@murumets-ee/content-api 0.3.0 → 0.4.5

package/LICENSE

@@ -0,0 +1,94 @@
+Elastic License 2.0 (ELv2)
+
+URL: https://www.elastic.co/licensing/elastic-license
+
+## Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+## Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject
+to the limitations and conditions below.
+
+## Limitations
+
+You may not provide the software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set
+of the features or functionality of the software.
+
+You may not move, change, disable, or circumvent the license key functionality
+in the software, and you may not remove or obscure any functionality in the
+software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other
+notices of the licensor in the software. Any use of the licensor's trademarks
+is subject to applicable law.
+
+## Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the software. If you or your company make any written claim that the software
+infringes or contributes to infringement of any patent, your patent license
+for the software granted under these terms ends immediately. If your company
+makes such a claim, your patent license ends immediately for work on behalf
+of your company.
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from
+you also gets a copy of these terms.
+
+If you modify the software, you must include in any modified copies of the
+software prominent notices stating that you have modified the software.
+
+## No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+## Termination
+
+If you use the software in violation of these terms, such use is not licensed,
+and your licenses will automatically terminate. If the licensor provides you
+with a notice of your violation, and you cease all violation of this license
+no later than 30 days after you receive that notice, your licenses will be
+reinstated retroactively. However, if you violate these terms after such
+reinstatement, any additional violation of these terms will cause your
+licenses to terminate automatically and permanently.
+
+## No Liability
+
+As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of
+legal claim.
+
+## Definitions
+
+The **licensor** is the entity offering these terms, and the **software** is
+the software the licensor makes available under these terms, including any
+portion of it.
+
+**you** refers to the individual or entity agreeing to these terms.
+
+**your company** is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that organization.
+**control** means ownership of substantially all the assets of an entity, or
+the power to direct the management and policies of an entity (for example, by
+voting right, contract, or otherwise). Control can be direct or indirect.
+
+**your licenses** are all the licenses granted to you for the software under
+these terms.
+
+**use** means anything you do with the software requiring one of your
+licenses.
+
+**trademark** means trademarks, service marks, and similar rights.

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/handler.ts","../src/schema-endpoint.ts"],"mappings":";;;;;UAciB,UAAA;EAYA;EAVf,cAAA;;EAEA,MAAA;AAAA;;UAQe,iBAAA;EAMN;EAJT,MAAA;EAQe;EANf,oBAAA;;EAEA,SAAA;AAAA;;UAIe,WAAA;EAMJ;EAJX,aAAA;EAI2C;EAF3C,2BAAA;EAUe;EARf,QAAA,GAAW,MAAA,SAAe,iBAAA;AAAA;;UAQX,gBAAA;EASQ;EAPvB,QAAA,EAAU,MAAA;EAeuB;;;;;EARjC,eAAA,QAAuB,OAAA,CAAQ,iBAAA;EAPrB;;;;;;EAeV,YAAA,IAAgB,GAAA,EAAK,OAAA,KAAY,OAAA;IAAU,IAAA;EAAA;EAM3C;;;;EAAA,UAAA;EASQ;EANR,aAAA;EAYA;EATA,IAAA,GAAO,UAAA;EAS2B;EANlC,KAAA,GAAQ,WAAA;EAM4D;EAHpE,QAAA;EAGkF;EAAlF,OAAA,IAAW,GAAA;IAAO,MAAA;IAAgB,OAAA;IAAiB,MAAA;IAAiB,IAAA;EAAA;AAAA;AAAA,UAOrD,mBAAA,KAAwB,MAAA;EACvC,IAAA,EAAM,CAAA;EACN,IAAA;IACE,KAAA;IACA,KAAA;IACA,MAAA;IACA,OAAA,WAEA;IAAA,UAAA;EAAA;AAAA;AAAA,UAIa,qBAAA,KAA0B,MAAA;EACzC,IAAA,EAAM,CAAA;AAAA;AAAA,UAGS,oBAAA;EACf,IAAA;IAAQ,KAAA;EAAA;AAAA;AAAA,UAGO,oBAAA;EACf,KAAA;IACE,MAAA;IACA,OAAA;IACA,IAAA;EAAA;AAAA;;UASa,WAAA;EACf,IAAA;EACA,QAAA;EACA,OAAA;EACA,WAAA;AAAA;;UAIe,YAAA;EACf,IAAA;EACA,UAAA;EACA,MAAA,EAAQ,MAAA,SAAe,WAAA;AAAA;;UAIR,cAAA;EACf,QAAA,EAAU,YAAA;AAAA;;UAQK,YAAA;EACf,MAAA,EAAQ,OAAA;IAAU,IAAA;EAAA;AAAA;;;iBCHJ,uBAAA,CAAwB,MAAA,EAAQ,gBAAA;aAsWjC,OAAA,EAAO,GAAA,EAAO,YAAA,KAAY,OAAA,CAAA,QAAA;iBACtB,OAAA,KAAO,QAAA;AAAA;;;;iBC1dV,cAAA,CAAe,MAAA,EAAQ,MAAA,GAAS,YAAA;;;;AFChD;iBEoBgB,mBAAA,CACd,QAAA,EAAU,MAAA,IACV,eAAA,GAAkB,UAAA,uBACjB,cAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/handler.ts","../src/schema-endpoint.ts"],"mappings":";;;;;UAciB,UAAA;EAYA;EAVf,cAAA;;EAEA,MAAA;AAAA;;UAQe,iBAAA;EAMN;EAJT,MAAA;EAQe;EANf,oBAAA;;EAEA,SAAA;AAAA;;UAIe,WAAA;EAMJ;EAJX,aAAA;EAI2C;EAF3C,2BAAA;EAUe;EARf,QAAA,GAAW,MAAA,SAAe,iBAAA;AAAA;;UAQX,gBAAA;EASQ;EAPvB,QAAA,EAAU,MAAA;EAeuB;;;;;EARjC,eAAA,QAAuB,OAAA,CAAQ,iBAAA;EAPrB;;;;;;EAeV,YAAA,IAAgB,GAAA,EAAK,OAAA,KAAY,OAAA;IAAU,IAAA;EAAA;EAM3C;;;;EAAA,UAAA;EASQ;EANR,aAAA;EAYA;EATA,IAAA,GAAO,UAAA;EAS2B;EANlC,KAAA,GAAQ,WAAA;EAM4D;EAHpE,QAAA;EAGkF;EAAlF,OAAA,IAAW,GAAA;IAAO,MAAA;IAAgB,OAAA;IAAiB,MAAA;IAAiB,IAAA;EAAA;AAAA;AAAA,UAOrD,mBAAA,KAAwB,MAAA;EACvC,IAAA,EAAM,CAAA;EACN,IAAA;IACE,KAAA;IACA,KAAA;IACA,MAAA;IACA,OAAA,WAEA;IAAA,UAAA;EAAA;AAAA;AAAA,UAIa,qBAAA,KAA0B,MAAA;EACzC,IAAA,EAAM,CAAA;AAAA;AAAA,UAGS,oBAAA;EACf,IAAA;IAAQ,KAAA;EAAA;AAAA;AAAA,UAGO,oBAAA;EACf,KAAA;IACE,MAAA;IACA,OAAA;IACA,IAAA;EAAA;AAAA;;UASa,WAAA;EACf,IAAA;EACA,QAAA;EACA,OAAA;EACA,WAAA;AAAA;;UAIe,YAAA;EACf,IAAA;EACA,UAAA;EACA,MAAA,EAAQ,MAAA,SAAe,WAAA;AAAA;;UAIR,cAAA;EACf,QAAA,EAAU,YAAA;AAAA;;UAQK,YAAA;EACf,MAAA,EAAQ,OAAA;IAAU,IAAA;EAAA;AAAA;;;iBCHJ,uBAAA,CAAwB,MAAA,EAAQ,gBAAA;aAkXjC,OAAA,EAAO,GAAA,EAAO,YAAA,KAAY,OAAA,CAAA,QAAA;iBACtB,OAAA,KAAO,QAAA;AAAA;;;;iBCteV,cAAA,CAAe,MAAA,EAAQ,MAAA,GAAS,YAAA;;;;AFChD;iBEoBgB,mBAAA,CACd,QAAA,EAAU,MAAA,IACV,eAAA,GAAkB,UAAA,uBACjB,cAAA"}

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import{getApp as e}from"@murumets-ee/core";import{schemaRegistry as t}from"@murumets-ee/db";import{CountCache as n,decodeCursor as r,encodeCursor as i,estimateRowCount as a}from"@murumets-ee/entity";import{QueryClient as o}from"@murumets-ee/entity/query";import{and as s,asc as c,desc as l,eq as u,gte as d,ilike as f,inArray as p,lte as m,or as h}from"drizzle-orm";import{z as g}from"zod";function _(e,t){let n=t?.entities?.[e];if(n?.cacheable===!1)return{"Cache-Control":`no-store`};let r=n?.maxAge??t?.defaultMaxAge??60,i=n?.staleWhileRevalidate??t?.defaultStaleWhileRevalidate??300;return{"Cache-Control":`public, max-age=${r}, stale-while-revalidate=${i}`}}function v(e,t){if(!t)return{};let n=e.headers.get(`Origin`);return!n||!t.allowedOrigins.includes(n)?{}:{"Access-Control-Allow-Origin":n,"Access-Control-Allow-Methods":`GET, OPTIONS`,"Access-Control-Allow-Headers":`Content-Type, Accept, Authorization`,"Access-Control-Max-Age":String(t.maxAge??3600),Vary:`Origin`}}function y(e,t){let n=v(e,t);return new Response(null,{status:204,headers:n})}const b=g.object({limit:g.coerce.number().int().min(1).max(100).default(20),offset:g.coerce.number().int().min(0).default(0),sort:g.string().regex(/^-?[a-zA-Z_]+$/).optional(),locale:g.string().regex(/^[a-z]{2}(-[A-Z]{2})?$/).optional(),fields:g.string().optional(),search:g.string().max(200).optional(),cursor:g.string().max(500).optional()}),x=g.object({locale:g.string().regex(/^[a-z]{2}(-[A-Z]{2})?$/).optional(),fields:g.string().optional()}),S=g.object({locale:g.string().regex(/^[a-z]{2}(-[A-Z]{2})?$/).optional()});function C(e){return e.replace(/[%_\\]/g,`\\$&`)}const w=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function T(e,t){switch(e.type){case`boolean`:return t===`true`?!0:t===`false`?!1:null;case`reference`:case`media`:return w.test(t)?t:null;case`select`:return e.options.includes(t)?t:null;case`date`:return t;case`text`:case`number`:return t;default:return null}}function E(e,t){if(!e)return;let n=e.split(`,`).map(e=>e.trim()).filter(e=>e in t&&!e.startsWith(`_`)&&t[e].type!==`blocks`);return n.length>0&&!n.includes(`id`)&&n.unshift(`id`),n.length>0?n:void 0}function D(e,t=200,n){return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":`application/json`,...n}})}function O(e,t,n,r){return D({error:{status:n,message:e,code:t}},n,r)}function k(e){return O(`Not found`,`NOT_FOUND`,404,e)}function A(e){let t={type:e.type};return e.required&&(t.required=!0),e.type===`select`&&(t.options=e.options),e.type===`reference`&&(t.cardinality=e.cardinality),t}function j(e){let t=e.allFields,n={};for(let[e,r]of Object.entries(t))e.startsWith(`_`)||(n[e]=A(r));return{name:e.name,pluralName:`${e.name}s`,fields:n}}function M(e,t){return{entities:e.filter(e=>t(e.name)).map(j)}}function N(e){let t=new Map;for(let n of e)t.set(n.name,n),t.set(`${n.name}s`,n);return t}function P(e,n){let r=t.get(e.name);if(!r)return;let i=e.allFields;for(let[e,t]of Object.entries(i))if(t.type===`text`&&(t.indexed||t.required)){let t=r[e];if(t)return f(t,`%${C(n)}%`)}}function F(e,n,r){if(!n)return;let i=n.startsWith(`-`),a=i?n.slice(1):n,o=r[a];if(!o||o.type===`blocks`)return;let s=t.get(e);if(!(!s||!s[a]))return i?l(s[a]):c(s[a])}function I(e,n,r){let i=t.get(e);if(!i)return[];let a=[];for(let[e,t]of n.searchParams.entries()){let n=e.match(/^filter\[([a-zA-Z_]+)\]$/);if(!n)continue;let o=n[1],s=r[o];if(!s||s.type===`blocks`)continue;let c=i[o];if(!c)continue;if(s.type===`date`){t.startsWith(`gte:`)?a.push(d(c,t.slice(4))):t.startsWith(`lte:`)?a.push(m(c,t.slice(4))):a.push(u(c,t));continue}let l=T(s,t);l!==null&&a.push(u(c,l))}return a}function L(c){let{entities:l,defaultLocale:d,publicRole:f=`public`,cors:m,cache:g,onError:C}=c,w=Math.min(c.maxLimit??100,100),T=N(l),A=new n(5e3),j=null,L=0;async function R(){let e=Date.now();return(!j||e-L>3e4)&&(j=await c.loadPermissions(),L=e),j}async function z(e){if(!c.authenticate)return f;try{return(await c.authenticate(e))?.role??f}catch{return f}}function B(e,t,n){return e(t,n,`view`)}function V(t){let n=e();return new o({entity:t,db:n.db.readOnly,logger:n.logger.child({entity:t.name}),countCache:A})}async function H(e,t,n){let a=new URL(e.url),o=b.safeParse(Object.fromEntries(a.searchParams));if(!o.success)return O(`Invalid query parameters`,`VALIDATION_ERROR`,400,n);let{limit:c,offset:l,sort:u,locale:f,fields:p,search:m,cursor:h}=o.data,v=Math.min(c,w),y=t.allFields,x;if(h){let e=r(h);if(!e)return O(`Invalid cursor`,`VALIDATION_ERROR`,400,n);if(!(e.field in y)&&e.field!==`id`)return O(`Invalid cursor field`,`VALIDATION_ERROR`,400,n);x=e}let S=[];if(m){let e=P(t,m);e&&S.push(e)}let C=I(t.name,a,y);S.push(...C);let T=F(t.name,u,y),k=E(p,y),A=V(t),j=f??d,M={where:S.length>0?s(...S):void 0,limit:v,offset:l,orderBy:T,select:k,locale:j,defaultLocale:d,cursor:x},[N,L]=await Promise.all([A.findMany(M),A.count({where:S.length>0?s(...S):void 0})]),R;if(N.length>0&&N.length===v){let e=N[N.length-1],t=x?.field??(u?u.startsWith(`-`)?u.slice(1):u:void 0),n=x?.direction??(u?.startsWith(`-`)?`desc`:`asc`);t&&e[t]!==void 0&&(R=i(e,t,n))}let z={...n,..._(t.name,g)};return D({data:N,meta:{total:L,limit:v,offset:l,hasMore:l+v<L,nextCursor:R}},200,z)}async function U(t,n,r){let i=new URL(t.url);return S.safeParse(Object.fromEntries(i.searchParams)).success?i.searchParams.get(`countMode`)===`estimate`?D({data:{count:await a(e().db.readOnly,n.name),estimate:!0}},200,{...r,..._(n.name,g)}):D({data:{count:await V(n).count()}},200,{...r,..._(n.name,g)}):O(`Invalid query parameters`,`VALIDATION_ERROR`,400,r)}async function W(e,t,n,r){let i=new URL(e.url),a=x.safeParse(Object.fromEntries(i.searchParams));if(!a.success)return O(`Invalid query parameters`,`VALIDATION_ERROR`,400,r);let{locale:o,fields:s}=a.data,c=t.allFields,l=E(s,c),u=o??d,f=await V(t).findById(n,{select:l,locale:u,defaultLocale:d});return f?D({data:f},200,{...r,..._(t.name,g)}):k(r)}async function G(n,r,i,a){let o=new URL(n.url),c=x.safeParse(Object.fromEntries(o.searchParams));if(!c.success)return O(`Invalid query parameters`,`VALIDATION_ERROR`,400,a);let l=r.allFields;if(!l.slug)return k(a);let{locale:f,fields:m}=c.data,v=E(m,l),y=f??d,b=t.get(r.name);if(!b?.slug)return k(a);let S=V(r),C=l.slug,w=u(b.slug,i);if(C.translatable&&y){let n=`${r.name}_translations`,a=t.get(n);if(a?.slug){let t=await e().db.readOnly.select({entityId:a.entityId}).from(a).where(s(u(a.slug,i),u(a.locale,y)));if(t.length>0){let e=t.map(e=>e.entityId);w=h(p(b.id,e),u(b.slug,i))}}}let T=await S.findMany({where:w,limit:1,select:v,locale:y,defaultLocale:d});return T.length===0?k(a):D({data:T[0]},200,{...a,..._(r.name,g)})}async function K(e,t){let n=v(e,m);try{let r=await t.params.then(e=>e.path);if(!r||r.length===0)return k(n);let i=await z(e),a=await R();if(r[0]===`_schema`)return D(M(l,e=>B(a,i,e)),200,{...n,"Cache-Control":`no-store`});let o=r[0],s=T.get(o)??T.get(o.endsWith(`s`)?o.slice(0,-1):o);return!s||!B(a,i,s.name)?k(n):r.length===1?H(e,s,n):r[1]===`count`?U(e,s,n):r[1]===`slug`&&r[2]?G(e,s,r[2],n):r.length===2?W(e,s,r[1],n):k(n)}catch(t){let r=t instanceof Error?t.message:`Internal server error`;return console.error(`[content-api] handler error:`,t),C?.({status:500,message:r,path:new URL(e.url).pathname}),O(`Internal server error`,`INTERNAL_ERROR`,500,n)}}return{GET:(e,t)=>K(e,t),OPTIONS:e=>y(e,m)}}export{M as buildSchemaResponse,L as createContentApiHandler,j as toSchemaEntity};
+import{LOCALE_PATTERN as e,escapeLikePattern as t,getApp as n,getContext as r,runWithContextAsync as i}from"@murumets-ee/core";import{schemaRegistry as a}from"@murumets-ee/db";import{CountCache as o,decodeCursor as s,encodeCursor as c,estimateRowCount as l}from"@murumets-ee/entity";import{QueryClient as u}from"@murumets-ee/entity/query";import{and as d,asc as f,desc as p,eq as m,gte as h,ilike as g,inArray as _,lte as v,or as y}from"drizzle-orm";import{z as b}from"zod";function x(e,t){let n=t?.entities?.[e];if(n?.cacheable===!1)return{"Cache-Control":`no-store`};let r=n?.maxAge??t?.defaultMaxAge??60,i=n?.staleWhileRevalidate??t?.defaultStaleWhileRevalidate??300;return{"Cache-Control":`public, max-age=${r}, stale-while-revalidate=${i}`}}function S(e,t){if(!t)return{};let n=e.headers.get(`Origin`);return!n||!t.allowedOrigins.includes(n)?{}:{"Access-Control-Allow-Origin":n,"Access-Control-Allow-Methods":`GET, OPTIONS`,"Access-Control-Allow-Headers":`Content-Type, Accept, Authorization`,"Access-Control-Max-Age":String(t.maxAge??3600),Vary:`Origin`}}function C(e,t){let n=S(e,t);return new Response(null,{status:204,headers:n})}const w=b.object({limit:b.coerce.number().int().min(1).max(100).default(20),offset:b.coerce.number().int().min(0).default(0),sort:b.string().regex(/^-?[a-zA-Z_]+$/).optional(),locale:b.string().regex(e).optional(),fields:b.string().optional(),search:b.string().max(200).optional(),cursor:b.string().max(500).optional()}),T=b.object({locale:b.string().regex(e).optional(),fields:b.string().optional()}),E=b.object({locale:b.string().regex(e).optional()}),D=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function O(e,t){switch(e.type){case`boolean`:return t===`true`?!0:t===`false`?!1:null;case`reference`:case`media`:return D.test(t)?t:null;case`select`:return e.options.includes(t)?t:null;case`date`:return t;case`text`:case`number`:return t;default:return null}}function k(e,t){if(!e)return;let n=e.split(`,`).map(e=>e.trim()).filter(e=>e in t&&!e.startsWith(`_`)&&t[e].type!==`blocks`);return n.length>0&&!n.includes(`id`)&&n.unshift(`id`),n.length>0?n:void 0}function A(e,t=200,n){return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":`application/json`,...n}})}function j(e,t,n,r){return A({error:{status:n,message:e,code:t}},n,r)}function M(e){return j(`Not found`,`NOT_FOUND`,404,e)}function N(e){let t={type:e.type};return e.required&&(t.required=!0),e.type===`select`&&(t.options=e.options),e.type===`reference`&&(t.cardinality=e.cardinality),t}function P(e){let t=e.allFields,n={};for(let[e,r]of Object.entries(t))e.startsWith(`_`)||(n[e]=N(r));return{name:e.name,pluralName:`${e.name}s`,fields:n}}function F(e,t){return{entities:e.filter(e=>t(e.name)).map(P)}}function I(e){let t=new Map;for(let n of e)t.set(n.name,n),t.set(`${n.name}s`,n);return t}function L(e,n){let r=a.get(e.name);if(!r)return;let i=e.allFields;for(let[e,a]of Object.entries(i))if(a.type===`text`&&(a.indexed||a.required)){let i=r[e];if(i)return g(i,`%${t(n)}%`)}}function R(e,t,n){if(!t)return;let r=t.startsWith(`-`),i=r?t.slice(1):t,o=n[i];if(!o||o.type===`blocks`)return;let s=a.get(e);if(!(!s||!s[i]))return r?p(s[i]):f(s[i])}function z(e,t,n){let r=a.get(e);if(!r)return[];let i=[];for(let[e,a]of t.searchParams.entries()){let t=e.match(/^filter\[([a-zA-Z_]+)\]$/);if(!t)continue;let o=t[1],s=n[o];if(!s||s.type===`blocks`)continue;let c=r[o];if(!c)continue;if(s.type===`date`){a.startsWith(`gte:`)?i.push(h(c,a.slice(4))):a.startsWith(`lte:`)?i.push(v(c,a.slice(4))):i.push(m(c,a));continue}let l=O(s,a);l!==null&&i.push(m(c,l))}return i}function B(e){let{entities:t,defaultLocale:f,publicRole:p=`public`,cors:h,cache:g,onError:v}=e,b=Math.min(e.maxLimit??100,100),D=I(t),O=new o(5e3),N=null,P=0;async function B(){let t=Date.now();return(!N||t-P>3e4)&&(N=await e.loadPermissions(),P=t),N}async function V(t){if(!e.authenticate)return p;try{return(await e.authenticate(t))?.role??p}catch{return p}}function H(e,t,n){return e(t,n,`view`)}function U(e){let t=n();return new u({entity:e,db:t.db.readOnly,logger:t.logger.child({entity:e.name}),countCache:O,contextResolver:()=>{let e=r();if(!(!e?.user||!e?.checker))return{user:e.user,checker:e.checker,scope:e.scope}}})}async function W(e,t,n){let r=new URL(e.url),i=w.safeParse(Object.fromEntries(r.searchParams));if(!i.success)return j(`Invalid query parameters`,`VALIDATION_ERROR`,400,n);let{limit:a,offset:o,sort:l,locale:u,fields:p,search:m,cursor:h}=i.data,_=Math.min(a,b),v=t.allFields,y;if(h){let e=s(h);if(!e)return j(`Invalid cursor`,`VALIDATION_ERROR`,400,n);if(!(e.field in v)&&e.field!==`id`)return j(`Invalid cursor field`,`VALIDATION_ERROR`,400,n);y=e}let S=[];if(m){let e=L(t,m);e&&S.push(e)}let C=z(t.name,r,v);S.push(...C);let T=R(t.name,l,v),E=k(p,v),D=U(t),O=u??f,M={where:S.length>0?d(...S):void 0,limit:_,offset:o,orderBy:T,select:E,locale:O,defaultLocale:f,cursor:y},[N,P]=await Promise.all([D.findMany(M),D.count({where:S.length>0?d(...S):void 0})]),F;if(N.length>0&&N.length===_){let e=N[N.length-1],t=y?.field??(l?l.startsWith(`-`)?l.slice(1):l:void 0),n=y?.direction??(l?.startsWith(`-`)?`desc`:`asc`);t&&e[t]!==void 0&&(F=c(e,t,n))}let I={...n,...x(t.name,g)};return A({data:N,meta:{total:P,limit:_,offset:o,hasMore:o+_<P,nextCursor:F}},200,I)}async function G(e,t,r){let i=new URL(e.url);return E.safeParse(Object.fromEntries(i.searchParams)).success?i.searchParams.get(`countMode`)===`estimate`?A({data:{count:await l(n().db.readOnly,t.name),estimate:!0}},200,{...r,...x(t.name,g)}):A({data:{count:await U(t).count()}},200,{...r,...x(t.name,g)}):j(`Invalid query parameters`,`VALIDATION_ERROR`,400,r)}async function K(e,t,n,r){let i=new URL(e.url),a=T.safeParse(Object.fromEntries(i.searchParams));if(!a.success)return j(`Invalid query parameters`,`VALIDATION_ERROR`,400,r);let{locale:o,fields:s}=a.data,c=t.allFields,l=k(s,c),u=o??f,d=await U(t).findById(n,{select:l,locale:u,defaultLocale:f});return d?A({data:d},200,{...r,...x(t.name,g)}):M(r)}async function q(e,t,r,i){let o=new URL(e.url),s=T.safeParse(Object.fromEntries(o.searchParams));if(!s.success)return j(`Invalid query parameters`,`VALIDATION_ERROR`,400,i);let c=t.allFields;if(!c.slug)return M(i);let{locale:l,fields:u}=s.data,p=k(u,c),h=l??f,v=a.get(t.name);if(!v?.slug)return M(i);let b=U(t),S=c.slug,C=m(v.slug,r);if(S.translatable&&h){let e=`${t.name}_translations`,i=a.get(e);if(i?.slug){let e=await n().db.readOnly.select({entityId:i.entityId}).from(i).where(d(m(i.slug,r),m(i.locale,h)));if(e.length>0){let t=e.map(e=>e.entityId);C=y(_(v.id,t),m(v.slug,r))}}}let w=await b.findMany({where:C,limit:1,select:p,locale:h,defaultLocale:f});return w.length===0?M(i):A({data:w[0]},200,{...i,...x(t.name,g)})}async function J(e,n){let r=S(e,h);try{let a=await n.params.then(e=>e.path);if(!a||a.length===0)return M(r);let o=await V(e),s=await B();return await i({user:{id:`public`,groups:o?[o]:[]},checker:s},async()=>{if(a[0]===`_schema`)return A(F(t,e=>H(s,o,e)),200,{...r,"Cache-Control":`no-store`});let n=a[0],i=D.get(n)??D.get(n.endsWith(`s`)?n.slice(0,-1):n);return!i||!H(s,o,i.name)?M(r):a.length===1?W(e,i,r):a[1]===`count`?G(e,i,r):a[1]===`slug`&&a[2]?q(e,i,a[2],r):a.length===2?K(e,i,a[1],r):M(r)})}catch(t){let n=t instanceof Error?t.message:`Internal server error`;return console.error(`[content-api] handler error:`,t),v?.({status:500,message:n,path:new URL(e.url).pathname}),j(`Internal server error`,`INTERNAL_ERROR`,500,r)}}return{GET:(e,t)=>J(e,t),OPTIONS:e=>C(e,h)}}export{F as buildSchemaResponse,B as createContentApiHandler,P as toSchemaEntity};
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/cache.ts","../src/cors.ts","../src/query-params.ts","../src/response.ts","../src/schema-endpoint.ts","../src/handler.ts"],"sourcesContent":["/**\n * Cache-Control header builder.\n *\n * Defaults: public, max-age=60, stale-while-revalidate=300.\n * Per-entity overrides for hot content (low TTL) vs static pages (high TTL).\n */\n\nimport type { CacheConfig } from './types.js'\n\nexport function buildCacheHeaders(\n  entityName: string,\n  config: CacheConfig | undefined,\n): Record<string, string> {\n  const entityConfig = config?.entities?.[entityName]\n\n  if (entityConfig?.cacheable === false) {\n    return { 'Cache-Control': 'no-store' }\n  }\n\n  const maxAge = entityConfig?.maxAge ?? config?.defaultMaxAge ?? 60\n  const swr = entityConfig?.staleWhileRevalidate ?? config?.defaultStaleWhileRevalidate ?? 300\n\n  return {\n    'Cache-Control': `public, max-age=${maxAge}, stale-while-revalidate=${swr}`,\n  }\n}\n","/**\n * CORS — Origin allowlist with exact match.\n *\n * No wildcards, no regex. This is a CMS content API — you know which\n * frontends consume it. Vary: Origin ensures CDNs cache per-origin.\n */\n\nimport type { CorsConfig } from './types.js'\n\nexport function buildCorsHeaders(\n  req: Request,\n  config: CorsConfig | undefined,\n): Record<string, string> {\n  if (!config) return {}\n\n  const origin = req.headers.get('Origin')\n  if (!origin) return {}\n\n  // Exact match only\n  if (!config.allowedOrigins.includes(origin)) return {}\n\n  return {\n    'Access-Control-Allow-Origin': origin,\n    'Access-Control-Allow-Methods': 'GET, OPTIONS',\n    'Access-Control-Allow-Headers': 'Content-Type, Accept, Authorization',\n    'Access-Control-Max-Age': String(config.maxAge ?? 3600),\n    Vary: 'Origin',\n  }\n}\n\nexport function corsPreflightResponse(req: Request, config: CorsConfig | undefined): Response {\n  const headers = buildCorsHeaders(req, config)\n  return new Response(null, { status: 204, headers })\n}\n","/**\n * Query parameter validation — Zod schemas for all content API endpoints.\n *\n * All user input is validated before it touches QueryClient.\n * Pagination hard-capped at MAX_LIMIT. Sort/filter restricted to queryable columns.\n */\n\nimport type { FieldConfig } from '@murumets-ee/entity'\nimport { z } from 'zod'\n\nexport const MAX_LIMIT = 100\n\n/** List endpoint query params. */\nexport const listParamsSchema = z.object({\n  limit: z.coerce.number().int().min(1).max(MAX_LIMIT).default(20),\n  offset: z.coerce.number().int().min(0).default(0),\n  sort: z\n    .string()\n    .regex(/^-?[a-zA-Z_]+$/)\n    .optional(),\n  locale: z\n    .string()\n    .regex(/^[a-z]{2}(-[A-Z]{2})?$/)\n    .optional(),\n  fields: z.string().optional(),\n  search: z.string().max(200).optional(),\n  /** Opaque cursor for keyset pagination (base64-encoded JSON). */\n  cursor: z.string().max(500).optional(),\n})\n\n/** Single entity query params. */\nexport const singleParamsSchema = z.object({\n  locale: z\n    .string()\n    .regex(/^[a-z]{2}(-[A-Z]{2})?$/)\n    .optional(),\n  fields: z.string().optional(),\n})\n\n/** Count endpoint query params. */\nexport const countParamsSchema = z.object({\n  locale: z\n    .string()\n    .regex(/^[a-z]{2}(-[A-Z]{2})?$/)\n    .optional(),\n})\n\n/** Escape LIKE wildcards to prevent wildcard injection in search queries. */\nexport function escapeLikePattern(s: string): string {\n  return s.replace(/[%_\\\\]/g, '\\\\$&')\n}\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\n/**\n * Validate a filter value against the field type.\n * Returns the validated value or null if invalid.\n */\nexport function validateFilterValue(fieldConfig: FieldConfig, raw: string): unknown {\n  switch (fieldConfig.type) {\n    case 'boolean':\n      if (raw === 'true') return true\n      if (raw === 'false') return false\n      return null\n\n    case 'reference':\n    case 'media':\n      return UUID_RE.test(raw) ? raw : null\n\n    case 'select':\n      return fieldConfig.options.includes(raw) ? raw : null\n\n    case 'date':\n      // Plain date or gte:/lte: prefix handled by caller\n      return raw\n\n    case 'text':\n    case 'number':\n      return raw\n\n    default:\n      return null\n  }\n}\n\n/**\n * Parse field selection string into validated field names.\n * Unknown/internal field names are silently dropped (no info leakage).\n */\nexport function parseFieldSelection(\n  fieldsParam: string | undefined,\n  allFields: Record<string, FieldConfig>,\n): string[] | undefined {\n  if (!fieldsParam) return undefined\n\n  const requested = fieldsParam.split(',').map((f) => f.trim())\n  const valid = requested.filter(\n    (name) => name in allFields && !name.startsWith('_') && allFields[name].type !== 'blocks',\n  )\n\n  // Always include id\n  if (valid.length > 0 && !valid.includes('id')) {\n    valid.unshift('id')\n  }\n\n  return valid.length > 0 ? valid : undefined\n}\n","/**\n * Response helpers — JSON envelope builders.\n */\n\nexport function jsonResponse(\n  data: unknown,\n  status = 200,\n  extraHeaders?: Record<string, string>,\n): Response {\n  return new Response(JSON.stringify(data), {\n    status,\n    headers: {\n      'Content-Type': 'application/json',\n      ...extraHeaders,\n    },\n  })\n}\n\nexport function errorResponse(\n  message: string,\n  code: string,\n  status: number,\n  extraHeaders?: Record<string, string>,\n): Response {\n  return jsonResponse({ error: { status, message, code } }, status, extraHeaders)\n}\n\nexport function notFoundResponse(extraHeaders?: Record<string, string>): Response {\n  return errorResponse('Not found', 'NOT_FOUND', 404, extraHeaders)\n}\n","/**\n * Schema introspection endpoint — GET /_schema\n *\n * Returns public-safe entity metadata for SDK generation.\n * Only exposes: type, required, options (select), cardinality (reference).\n * Internal fields (_version, _scopeId) excluded.\n * No hooks, behaviors, access rules, or implementation details.\n *\n * Response is filtered by the caller's role permissions — only entities\n * the role can 'view' are included.\n */\n\nimport type { Entity, FieldConfig } from '@murumets-ee/entity'\nimport type { SchemaEntity, SchemaField, SchemaResponse } from './types.js'\n\n/** Convert a FieldConfig to the public-safe SchemaField subset. */\nfunction toSchemaField(config: FieldConfig): SchemaField {\n  const field: SchemaField = { type: config.type }\n\n  if (config.required) {\n    field.required = true\n  }\n\n  if (config.type === 'select') {\n    field.options = config.options\n  }\n\n  if (config.type === 'reference') {\n    field.cardinality = config.cardinality\n  }\n\n  return field\n}\n\n/** Convert an Entity to public-safe schema metadata. */\nexport function toSchemaEntity(entity: Entity): SchemaEntity {\n  const allFields = entity.allFields as Record<string, FieldConfig>\n  const fields: Record<string, SchemaField> = {}\n\n  for (const [name, config] of Object.entries(allFields)) {\n    // Skip internal fields\n    if (name.startsWith('_')) continue\n    fields[name] = toSchemaField(config)\n  }\n\n  return {\n    name: entity.name,\n    pluralName: `${entity.name}s`,\n    fields,\n  }\n}\n\n/**\n * Build the full /_schema response.\n * Only includes entities that pass the permission check.\n */\nexport function buildSchemaResponse(\n  entities: Entity[],\n  checkPermission: (entityName: string) => boolean,\n): SchemaResponse {\n  const visible = entities.filter((e) => checkPermission(e.name))\n  return {\n    entities: visible.map(toSchemaEntity),\n  }\n}\n","/**\n * Content API handler factory\n *\n * Creates a read-only catch-all route handler for public content delivery.\n * Mirrors the `createAdminApiHandler` pattern but with:\n * - No mutations (GET + OPTIONS only)\n * - Permission-gated (public role starts with 0 permissions)\n * - Published content only (QueryClient auto-filters)\n * - CORS + Cache-Control headers\n *\n * @example\n * ```typescript\n * // app/api/content/[...path]/route.ts\n * import { createContentApiHandler } from '@murumets-ee/content-api'\n * import { Article, Page } from '@/entities'\n *\n * const handler = createContentApiHandler({\n *   entities: [Article, Page],\n *   loadPermissions: async () => {\n *     const roles = await loadRoles(getApp())\n *     return buildPermissionChecker(roles)\n *   },\n *   cors: { allowedOrigins: ['https://www.example.com'] },\n * })\n *\n * export const { GET, OPTIONS } = handler\n * ```\n */\n\nimport type { PermissionChecker } from '@murumets-ee/core'\nimport { getApp } from '@murumets-ee/core'\nimport { schemaRegistry } from '@murumets-ee/db'\nimport type { CursorInput, Entity, FieldConfig, SlugField } from '@murumets-ee/entity'\nimport { CountCache, decodeCursor, encodeCursor, estimateRowCount } from '@murumets-ee/entity'\nimport { QueryClient } from '@murumets-ee/entity/query'\nimport { and, asc, desc, eq, gte, ilike, inArray, lte, or, type SQL } from 'drizzle-orm'\nimport type { PgTableWithColumns } from 'drizzle-orm/pg-core'\nimport { buildCacheHeaders } from './cache.js'\nimport { buildCorsHeaders, corsPreflightResponse } from './cors.js'\nimport {\n  countParamsSchema,\n  escapeLikePattern,\n  listParamsSchema,\n  MAX_LIMIT,\n  parseFieldSelection,\n  singleParamsSchema,\n  validateFilterValue,\n} from './query-params.js'\nimport { errorResponse, jsonResponse, notFoundResponse } from './response.js'\nimport { buildSchemaResponse } from './schema-endpoint.js'\nimport type { ContentApiConfig, RouteContext } from './types.js'\n\n// ---------------------------------------------------------------------------\n// Entity resolution (whitelist-based, same pattern as admin handler)\n// ---------------------------------------------------------------------------\n\nfunction buildEntityMap(entities: Entity[]): Map<string, Entity> {\n  const map = new Map<string, Entity>()\n  for (const entity of entities) {\n    map.set(entity.name, entity)\n    map.set(`${entity.name}s`, entity)\n  }\n  return map\n}\n\n// ---------------------------------------------------------------------------\n// Query helpers\n// ---------------------------------------------------------------------------\n\nfunction buildSearchCondition(entity: Entity, search: string): SQL | undefined {\n  // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n  const table = schemaRegistry.get(entity.name) as PgTableWithColumns<any> | undefined\n  if (!table) return undefined\n\n  const allFields = entity.allFields as Record<string, FieldConfig>\n  for (const [fieldName, config] of Object.entries(allFields)) {\n    if (config.type === 'text' && (config.indexed || config.required)) {\n      const column = table[fieldName]\n      if (column) return ilike(column, `%${escapeLikePattern(search)}%`)\n    }\n  }\n  return undefined\n}\n\nfunction buildOrderBy(\n  entityName: string,\n  sortParam: string | undefined,\n  allFields: Record<string, FieldConfig>,\n): SQL | undefined {\n  if (!sortParam) return undefined\n\n  const descending = sortParam.startsWith('-')\n  const fieldName = descending ? sortParam.slice(1) : sortParam\n\n  const fieldConfig = allFields[fieldName]\n  if (!fieldConfig || fieldConfig.type === 'blocks') return undefined\n\n  // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n  const table = schemaRegistry.get(entityName) as PgTableWithColumns<any> | undefined\n  if (!table || !table[fieldName]) return undefined\n\n  return descending ? desc(table[fieldName]) : asc(table[fieldName])\n}\n\nfunction buildFilterConditions(\n  entityName: string,\n  url: URL,\n  allFields: Record<string, FieldConfig>,\n): SQL[] {\n  // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n  const table = schemaRegistry.get(entityName) as PgTableWithColumns<any> | undefined\n  if (!table) return []\n\n  const conditions: SQL[] = []\n\n  for (const [key, raw] of url.searchParams.entries()) {\n    const match = key.match(/^filter\\[([a-zA-Z_]+)\\]$/)\n    if (!match) continue\n\n    const fieldName = match[1]\n    const fieldConfig = allFields[fieldName]\n    if (!fieldConfig || fieldConfig.type === 'blocks') continue\n\n    const column = table[fieldName]\n    if (!column) continue\n\n    // Date range filters: gte: / lte: prefix\n    if (fieldConfig.type === 'date') {\n      if (raw.startsWith('gte:')) {\n        conditions.push(gte(column, raw.slice(4)))\n      } else if (raw.startsWith('lte:')) {\n        conditions.push(lte(column, raw.slice(4)))\n      } else {\n        conditions.push(eq(column, raw))\n      }\n      continue\n    }\n\n    const validated = validateFilterValue(fieldConfig, raw)\n    if (validated === null) continue\n    conditions.push(eq(column, validated))\n  }\n\n  return conditions\n}\n\n// ---------------------------------------------------------------------------\n// Handler factory\n// ---------------------------------------------------------------------------\n\nexport function createContentApiHandler(config: ContentApiConfig) {\n  const {\n    entities,\n    defaultLocale,\n    publicRole = 'public',\n    cors: corsConfig,\n    cache: cacheConfig,\n    onError,\n  } = config\n  const maxLimit = Math.min(config.maxLimit ?? MAX_LIMIT, MAX_LIMIT)\n  const entityMap = buildEntityMap(entities)\n\n  // Shared count cache — reduces COUNT(*) queries on paginated list pages.\n  const countCache = new CountCache(5000)\n\n  // Lazy-loaded permission checker — cached with 30s TTL\n  const PERMISSION_CACHE_TTL_MS = 30_000\n  let permissionChecker: PermissionChecker | null = null\n  let permissionCacheTime = 0\n\n  async function getChecker(): Promise<PermissionChecker> {\n    const now = Date.now()\n    if (!permissionChecker || now - permissionCacheTime > PERMISSION_CACHE_TTL_MS) {\n      permissionChecker = await config.loadPermissions()\n      permissionCacheTime = now\n    }\n    return permissionChecker\n  }\n\n  // -- Role resolution -------------------------------------------------------\n\n  async function resolveRole(req: Request): Promise<string> {\n    if (!config.authenticate) return publicRole\n    try {\n      const result = await config.authenticate(req)\n      return result?.role ?? publicRole\n    } catch {\n      return publicRole\n    }\n  }\n\n  // -- Permission check (returns 404 on deny to avoid info leakage) ----------\n\n  function hasViewPermission(\n    checker: PermissionChecker,\n    role: string,\n    entityName: string,\n  ): boolean {\n    return checker(role, entityName, 'view')\n  }\n\n  // -- Create QueryClient from entity ----------------------------------------\n\n  function createClient(entity: Entity): QueryClient {\n    const app = getApp()\n    return new QueryClient({\n      entity,\n      db: app.db.readOnly,\n      logger: app.logger.child({ entity: entity.name }),\n      countCache,\n    })\n  }\n\n  // -- Endpoint handlers -----------------------------------------------------\n\n  async function handleList(\n    req: Request,\n    entity: Entity,\n    corsHeaders: Record<string, string>,\n  ): Promise<Response> {\n    const url = new URL(req.url)\n    const params = listParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n    if (!params.success) {\n      return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n    }\n\n    const {\n      limit: rawLimit,\n      offset,\n      sort,\n      locale,\n      fields,\n      search,\n      cursor: cursorParam,\n    } = params.data\n    const limit = Math.min(rawLimit, maxLimit)\n    const allFields = entity.allFields as Record<string, FieldConfig>\n\n    // Cursor-based pagination (opt-in, replaces OFFSET when provided)\n    let cursor: CursorInput | undefined\n    if (cursorParam) {\n      const decoded = decodeCursor(cursorParam)\n      if (!decoded) {\n        return errorResponse('Invalid cursor', 'VALIDATION_ERROR', 400, corsHeaders)\n      }\n      // Whitelist: cursor field must be a real field on the entity\n      if (!(decoded.field in allFields) && decoded.field !== 'id') {\n        return errorResponse('Invalid cursor field', 'VALIDATION_ERROR', 400, corsHeaders)\n      }\n      cursor = decoded\n    }\n\n    const where: SQL[] = []\n    if (search) {\n      const searchCondition = buildSearchCondition(entity, search)\n      if (searchCondition) where.push(searchCondition)\n    }\n\n    const filterConditions = buildFilterConditions(entity.name, url, allFields)\n    where.push(...filterConditions)\n\n    const orderBy = buildOrderBy(entity.name, sort, allFields)\n    const select = parseFieldSelection(fields, allFields)\n\n    const client = createClient(entity)\n    const resolvedLocale = locale ?? defaultLocale\n    const queryOpts = {\n      where: where.length > 0 ? and(...where) : undefined,\n      limit,\n      offset,\n      orderBy,\n      select,\n      locale: resolvedLocale,\n      defaultLocale,\n      cursor,\n    }\n\n    const [items, total] = await Promise.all([\n      client.findMany(queryOpts),\n      client.count({ where: where.length > 0 ? and(...where) : undefined }),\n    ])\n\n    // Build nextCursor from last item for keyset pagination\n    let nextCursor: string | undefined\n    if (items.length > 0 && items.length === limit) {\n      const lastItem = items[items.length - 1] as Record<string, unknown>\n      // Derive sort field and direction from cursor or sort param\n      const cursorField =\n        cursor?.field ?? (sort ? (sort.startsWith('-') ? sort.slice(1) : sort) : undefined)\n      const cursorDirection: 'asc' | 'desc' =\n        cursor?.direction ?? (sort?.startsWith('-') ? 'desc' : 'asc')\n      if (cursorField && lastItem[cursorField] !== undefined) {\n        nextCursor = encodeCursor(lastItem, cursorField, cursorDirection)\n      }\n    }\n\n    const headers = {\n      ...corsHeaders,\n      ...buildCacheHeaders(entity.name, cacheConfig),\n    }\n\n    return jsonResponse(\n      {\n        data: items,\n        meta: { total, limit, offset, hasMore: offset + limit < total, nextCursor },\n      },\n      200,\n      headers,\n    )\n  }\n\n  async function handleCount(\n    req: Request,\n    entity: Entity,\n    corsHeaders: Record<string, string>,\n  ): Promise<Response> {\n    const url = new URL(req.url)\n    const params = countParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n    if (!params.success) {\n      return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n    }\n\n    const countMode = url.searchParams.get('countMode')\n\n    // Fast path: use Postgres row estimate for unfiltered counts\n    if (countMode === 'estimate') {\n      const app = getApp()\n      const count = await estimateRowCount(app.db.readOnly, entity.name)\n      return jsonResponse({ data: { count, estimate: true } }, 200, {\n        ...corsHeaders,\n        ...buildCacheHeaders(entity.name, cacheConfig),\n      })\n    }\n\n    const client = createClient(entity)\n    const count = await client.count()\n\n    return jsonResponse({ data: { count } }, 200, {\n      ...corsHeaders,\n      ...buildCacheHeaders(entity.name, cacheConfig),\n    })\n  }\n\n  async function handleById(\n    req: Request,\n    entity: Entity,\n    id: string,\n    corsHeaders: Record<string, string>,\n  ): Promise<Response> {\n    const url = new URL(req.url)\n    const params = singleParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n    if (!params.success) {\n      return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n    }\n\n    const { locale, fields } = params.data\n    const allFields = entity.allFields as Record<string, FieldConfig>\n    const select = parseFieldSelection(fields, allFields)\n    const resolvedLocale = locale ?? defaultLocale\n\n    const client = createClient(entity)\n    const item = await client.findById(id, {\n      select,\n      locale: resolvedLocale,\n      defaultLocale,\n    })\n    if (!item) return notFoundResponse(corsHeaders)\n\n    return jsonResponse({ data: item }, 200, {\n      ...corsHeaders,\n      ...buildCacheHeaders(entity.name, cacheConfig),\n    })\n  }\n\n  async function handleBySlug(\n    req: Request,\n    entity: Entity,\n    slug: string,\n    corsHeaders: Record<string, string>,\n  ): Promise<Response> {\n    const url = new URL(req.url)\n    const params = singleParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n    if (!params.success) {\n      return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n    }\n\n    // Check entity has a slug field\n    const allFields = entity.allFields as Record<string, FieldConfig>\n    if (!allFields.slug) return notFoundResponse(corsHeaders)\n\n    const { locale, fields } = params.data\n    const select = parseFieldSelection(fields, allFields)\n    const resolvedLocale = locale ?? defaultLocale\n\n    // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n    const table = schemaRegistry.get(entity.name) as PgTableWithColumns<any> | undefined\n    if (!table?.slug) return notFoundResponse(corsHeaders)\n\n    const client = createClient(entity)\n    const slugConfig = allFields.slug as SlugField\n\n    // For translatable slugs, also search the translation table.\n    // A non-default locale's slug may live in {entity}_translations, not the main table.\n    let whereClause: SQL = eq(table.slug, slug)\n\n    if (slugConfig.translatable && resolvedLocale) {\n      const translationTableName = `${entity.name}_translations`\n      // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n      const translationTable = schemaRegistry.get(translationTableName) as\n        | PgTableWithColumns<any>\n        | undefined\n      if (translationTable?.slug) {\n        // Find entity IDs whose translated slug matches (for the requested locale)\n        const app = getApp()\n        const translationMatches = await app.db.readOnly\n          .select({ entityId: translationTable.entityId })\n          .from(translationTable)\n          .where(and(eq(translationTable.slug, slug), eq(translationTable.locale, resolvedLocale)))\n\n        if (translationMatches.length > 0) {\n          const translatedIds = translationMatches.map((r) => r.entityId as string)\n          // Match by translated slug OR by main table slug (fallback)\n          whereClause = or(inArray(table.id, translatedIds), eq(table.slug, slug))!\n        }\n      }\n    }\n\n    const results = await client.findMany({\n      where: whereClause,\n      limit: 1,\n      select,\n      locale: resolvedLocale,\n      defaultLocale,\n    })\n\n    if (results.length === 0) return notFoundResponse(corsHeaders)\n\n    return jsonResponse({ data: results[0] }, 200, {\n      ...corsHeaders,\n      ...buildCacheHeaders(entity.name, cacheConfig),\n    })\n  }\n\n  // -- Central dispatch -------------------------------------------------------\n\n  async function handleGet(req: Request, ctx: RouteContext): Promise<Response> {\n    const corsHeaders = buildCorsHeaders(req, corsConfig)\n\n    try {\n      const segments = await ctx.params.then((p) => p.path)\n      if (!segments || segments.length === 0) {\n        return notFoundResponse(corsHeaders)\n      }\n\n      // Resolve role + load permissions\n      const role = await resolveRole(req)\n      const checker = await getChecker()\n\n      // /_schema — entity introspection (filtered by role)\n      if (segments[0] === '_schema') {\n        const schema = buildSchemaResponse(entities, (name) =>\n          hasViewPermission(checker, role, name),\n        )\n        return jsonResponse(schema, 200, {\n          ...corsHeaders,\n          'Cache-Control': 'no-store',\n        })\n      }\n\n      // Resolve entity from whitelist\n      const entityName = segments[0]\n      const entity =\n        entityMap.get(entityName) ??\n        entityMap.get(entityName.endsWith('s') ? entityName.slice(0, -1) : entityName)\n\n      // Entity not in whitelist OR role lacks view permission → 404\n      if (!entity || !hasViewPermission(checker, role, entity.name)) {\n        return notFoundResponse(corsHeaders)\n      }\n\n      // Route to handler\n      if (segments.length === 1) {\n        return handleList(req, entity, corsHeaders)\n      }\n      if (segments[1] === 'count') {\n        return handleCount(req, entity, corsHeaders)\n      }\n      if (segments[1] === 'slug' && segments[2]) {\n        return handleBySlug(req, entity, segments[2], corsHeaders)\n      }\n      if (segments.length === 2) {\n        return handleById(req, entity, segments[1], corsHeaders)\n      }\n\n      return notFoundResponse(corsHeaders)\n    } catch (err) {\n      const message = err instanceof Error ? err.message : 'Internal server error'\n      console.error('[content-api] handler error:', err)\n      onError?.({\n        status: 500,\n        message,\n        path: new URL(req.url).pathname,\n      })\n      return errorResponse('Internal server error', 'INTERNAL_ERROR', 500, corsHeaders)\n    }\n  }\n\n  return {\n    GET: (req: Request, ctx: RouteContext) => handleGet(req, ctx),\n    OPTIONS: (req: Request) => corsPreflightResponse(req, corsConfig),\n  }\n}\n"],"mappings":"sYASA,SAAgB,EACd,EACA,EACwB,CACxB,IAAM,EAAe,GAAQ,WAAW,GAExC,GAAI,GAAc,YAAc,GAC9B,MAAO,CAAE,gBAAiB,WAAY,CAGxC,IAAM,EAAS,GAAc,QAAU,GAAQ,eAAiB,GAC1D,EAAM,GAAc,sBAAwB,GAAQ,6BAA+B,IAEzF,MAAO,CACL,gBAAiB,mBAAmB,EAAO,2BAA2B,IACvE,CCfH,SAAgB,EACd,EACA,EACwB,CACxB,GAAI,CAAC,EAAQ,MAAO,EAAE,CAEtB,IAAM,EAAS,EAAI,QAAQ,IAAI,SAAS,CAMxC,MALI,CAAC,GAGD,CAAC,EAAO,eAAe,SAAS,EAAO,CAAS,EAAE,CAE/C,CACL,8BAA+B,EAC/B,+BAAgC,eAChC,+BAAgC,sCAChC,yBAA0B,OAAO,EAAO,QAAU,KAAK,CACvD,KAAM,SACP,CAGH,SAAgB,EAAsB,EAAc,EAA0C,CAC5F,IAAM,EAAU,EAAiB,EAAK,EAAO,CAC7C,OAAO,IAAI,SAAS,KAAM,CAAE,OAAQ,IAAK,UAAS,CAAC,CCnBrD,MAAa,EAAmB,EAAE,OAAO,CACvC,MAAO,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAA,IAAc,CAAC,QAAQ,GAAG,CAChE,OAAQ,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CACjD,KAAM,EACH,QAAQ,CACR,MAAM,iBAAiB,CACvB,UAAU,CACb,OAAQ,EACL,QAAQ,CACR,MAAM,yBAAyB,CAC/B,UAAU,CACb,OAAQ,EAAE,QAAQ,CAAC,UAAU,CAC7B,OAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAEtC,OAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CACvC,CAAC,CAGW,EAAqB,EAAE,OAAO,CACzC,OAAQ,EACL,QAAQ,CACR,MAAM,yBAAyB,CAC/B,UAAU,CACb,OAAQ,EAAE,QAAQ,CAAC,UAAU,CAC9B,CAAC,CAGW,EAAoB,EAAE,OAAO,CACxC,OAAQ,EACL,QAAQ,CACR,MAAM,yBAAyB,CAC/B,UAAU,CACd,CAAC,CAGF,SAAgB,EAAkB,EAAmB,CACnD,OAAO,EAAE,QAAQ,UAAW,OAAO,CAGrC,MAAM,EAAU,kEAMhB,SAAgB,EAAoB,EAA0B,EAAsB,CAClF,OAAQ,EAAY,KAApB,CACE,IAAK,UAGH,OAFI,IAAQ,OAAe,GACvB,IAAQ,QAAgB,GACrB,KAET,IAAK,YACL,IAAK,QACH,OAAO,EAAQ,KAAK,EAAI,CAAG,EAAM,KAEnC,IAAK,SACH,OAAO,EAAY,QAAQ,SAAS,EAAI,CAAG,EAAM,KAEnD,IAAK,OAEH,OAAO,EAET,IAAK,OACL,IAAK,SACH,OAAO,EAET,QACE,OAAO,MAQb,SAAgB,EACd,EACA,EACsB,CACtB,GAAI,CAAC,EAAa,OAGlB,IAAM,EADY,EAAY,MAAM,IAAI,CAAC,IAAK,GAAM,EAAE,MAAM,CAAC,CACrC,OACrB,GAAS,KAAQ,GAAa,CAAC,EAAK,WAAW,IAAI,EAAI,EAAU,GAAM,OAAS,SAClF,CAOD,OAJI,EAAM,OAAS,GAAK,CAAC,EAAM,SAAS,KAAK,EAC3C,EAAM,QAAQ,KAAK,CAGd,EAAM,OAAS,EAAI,EAAQ,IAAA,GCrGpC,SAAgB,EACd,EACA,EAAS,IACT,EACU,CACV,OAAO,IAAI,SAAS,KAAK,UAAU,EAAK,CAAE,CACxC,SACA,QAAS,CACP,eAAgB,mBAChB,GAAG,EACJ,CACF,CAAC,CAGJ,SAAgB,EACd,EACA,EACA,EACA,EACU,CACV,OAAO,EAAa,CAAE,MAAO,CAAE,SAAQ,UAAS,OAAM,CAAE,CAAE,EAAQ,EAAa,CAGjF,SAAgB,EAAiB,EAAiD,CAChF,OAAO,EAAc,YAAa,YAAa,IAAK,EAAa,CCZnE,SAAS,EAAc,EAAkC,CACvD,IAAM,EAAqB,CAAE,KAAM,EAAO,KAAM,CAchD,OAZI,EAAO,WACT,EAAM,SAAW,IAGf,EAAO,OAAS,WAClB,EAAM,QAAU,EAAO,SAGrB,EAAO,OAAS,cAClB,EAAM,YAAc,EAAO,aAGtB,EAIT,SAAgB,EAAe,EAA8B,CAC3D,IAAM,EAAY,EAAO,UACnB,EAAsC,EAAE,CAE9C,IAAK,GAAM,CAAC,EAAM,KAAW,OAAO,QAAQ,EAAU,CAEhD,EAAK,WAAW,IAAI,GACxB,EAAO,GAAQ,EAAc,EAAO,EAGtC,MAAO,CACL,KAAM,EAAO,KACb,WAAY,GAAG,EAAO,KAAK,GAC3B,SACD,CAOH,SAAgB,EACd,EACA,EACgB,CAEhB,MAAO,CACL,SAFc,EAAS,OAAQ,GAAM,EAAgB,EAAE,KAAK,CAAC,CAE3C,IAAI,EAAe,CACtC,CCPH,SAAS,EAAe,EAAyC,CAC/D,IAAM,EAAM,IAAI,IAChB,IAAK,IAAM,KAAU,EACnB,EAAI,IAAI,EAAO,KAAM,EAAO,CAC5B,EAAI,IAAI,GAAG,EAAO,KAAK,GAAI,EAAO,CAEpC,OAAO,EAOT,SAAS,EAAqB,EAAgB,EAAiC,CAE7E,IAAM,EAAQ,EAAe,IAAI,EAAO,KAAK,CAC7C,GAAI,CAAC,EAAO,OAEZ,IAAM,EAAY,EAAO,UACzB,IAAK,GAAM,CAAC,EAAW,KAAW,OAAO,QAAQ,EAAU,CACzD,GAAI,EAAO,OAAS,SAAW,EAAO,SAAW,EAAO,UAAW,CACjE,IAAM,EAAS,EAAM,GACrB,GAAI,EAAQ,OAAO,EAAM,EAAQ,IAAI,EAAkB,EAAO,CAAC,GAAG,EAMxE,SAAS,EACP,EACA,EACA,EACiB,CACjB,GAAI,CAAC,EAAW,OAEhB,IAAM,EAAa,EAAU,WAAW,IAAI,CACtC,EAAY,EAAa,EAAU,MAAM,EAAE,CAAG,EAE9C,EAAc,EAAU,GAC9B,GAAI,CAAC,GAAe,EAAY,OAAS,SAAU,OAGnD,IAAM,EAAQ,EAAe,IAAI,EAAW,CACxC,MAAC,GAAS,CAAC,EAAM,IAErB,OAAO,EAAa,EAAK,EAAM,GAAW,CAAG,EAAI,EAAM,GAAW,CAGpE,SAAS,EACP,EACA,EACA,EACO,CAEP,IAAM,EAAQ,EAAe,IAAI,EAAW,CAC5C,GAAI,CAAC,EAAO,MAAO,EAAE,CAErB,IAAM,EAAoB,EAAE,CAE5B,IAAK,GAAM,CAAC,EAAK,KAAQ,EAAI,aAAa,SAAS,CAAE,CACnD,IAAM,EAAQ,EAAI,MAAM,2BAA2B,CACnD,GAAI,CAAC,EAAO,SAEZ,IAAM,EAAY,EAAM,GAClB,EAAc,EAAU,GAC9B,GAAI,CAAC,GAAe,EAAY,OAAS,SAAU,SAEnD,IAAM,EAAS,EAAM,GACrB,GAAI,CAAC,EAAQ,SAGb,GAAI,EAAY,OAAS,OAAQ,CAC3B,EAAI,WAAW,OAAO,CACxB,EAAW,KAAK,EAAI,EAAQ,EAAI,MAAM,EAAE,CAAC,CAAC,CACjC,EAAI,WAAW,OAAO,CAC/B,EAAW,KAAK,EAAI,EAAQ,EAAI,MAAM,EAAE,CAAC,CAAC,CAE1C,EAAW,KAAK,EAAG,EAAQ,EAAI,CAAC,CAElC,SAGF,IAAM,EAAY,EAAoB,EAAa,EAAI,CACnD,IAAc,MAClB,EAAW,KAAK,EAAG,EAAQ,EAAU,CAAC,CAGxC,OAAO,EAOT,SAAgB,EAAwB,EAA0B,CAChE,GAAM,CACJ,WACA,gBACA,aAAa,SACb,KAAM,EACN,MAAO,EACP,WACE,EACE,EAAW,KAAK,IAAI,EAAO,UAAA,IAAA,IAAiC,CAC5D,EAAY,EAAe,EAAS,CAGpC,EAAa,IAAI,EAAW,IAAK,CAInC,EAA8C,KAC9C,EAAsB,EAE1B,eAAe,GAAyC,CACtD,IAAM,EAAM,KAAK,KAAK,CAKtB,OAJI,CAAC,GAAqB,EAAM,EAAsB,OACpD,EAAoB,MAAM,EAAO,iBAAiB,CAClD,EAAsB,GAEjB,EAKT,eAAe,EAAY,EAA+B,CACxD,GAAI,CAAC,EAAO,aAAc,OAAO,EACjC,GAAI,CAEF,OADe,MAAM,EAAO,aAAa,EAAI,GAC9B,MAAQ,OACjB,CACN,OAAO,GAMX,SAAS,EACP,EACA,EACA,EACS,CACT,OAAO,EAAQ,EAAM,EAAY,OAAO,CAK1C,SAAS,EAAa,EAA6B,CACjD,IAAM,EAAM,GAAQ,CACpB,OAAO,IAAI,EAAY,CACrB,SACA,GAAI,EAAI,GAAG,SACX,OAAQ,EAAI,OAAO,MAAM,CAAE,OAAQ,EAAO,KAAM,CAAC,CACjD,aACD,CAAC,CAKJ,eAAe,EACb,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CACtB,EAAS,EAAiB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CAC/E,GAAI,CAAC,EAAO,QACV,OAAO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAGxF,GAAM,CACJ,MAAO,EACP,SACA,OACA,SACA,SACA,SACA,OAAQ,GACN,EAAO,KACL,EAAQ,KAAK,IAAI,EAAU,EAAS,CACpC,EAAY,EAAO,UAGrB,EACJ,GAAI,EAAa,CACf,IAAM,EAAU,EAAa,EAAY,CACzC,GAAI,CAAC,EACH,OAAO,EAAc,iBAAkB,mBAAoB,IAAK,EAAY,CAG9E,GAAI,EAAE,EAAQ,SAAS,IAAc,EAAQ,QAAU,KACrD,OAAO,EAAc,uBAAwB,mBAAoB,IAAK,EAAY,CAEpF,EAAS,EAGX,IAAM,EAAe,EAAE,CACvB,GAAI,EAAQ,CACV,IAAM,EAAkB,EAAqB,EAAQ,EAAO,CACxD,GAAiB,EAAM,KAAK,EAAgB,CAGlD,IAAM,EAAmB,EAAsB,EAAO,KAAM,EAAK,EAAU,CAC3E,EAAM,KAAK,GAAG,EAAiB,CAE/B,IAAM,EAAU,EAAa,EAAO,KAAM,EAAM,EAAU,CACpD,EAAS,EAAoB,EAAQ,EAAU,CAE/C,EAAS,EAAa,EAAO,CAC7B,EAAiB,GAAU,EAC3B,EAAY,CAChB,MAAO,EAAM,OAAS,EAAI,EAAI,GAAG,EAAM,CAAG,IAAA,GAC1C,QACA,SACA,UACA,SACA,OAAQ,EACR,gBACA,SACD,CAEK,CAAC,EAAO,GAAS,MAAM,QAAQ,IAAI,CACvC,EAAO,SAAS,EAAU,CAC1B,EAAO,MAAM,CAAE,MAAO,EAAM,OAAS,EAAI,EAAI,GAAG,EAAM,CAAG,IAAA,GAAW,CAAC,CACtE,CAAC,CAGE,EACJ,GAAI,EAAM,OAAS,GAAK,EAAM,SAAW,EAAO,CAC9C,IAAM,EAAW,EAAM,EAAM,OAAS,GAEhC,EACJ,GAAQ,QAAU,EAAQ,EAAK,WAAW,IAAI,CAAG,EAAK,MAAM,EAAE,CAAG,EAAQ,IAAA,IACrE,EACJ,GAAQ,YAAc,GAAM,WAAW,IAAI,CAAG,OAAS,OACrD,GAAe,EAAS,KAAiB,IAAA,KAC3C,EAAa,EAAa,EAAU,EAAa,EAAgB,EAIrE,IAAM,EAAU,CACd,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAED,OAAO,EACL,CACE,KAAM,EACN,KAAM,CAAE,QAAO,QAAO,SAAQ,QAAS,EAAS,EAAQ,EAAO,aAAY,CAC5E,CACD,IACA,EACD,CAGH,eAAe,EACb,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CAqB5B,OApBe,EAAkB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CACpE,QAIM,EAAI,aAAa,IAAI,YAAY,GAGjC,WAGT,EAAa,CAAE,KAAM,CAAE,MADhB,MAAM,EADR,GAAQ,CACqB,GAAG,SAAU,EAAO,KAAK,CAC7B,SAAU,GAAM,CAAE,CAAE,IAAK,CAC5D,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CAMG,EAAa,CAAE,KAAM,CAAE,MAFhB,MADC,EAAa,EAAO,CACR,OAAO,CAEG,CAAE,CAAE,IAAK,CAC5C,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CArBO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAwB1F,eAAe,EACb,EACA,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CACtB,EAAS,EAAmB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CACjF,GAAI,CAAC,EAAO,QACV,OAAO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAGxF,GAAM,CAAE,SAAQ,UAAW,EAAO,KAC5B,EAAY,EAAO,UACnB,EAAS,EAAoB,EAAQ,EAAU,CAC/C,EAAiB,GAAU,EAG3B,EAAO,MADE,EAAa,EAAO,CACT,SAAS,EAAI,CACrC,SACA,OAAQ,EACR,gBACD,CAAC,CAGF,OAFK,EAEE,EAAa,CAAE,KAAM,EAAM,CAAE,IAAK,CACvC,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CALgB,EAAiB,EAAY,CAQjD,eAAe,EACb,EACA,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CACtB,EAAS,EAAmB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CACjF,GAAI,CAAC,EAAO,QACV,OAAO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAIxF,IAAM,EAAY,EAAO,UACzB,GAAI,CAAC,EAAU,KAAM,OAAO,EAAiB,EAAY,CAEzD,GAAM,CAAE,SAAQ,UAAW,EAAO,KAC5B,EAAS,EAAoB,EAAQ,EAAU,CAC/C,EAAiB,GAAU,EAG3B,EAAQ,EAAe,IAAI,EAAO,KAAK,CAC7C,GAAI,CAAC,GAAO,KAAM,OAAO,EAAiB,EAAY,CAEtD,IAAM,EAAS,EAAa,EAAO,CAC7B,EAAa,EAAU,KAIzB,EAAmB,EAAG,EAAM,KAAM,EAAK,CAE3C,GAAI,EAAW,cAAgB,EAAgB,CAC7C,IAAM,EAAuB,GAAG,EAAO,KAAK,eAEtC,EAAmB,EAAe,IAAI,EAAqB,CAGjE,GAAI,GAAkB,KAAM,CAG1B,IAAM,EAAqB,MADf,GAAQ,CACiB,GAAG,SACrC,OAAO,CAAE,SAAU,EAAiB,SAAU,CAAC,CAC/C,KAAK,EAAiB,CACtB,MAAM,EAAI,EAAG,EAAiB,KAAM,EAAK,CAAE,EAAG,EAAiB,OAAQ,EAAe,CAAC,CAAC,CAE3F,GAAI,EAAmB,OAAS,EAAG,CACjC,IAAM,EAAgB,EAAmB,IAAK,GAAM,EAAE,SAAmB,CAEzE,EAAc,EAAG,EAAQ,EAAM,GAAI,EAAc,CAAE,EAAG,EAAM,KAAM,EAAK,CAAC,GAK9E,IAAM,EAAU,MAAM,EAAO,SAAS,CACpC,MAAO,EACP,MAAO,EACP,SACA,OAAQ,EACR,gBACD,CAAC,CAIF,OAFI,EAAQ,SAAW,EAAU,EAAiB,EAAY,CAEvD,EAAa,CAAE,KAAM,EAAQ,GAAI,CAAE,IAAK,CAC7C,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CAKJ,eAAe,EAAU,EAAc,EAAsC,CAC3E,IAAM,EAAc,EAAiB,EAAK,EAAW,CAErD,GAAI,CACF,IAAM,EAAW,MAAM,EAAI,OAAO,KAAM,GAAM,EAAE,KAAK,CACrD,GAAI,CAAC,GAAY,EAAS,SAAW,EACnC,OAAO,EAAiB,EAAY,CAItC,IAAM,EAAO,MAAM,EAAY,EAAI,CAC7B,EAAU,MAAM,GAAY,CAGlC,GAAI,EAAS,KAAO,UAIlB,OAAO,EAHQ,EAAoB,EAAW,GAC5C,EAAkB,EAAS,EAAM,EAAK,CACvC,CAC2B,IAAK,CAC/B,GAAG,EACH,gBAAiB,WAClB,CAAC,CAIJ,IAAM,EAAa,EAAS,GACtB,EACJ,EAAU,IAAI,EAAW,EACzB,EAAU,IAAI,EAAW,SAAS,IAAI,CAAG,EAAW,MAAM,EAAG,GAAG,CAAG,EAAW,CAqBhF,MAlBI,CAAC,GAAU,CAAC,EAAkB,EAAS,EAAM,EAAO,KAAK,CACpD,EAAiB,EAAY,CAIlC,EAAS,SAAW,EACf,EAAW,EAAK,EAAQ,EAAY,CAEzC,EAAS,KAAO,QACX,EAAY,EAAK,EAAQ,EAAY,CAE1C,EAAS,KAAO,QAAU,EAAS,GAC9B,EAAa,EAAK,EAAQ,EAAS,GAAI,EAAY,CAExD,EAAS,SAAW,EACf,EAAW,EAAK,EAAQ,EAAS,GAAI,EAAY,CAGnD,EAAiB,EAAY,OAC7B,EAAK,CACZ,IAAM,EAAU,aAAe,MAAQ,EAAI,QAAU,wBAOrD,OANA,QAAQ,MAAM,+BAAgC,EAAI,CAClD,IAAU,CACR,OAAQ,IACR,UACA,KAAM,IAAI,IAAI,EAAI,IAAI,CAAC,SACxB,CAAC,CACK,EAAc,wBAAyB,iBAAkB,IAAK,EAAY,EAIrF,MAAO,CACL,KAAM,EAAc,IAAsB,EAAU,EAAK,EAAI,CAC7D,QAAU,GAAiB,EAAsB,EAAK,EAAW,CAClE"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/cache.ts","../src/cors.ts","../src/query-params.ts","../src/response.ts","../src/schema-endpoint.ts","../src/handler.ts"],"sourcesContent":["/**\n * Cache-Control header builder.\n *\n * Defaults: public, max-age=60, stale-while-revalidate=300.\n * Per-entity overrides for hot content (low TTL) vs static pages (high TTL).\n */\n\nimport type { CacheConfig } from './types.js'\n\nexport function buildCacheHeaders(\n  entityName: string,\n  config: CacheConfig | undefined,\n): Record<string, string> {\n  const entityConfig = config?.entities?.[entityName]\n\n  if (entityConfig?.cacheable === false) {\n    return { 'Cache-Control': 'no-store' }\n  }\n\n  const maxAge = entityConfig?.maxAge ?? config?.defaultMaxAge ?? 60\n  const swr = entityConfig?.staleWhileRevalidate ?? config?.defaultStaleWhileRevalidate ?? 300\n\n  return {\n    'Cache-Control': `public, max-age=${maxAge}, stale-while-revalidate=${swr}`,\n  }\n}\n","/**\n * CORS — Origin allowlist with exact match.\n *\n * No wildcards, no regex. This is a CMS content API — you know which\n * frontends consume it. Vary: Origin ensures CDNs cache per-origin.\n */\n\nimport type { CorsConfig } from './types.js'\n\nexport function buildCorsHeaders(\n  req: Request,\n  config: CorsConfig | undefined,\n): Record<string, string> {\n  if (!config) return {}\n\n  const origin = req.headers.get('Origin')\n  if (!origin) return {}\n\n  // Exact match only\n  if (!config.allowedOrigins.includes(origin)) return {}\n\n  return {\n    'Access-Control-Allow-Origin': origin,\n    'Access-Control-Allow-Methods': 'GET, OPTIONS',\n    'Access-Control-Allow-Headers': 'Content-Type, Accept, Authorization',\n    'Access-Control-Max-Age': String(config.maxAge ?? 3600),\n    Vary: 'Origin',\n  }\n}\n\nexport function corsPreflightResponse(req: Request, config: CorsConfig | undefined): Response {\n  const headers = buildCorsHeaders(req, config)\n  return new Response(null, { status: 204, headers })\n}\n","/**\n * Query parameter validation — Zod schemas for all content API endpoints.\n *\n * All user input is validated before it touches QueryClient.\n * Pagination hard-capped at MAX_LIMIT. Sort/filter restricted to queryable columns.\n */\n\nimport { escapeLikePattern, LOCALE_PATTERN } from '@murumets-ee/core'\nimport type { FieldConfig } from '@murumets-ee/entity'\nimport { z } from 'zod'\n\nexport const MAX_LIMIT = 100\n\n/** List endpoint query params. */\nexport const listParamsSchema = z.object({\n  limit: z.coerce.number().int().min(1).max(MAX_LIMIT).default(20),\n  offset: z.coerce.number().int().min(0).default(0),\n  sort: z\n    .string()\n    .regex(/^-?[a-zA-Z_]+$/)\n    .optional(),\n  locale: z.string().regex(LOCALE_PATTERN).optional(),\n  fields: z.string().optional(),\n  search: z.string().max(200).optional(),\n  /** Opaque cursor for keyset pagination (base64-encoded JSON). */\n  cursor: z.string().max(500).optional(),\n})\n\n/** Single entity query params. */\nexport const singleParamsSchema = z.object({\n  locale: z.string().regex(LOCALE_PATTERN).optional(),\n  fields: z.string().optional(),\n})\n\n/** Count endpoint query params. */\nexport const countParamsSchema = z.object({\n  locale: z.string().regex(LOCALE_PATTERN).optional(),\n})\n\n// Re-export from core so existing imports from this module continue to work\nexport { escapeLikePattern }\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\n/**\n * Validate a filter value against the field type.\n * Returns the validated value or null if invalid.\n */\nexport function validateFilterValue(fieldConfig: FieldConfig, raw: string): unknown {\n  switch (fieldConfig.type) {\n    case 'boolean':\n      if (raw === 'true') return true\n      if (raw === 'false') return false\n      return null\n\n    case 'reference':\n    case 'media':\n      return UUID_RE.test(raw) ? raw : null\n\n    case 'select':\n      return fieldConfig.options.includes(raw) ? raw : null\n\n    case 'date':\n      // Plain date or gte:/lte: prefix handled by caller\n      return raw\n\n    case 'text':\n    case 'number':\n      return raw\n\n    default:\n      return null\n  }\n}\n\n/**\n * Parse field selection string into validated field names.\n * Unknown/internal field names are silently dropped (no info leakage).\n */\nexport function parseFieldSelection(\n  fieldsParam: string | undefined,\n  allFields: Record<string, FieldConfig>,\n): string[] | undefined {\n  if (!fieldsParam) return undefined\n\n  const requested = fieldsParam.split(',').map((f) => f.trim())\n  const valid = requested.filter(\n    (name) => name in allFields && !name.startsWith('_') && allFields[name].type !== 'blocks',\n  )\n\n  // Always include id\n  if (valid.length > 0 && !valid.includes('id')) {\n    valid.unshift('id')\n  }\n\n  return valid.length > 0 ? valid : undefined\n}\n","/**\n * Response helpers — JSON envelope builders.\n */\n\nexport function jsonResponse(\n  data: unknown,\n  status = 200,\n  extraHeaders?: Record<string, string>,\n): Response {\n  return new Response(JSON.stringify(data), {\n    status,\n    headers: {\n      'Content-Type': 'application/json',\n      ...extraHeaders,\n    },\n  })\n}\n\nexport function errorResponse(\n  message: string,\n  code: string,\n  status: number,\n  extraHeaders?: Record<string, string>,\n): Response {\n  return jsonResponse({ error: { status, message, code } }, status, extraHeaders)\n}\n\nexport function notFoundResponse(extraHeaders?: Record<string, string>): Response {\n  return errorResponse('Not found', 'NOT_FOUND', 404, extraHeaders)\n}\n","/**\n * Schema introspection endpoint — GET /_schema\n *\n * Returns public-safe entity metadata for SDK generation.\n * Only exposes: type, required, options (select), cardinality (reference).\n * Internal fields (_version, _scopeId) excluded.\n * No hooks, behaviors, access rules, or implementation details.\n *\n * Response is filtered by the caller's role permissions — only entities\n * the role can 'view' are included.\n */\n\nimport type { Entity, FieldConfig } from '@murumets-ee/entity'\nimport type { SchemaEntity, SchemaField, SchemaResponse } from './types.js'\n\n/** Convert a FieldConfig to the public-safe SchemaField subset. */\nfunction toSchemaField(config: FieldConfig): SchemaField {\n  const field: SchemaField = { type: config.type }\n\n  if (config.required) {\n    field.required = true\n  }\n\n  if (config.type === 'select') {\n    field.options = config.options\n  }\n\n  if (config.type === 'reference') {\n    field.cardinality = config.cardinality\n  }\n\n  return field\n}\n\n/** Convert an Entity to public-safe schema metadata. */\nexport function toSchemaEntity(entity: Entity): SchemaEntity {\n  const allFields = entity.allFields as Record<string, FieldConfig>\n  const fields: Record<string, SchemaField> = {}\n\n  for (const [name, config] of Object.entries(allFields)) {\n    // Skip internal fields\n    if (name.startsWith('_')) continue\n    fields[name] = toSchemaField(config)\n  }\n\n  return {\n    name: entity.name,\n    pluralName: `${entity.name}s`,\n    fields,\n  }\n}\n\n/**\n * Build the full /_schema response.\n * Only includes entities that pass the permission check.\n */\nexport function buildSchemaResponse(\n  entities: Entity[],\n  checkPermission: (entityName: string) => boolean,\n): SchemaResponse {\n  const visible = entities.filter((e) => checkPermission(e.name))\n  return {\n    entities: visible.map(toSchemaEntity),\n  }\n}\n","/**\n * Content API handler factory\n *\n * Creates a read-only catch-all route handler for public content delivery.\n * Mirrors the `createAdminApiHandler` pattern but with:\n * - No mutations (GET + OPTIONS only)\n * - Permission-gated (public role starts with 0 permissions)\n * - Published content only (QueryClient auto-filters)\n * - CORS + Cache-Control headers\n *\n * @example\n * ```typescript\n * // app/api/content/[...path]/route.ts\n * import { createContentApiHandler } from '@murumets-ee/content-api'\n * import { Article, Page } from '@/entities'\n *\n * const handler = createContentApiHandler({\n *   entities: [Article, Page],\n *   loadPermissions: async () => {\n *     const roles = await loadRoles(getApp())\n *     return buildPermissionChecker(roles)\n *   },\n *   cors: { allowedOrigins: ['https://www.example.com'] },\n * })\n *\n * export const { GET, OPTIONS } = handler\n * ```\n */\n\nimport type { PermissionChecker, RequestContext } from '@murumets-ee/core'\nimport { getApp, getContext, runWithContextAsync } from '@murumets-ee/core'\nimport { schemaRegistry } from '@murumets-ee/db'\nimport type { CursorInput, Entity, FieldConfig, SlugField } from '@murumets-ee/entity'\nimport { CountCache, decodeCursor, encodeCursor, estimateRowCount } from '@murumets-ee/entity'\nimport { QueryClient } from '@murumets-ee/entity/query'\nimport { and, asc, desc, eq, gte, ilike, inArray, lte, or, type SQL } from 'drizzle-orm'\nimport type { PgTableWithColumns } from 'drizzle-orm/pg-core'\nimport { buildCacheHeaders } from './cache.js'\nimport { buildCorsHeaders, corsPreflightResponse } from './cors.js'\nimport {\n  countParamsSchema,\n  escapeLikePattern,\n  listParamsSchema,\n  MAX_LIMIT,\n  parseFieldSelection,\n  singleParamsSchema,\n  validateFilterValue,\n} from './query-params.js'\nimport { errorResponse, jsonResponse, notFoundResponse } from './response.js'\nimport { buildSchemaResponse } from './schema-endpoint.js'\nimport type { ContentApiConfig, RouteContext } from './types.js'\n\n// ---------------------------------------------------------------------------\n// Entity resolution (whitelist-based, same pattern as admin handler)\n// ---------------------------------------------------------------------------\n\nfunction buildEntityMap(entities: Entity[]): Map<string, Entity> {\n  const map = new Map<string, Entity>()\n  for (const entity of entities) {\n    map.set(entity.name, entity)\n    map.set(`${entity.name}s`, entity)\n  }\n  return map\n}\n\n// ---------------------------------------------------------------------------\n// Query helpers\n// ---------------------------------------------------------------------------\n\nfunction buildSearchCondition(entity: Entity, search: string): SQL | undefined {\n  // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n  const table = schemaRegistry.get(entity.name) as PgTableWithColumns<any> | undefined\n  if (!table) return undefined\n\n  const allFields = entity.allFields as Record<string, FieldConfig>\n  for (const [fieldName, config] of Object.entries(allFields)) {\n    if (config.type === 'text' && (config.indexed || config.required)) {\n      const column = table[fieldName]\n      if (column) return ilike(column, `%${escapeLikePattern(search)}%`)\n    }\n  }\n  return undefined\n}\n\nfunction buildOrderBy(\n  entityName: string,\n  sortParam: string | undefined,\n  allFields: Record<string, FieldConfig>,\n): SQL | undefined {\n  if (!sortParam) return undefined\n\n  const descending = sortParam.startsWith('-')\n  const fieldName = descending ? sortParam.slice(1) : sortParam\n\n  const fieldConfig = allFields[fieldName]\n  if (!fieldConfig || fieldConfig.type === 'blocks') return undefined\n\n  // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n  const table = schemaRegistry.get(entityName) as PgTableWithColumns<any> | undefined\n  if (!table || !table[fieldName]) return undefined\n\n  return descending ? desc(table[fieldName]) : asc(table[fieldName])\n}\n\nfunction buildFilterConditions(\n  entityName: string,\n  url: URL,\n  allFields: Record<string, FieldConfig>,\n): SQL[] {\n  // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n  const table = schemaRegistry.get(entityName) as PgTableWithColumns<any> | undefined\n  if (!table) return []\n\n  const conditions: SQL[] = []\n\n  for (const [key, raw] of url.searchParams.entries()) {\n    const match = key.match(/^filter\\[([a-zA-Z_]+)\\]$/)\n    if (!match) continue\n\n    const fieldName = match[1]\n    const fieldConfig = allFields[fieldName]\n    if (!fieldConfig || fieldConfig.type === 'blocks') continue\n\n    const column = table[fieldName]\n    if (!column) continue\n\n    // Date range filters: gte: / lte: prefix\n    if (fieldConfig.type === 'date') {\n      if (raw.startsWith('gte:')) {\n        conditions.push(gte(column, raw.slice(4)))\n      } else if (raw.startsWith('lte:')) {\n        conditions.push(lte(column, raw.slice(4)))\n      } else {\n        conditions.push(eq(column, raw))\n      }\n      continue\n    }\n\n    const validated = validateFilterValue(fieldConfig, raw)\n    if (validated === null) continue\n    conditions.push(eq(column, validated))\n  }\n\n  return conditions\n}\n\n// ---------------------------------------------------------------------------\n// Handler factory\n// ---------------------------------------------------------------------------\n\nexport function createContentApiHandler(config: ContentApiConfig) {\n  const {\n    entities,\n    defaultLocale,\n    publicRole = 'public',\n    cors: corsConfig,\n    cache: cacheConfig,\n    onError,\n  } = config\n  const maxLimit = Math.min(config.maxLimit ?? MAX_LIMIT, MAX_LIMIT)\n  const entityMap = buildEntityMap(entities)\n\n  // Shared count cache — reduces COUNT(*) queries on paginated list pages.\n  const countCache = new CountCache(5000)\n\n  // Lazy-loaded permission checker — cached with 30s TTL\n  const PERMISSION_CACHE_TTL_MS = 30_000\n  let permissionChecker: PermissionChecker | null = null\n  let permissionCacheTime = 0\n\n  async function getChecker(): Promise<PermissionChecker> {\n    const now = Date.now()\n    if (!permissionChecker || now - permissionCacheTime > PERMISSION_CACHE_TTL_MS) {\n      permissionChecker = await config.loadPermissions()\n      permissionCacheTime = now\n    }\n    return permissionChecker\n  }\n\n  // -- Role resolution -------------------------------------------------------\n\n  async function resolveRole(req: Request): Promise<string> {\n    if (!config.authenticate) return publicRole\n    try {\n      const result = await config.authenticate(req)\n      return result?.role ?? publicRole\n    } catch {\n      return publicRole\n    }\n  }\n\n  // -- Permission check (returns 404 on deny to avoid info leakage) ----------\n\n  function hasViewPermission(\n    checker: PermissionChecker,\n    role: string,\n    entityName: string,\n  ): boolean {\n    return checker(role, entityName, 'view')\n  }\n\n  // -- Create QueryClient from entity ----------------------------------------\n\n  function createClient(entity: Entity): QueryClient {\n    const app = getApp()\n    return new QueryClient({\n      entity,\n      db: app.db.readOnly,\n      logger: app.logger.child({ entity: entity.name }),\n      countCache,\n      contextResolver: () => {\n        const ctx = getContext()\n        if (!ctx?.user || !ctx?.checker) return undefined\n        return { user: ctx.user, checker: ctx.checker, scope: ctx.scope }\n      },\n    })\n  }\n\n  // -- Endpoint handlers -----------------------------------------------------\n\n  async function handleList(\n    req: Request,\n    entity: Entity,\n    corsHeaders: Record<string, string>,\n  ): Promise<Response> {\n    const url = new URL(req.url)\n    const params = listParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n    if (!params.success) {\n      return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n    }\n\n    const {\n      limit: rawLimit,\n      offset,\n      sort,\n      locale,\n      fields,\n      search,\n      cursor: cursorParam,\n    } = params.data\n    const limit = Math.min(rawLimit, maxLimit)\n    const allFields = entity.allFields as Record<string, FieldConfig>\n\n    // Cursor-based pagination (opt-in, replaces OFFSET when provided)\n    let cursor: CursorInput | undefined\n    if (cursorParam) {\n      const decoded = decodeCursor(cursorParam)\n      if (!decoded) {\n        return errorResponse('Invalid cursor', 'VALIDATION_ERROR', 400, corsHeaders)\n      }\n      // Whitelist: cursor field must be a real field on the entity\n      if (!(decoded.field in allFields) && decoded.field !== 'id') {\n        return errorResponse('Invalid cursor field', 'VALIDATION_ERROR', 400, corsHeaders)\n      }\n      cursor = decoded\n    }\n\n    const where: SQL[] = []\n    if (search) {\n      const searchCondition = buildSearchCondition(entity, search)\n      if (searchCondition) where.push(searchCondition)\n    }\n\n    const filterConditions = buildFilterConditions(entity.name, url, allFields)\n    where.push(...filterConditions)\n\n    const orderBy = buildOrderBy(entity.name, sort, allFields)\n    const select = parseFieldSelection(fields, allFields)\n\n    const client = createClient(entity)\n    const resolvedLocale = locale ?? defaultLocale\n    const queryOpts = {\n      where: where.length > 0 ? and(...where) : undefined,\n      limit,\n      offset,\n      orderBy,\n      select,\n      locale: resolvedLocale,\n      defaultLocale,\n      cursor,\n    }\n\n    const [items, total] = await Promise.all([\n      client.findMany(queryOpts),\n      client.count({ where: where.length > 0 ? and(...where) : undefined }),\n    ])\n\n    // Build nextCursor from last item for keyset pagination\n    let nextCursor: string | undefined\n    if (items.length > 0 && items.length === limit) {\n      const lastItem = items[items.length - 1] as Record<string, unknown>\n      // Derive sort field and direction from cursor or sort param\n      const cursorField =\n        cursor?.field ?? (sort ? (sort.startsWith('-') ? sort.slice(1) : sort) : undefined)\n      const cursorDirection: 'asc' | 'desc' =\n        cursor?.direction ?? (sort?.startsWith('-') ? 'desc' : 'asc')\n      if (cursorField && lastItem[cursorField] !== undefined) {\n        nextCursor = encodeCursor(lastItem, cursorField, cursorDirection)\n      }\n    }\n\n    const headers = {\n      ...corsHeaders,\n      ...buildCacheHeaders(entity.name, cacheConfig),\n    }\n\n    return jsonResponse(\n      {\n        data: items,\n        meta: { total, limit, offset, hasMore: offset + limit < total, nextCursor },\n      },\n      200,\n      headers,\n    )\n  }\n\n  async function handleCount(\n    req: Request,\n    entity: Entity,\n    corsHeaders: Record<string, string>,\n  ): Promise<Response> {\n    const url = new URL(req.url)\n    const params = countParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n    if (!params.success) {\n      return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n    }\n\n    const countMode = url.searchParams.get('countMode')\n\n    // Fast path: use Postgres row estimate for unfiltered counts\n    if (countMode === 'estimate') {\n      const app = getApp()\n      const count = await estimateRowCount(app.db.readOnly, entity.name)\n      return jsonResponse({ data: { count, estimate: true } }, 200, {\n        ...corsHeaders,\n        ...buildCacheHeaders(entity.name, cacheConfig),\n      })\n    }\n\n    const client = createClient(entity)\n    const count = await client.count()\n\n    return jsonResponse({ data: { count } }, 200, {\n      ...corsHeaders,\n      ...buildCacheHeaders(entity.name, cacheConfig),\n    })\n  }\n\n  async function handleById(\n    req: Request,\n    entity: Entity,\n    id: string,\n    corsHeaders: Record<string, string>,\n  ): Promise<Response> {\n    const url = new URL(req.url)\n    const params = singleParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n    if (!params.success) {\n      return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n    }\n\n    const { locale, fields } = params.data\n    const allFields = entity.allFields as Record<string, FieldConfig>\n    const select = parseFieldSelection(fields, allFields)\n    const resolvedLocale = locale ?? defaultLocale\n\n    const client = createClient(entity)\n    const item = await client.findById(id, {\n      select,\n      locale: resolvedLocale,\n      defaultLocale,\n    })\n    if (!item) return notFoundResponse(corsHeaders)\n\n    return jsonResponse({ data: item }, 200, {\n      ...corsHeaders,\n      ...buildCacheHeaders(entity.name, cacheConfig),\n    })\n  }\n\n  async function handleBySlug(\n    req: Request,\n    entity: Entity,\n    slug: string,\n    corsHeaders: Record<string, string>,\n  ): Promise<Response> {\n    const url = new URL(req.url)\n    const params = singleParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n    if (!params.success) {\n      return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n    }\n\n    // Check entity has a slug field\n    const allFields = entity.allFields as Record<string, FieldConfig>\n    if (!allFields.slug) return notFoundResponse(corsHeaders)\n\n    const { locale, fields } = params.data\n    const select = parseFieldSelection(fields, allFields)\n    const resolvedLocale = locale ?? defaultLocale\n\n    // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n    const table = schemaRegistry.get(entity.name) as PgTableWithColumns<any> | undefined\n    if (!table?.slug) return notFoundResponse(corsHeaders)\n\n    const client = createClient(entity)\n    const slugConfig = allFields.slug as SlugField\n\n    // For translatable slugs, also search the translation table.\n    // A non-default locale's slug may live in {entity}_translations, not the main table.\n    let whereClause: SQL = eq(table.slug, slug)\n\n    if (slugConfig.translatable && resolvedLocale) {\n      const translationTableName = `${entity.name}_translations`\n      // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n      const translationTable = schemaRegistry.get(translationTableName) as\n        | PgTableWithColumns<any>\n        | undefined\n      if (translationTable?.slug) {\n        // Find entity IDs whose translated slug matches (for the requested locale)\n        const app = getApp()\n        const translationMatches = await app.db.readOnly\n          .select({ entityId: translationTable.entityId })\n          .from(translationTable)\n          .where(and(eq(translationTable.slug, slug), eq(translationTable.locale, resolvedLocale)))\n\n        if (translationMatches.length > 0) {\n          const translatedIds = translationMatches.map((r) => r.entityId as string)\n          // Match by translated slug OR by main table slug (fallback)\n          whereClause = or(inArray(table.id, translatedIds), eq(table.slug, slug))!\n        }\n      }\n    }\n\n    const results = await client.findMany({\n      where: whereClause,\n      limit: 1,\n      select,\n      locale: resolvedLocale,\n      defaultLocale,\n    })\n\n    if (results.length === 0) return notFoundResponse(corsHeaders)\n\n    return jsonResponse({ data: results[0] }, 200, {\n      ...corsHeaders,\n      ...buildCacheHeaders(entity.name, cacheConfig),\n    })\n  }\n\n  // -- Central dispatch -------------------------------------------------------\n\n  async function handleGet(req: Request, ctx: RouteContext): Promise<Response> {\n    const corsHeaders = buildCorsHeaders(req, corsConfig)\n\n    try {\n      const segments = await ctx.params.then((p) => p.path)\n      if (!segments || segments.length === 0) {\n        return notFoundResponse(corsHeaders)\n      }\n\n      // Resolve role + load permissions + establish request context\n      const role = await resolveRole(req)\n      const checker = await getChecker()\n\n      const requestContext: RequestContext = {\n        user: { id: 'public', groups: role ? [role] : [] },\n        checker,\n      }\n\n      return await runWithContextAsync(requestContext, async () => {\n      // /_schema — entity introspection (filtered by role)\n      if (segments[0] === '_schema') {\n        const schema = buildSchemaResponse(entities, (name) =>\n          hasViewPermission(checker, role, name),\n        )\n        return jsonResponse(schema, 200, {\n          ...corsHeaders,\n          'Cache-Control': 'no-store',\n        })\n      }\n\n      // Resolve entity from whitelist\n      const entityName = segments[0]\n      const entity =\n        entityMap.get(entityName) ??\n        entityMap.get(entityName.endsWith('s') ? entityName.slice(0, -1) : entityName)\n\n      // Entity not in whitelist OR role lacks view permission → 404\n      if (!entity || !hasViewPermission(checker, role, entity.name)) {\n        return notFoundResponse(corsHeaders)\n      }\n\n      // Route to handler\n      if (segments.length === 1) {\n        return handleList(req, entity, corsHeaders)\n      }\n      if (segments[1] === 'count') {\n        return handleCount(req, entity, corsHeaders)\n      }\n      if (segments[1] === 'slug' && segments[2]) {\n        return handleBySlug(req, entity, segments[2], corsHeaders)\n      }\n      if (segments.length === 2) {\n        return handleById(req, entity, segments[1], corsHeaders)\n      }\n\n      return notFoundResponse(corsHeaders)\n      }) // end runWithContextAsync\n    } catch (err) {\n      const message = err instanceof Error ? err.message : 'Internal server error'\n      console.error('[content-api] handler error:', err)\n      onError?.({\n        status: 500,\n        message,\n        path: new URL(req.url).pathname,\n      })\n      return errorResponse('Internal server error', 'INTERNAL_ERROR', 500, corsHeaders)\n    }\n  }\n\n  return {\n    GET: (req: Request, ctx: RouteContext) => handleGet(req, ctx),\n    OPTIONS: (req: Request) => corsPreflightResponse(req, corsConfig),\n  }\n}\n"],"mappings":"0dASA,SAAgB,EACd,EACA,EACwB,CACxB,IAAM,EAAe,GAAQ,WAAW,GAExC,GAAI,GAAc,YAAc,GAC9B,MAAO,CAAE,gBAAiB,WAAY,CAGxC,IAAM,EAAS,GAAc,QAAU,GAAQ,eAAiB,GAC1D,EAAM,GAAc,sBAAwB,GAAQ,6BAA+B,IAEzF,MAAO,CACL,gBAAiB,mBAAmB,EAAO,2BAA2B,IACvE,CCfH,SAAgB,EACd,EACA,EACwB,CACxB,GAAI,CAAC,EAAQ,MAAO,EAAE,CAEtB,IAAM,EAAS,EAAI,QAAQ,IAAI,SAAS,CAMxC,MALI,CAAC,GAGD,CAAC,EAAO,eAAe,SAAS,EAAO,CAAS,EAAE,CAE/C,CACL,8BAA+B,EAC/B,+BAAgC,eAChC,+BAAgC,sCAChC,yBAA0B,OAAO,EAAO,QAAU,KAAK,CACvD,KAAM,SACP,CAGH,SAAgB,EAAsB,EAAc,EAA0C,CAC5F,IAAM,EAAU,EAAiB,EAAK,EAAO,CAC7C,OAAO,IAAI,SAAS,KAAM,CAAE,OAAQ,IAAK,UAAS,CAAC,CClBrD,MAAa,EAAmB,EAAE,OAAO,CACvC,MAAO,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAA,IAAc,CAAC,QAAQ,GAAG,CAChE,OAAQ,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CACjD,KAAM,EACH,QAAQ,CACR,MAAM,iBAAiB,CACvB,UAAU,CACb,OAAQ,EAAE,QAAQ,CAAC,MAAM,EAAe,CAAC,UAAU,CACnD,OAAQ,EAAE,QAAQ,CAAC,UAAU,CAC7B,OAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAEtC,OAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CACvC,CAAC,CAGW,EAAqB,EAAE,OAAO,CACzC,OAAQ,EAAE,QAAQ,CAAC,MAAM,EAAe,CAAC,UAAU,CACnD,OAAQ,EAAE,QAAQ,CAAC,UAAU,CAC9B,CAAC,CAGW,EAAoB,EAAE,OAAO,CACxC,OAAQ,EAAE,QAAQ,CAAC,MAAM,EAAe,CAAC,UAAU,CACpD,CAAC,CAKI,EAAU,kEAMhB,SAAgB,EAAoB,EAA0B,EAAsB,CAClF,OAAQ,EAAY,KAApB,CACE,IAAK,UAGH,OAFI,IAAQ,OAAe,GACvB,IAAQ,QAAgB,GACrB,KAET,IAAK,YACL,IAAK,QACH,OAAO,EAAQ,KAAK,EAAI,CAAG,EAAM,KAEnC,IAAK,SACH,OAAO,EAAY,QAAQ,SAAS,EAAI,CAAG,EAAM,KAEnD,IAAK,OAEH,OAAO,EAET,IAAK,OACL,IAAK,SACH,OAAO,EAET,QACE,OAAO,MAQb,SAAgB,EACd,EACA,EACsB,CACtB,GAAI,CAAC,EAAa,OAGlB,IAAM,EADY,EAAY,MAAM,IAAI,CAAC,IAAK,GAAM,EAAE,MAAM,CAAC,CACrC,OACrB,GAAS,KAAQ,GAAa,CAAC,EAAK,WAAW,IAAI,EAAI,EAAU,GAAM,OAAS,SAClF,CAOD,OAJI,EAAM,OAAS,GAAK,CAAC,EAAM,SAAS,KAAK,EAC3C,EAAM,QAAQ,KAAK,CAGd,EAAM,OAAS,EAAI,EAAQ,IAAA,GC3FpC,SAAgB,EACd,EACA,EAAS,IACT,EACU,CACV,OAAO,IAAI,SAAS,KAAK,UAAU,EAAK,CAAE,CACxC,SACA,QAAS,CACP,eAAgB,mBAChB,GAAG,EACJ,CACF,CAAC,CAGJ,SAAgB,EACd,EACA,EACA,EACA,EACU,CACV,OAAO,EAAa,CAAE,MAAO,CAAE,SAAQ,UAAS,OAAM,CAAE,CAAE,EAAQ,EAAa,CAGjF,SAAgB,EAAiB,EAAiD,CAChF,OAAO,EAAc,YAAa,YAAa,IAAK,EAAa,CCZnE,SAAS,EAAc,EAAkC,CACvD,IAAM,EAAqB,CAAE,KAAM,EAAO,KAAM,CAchD,OAZI,EAAO,WACT,EAAM,SAAW,IAGf,EAAO,OAAS,WAClB,EAAM,QAAU,EAAO,SAGrB,EAAO,OAAS,cAClB,EAAM,YAAc,EAAO,aAGtB,EAIT,SAAgB,EAAe,EAA8B,CAC3D,IAAM,EAAY,EAAO,UACnB,EAAsC,EAAE,CAE9C,IAAK,GAAM,CAAC,EAAM,KAAW,OAAO,QAAQ,EAAU,CAEhD,EAAK,WAAW,IAAI,GACxB,EAAO,GAAQ,EAAc,EAAO,EAGtC,MAAO,CACL,KAAM,EAAO,KACb,WAAY,GAAG,EAAO,KAAK,GAC3B,SACD,CAOH,SAAgB,EACd,EACA,EACgB,CAEhB,MAAO,CACL,SAFc,EAAS,OAAQ,GAAM,EAAgB,EAAE,KAAK,CAAC,CAE3C,IAAI,EAAe,CACtC,CCPH,SAAS,EAAe,EAAyC,CAC/D,IAAM,EAAM,IAAI,IAChB,IAAK,IAAM,KAAU,EACnB,EAAI,IAAI,EAAO,KAAM,EAAO,CAC5B,EAAI,IAAI,GAAG,EAAO,KAAK,GAAI,EAAO,CAEpC,OAAO,EAOT,SAAS,EAAqB,EAAgB,EAAiC,CAE7E,IAAM,EAAQ,EAAe,IAAI,EAAO,KAAK,CAC7C,GAAI,CAAC,EAAO,OAEZ,IAAM,EAAY,EAAO,UACzB,IAAK,GAAM,CAAC,EAAW,KAAW,OAAO,QAAQ,EAAU,CACzD,GAAI,EAAO,OAAS,SAAW,EAAO,SAAW,EAAO,UAAW,CACjE,IAAM,EAAS,EAAM,GACrB,GAAI,EAAQ,OAAO,EAAM,EAAQ,IAAI,EAAkB,EAAO,CAAC,GAAG,EAMxE,SAAS,EACP,EACA,EACA,EACiB,CACjB,GAAI,CAAC,EAAW,OAEhB,IAAM,EAAa,EAAU,WAAW,IAAI,CACtC,EAAY,EAAa,EAAU,MAAM,EAAE,CAAG,EAE9C,EAAc,EAAU,GAC9B,GAAI,CAAC,GAAe,EAAY,OAAS,SAAU,OAGnD,IAAM,EAAQ,EAAe,IAAI,EAAW,CACxC,MAAC,GAAS,CAAC,EAAM,IAErB,OAAO,EAAa,EAAK,EAAM,GAAW,CAAG,EAAI,EAAM,GAAW,CAGpE,SAAS,EACP,EACA,EACA,EACO,CAEP,IAAM,EAAQ,EAAe,IAAI,EAAW,CAC5C,GAAI,CAAC,EAAO,MAAO,EAAE,CAErB,IAAM,EAAoB,EAAE,CAE5B,IAAK,GAAM,CAAC,EAAK,KAAQ,EAAI,aAAa,SAAS,CAAE,CACnD,IAAM,EAAQ,EAAI,MAAM,2BAA2B,CACnD,GAAI,CAAC,EAAO,SAEZ,IAAM,EAAY,EAAM,GAClB,EAAc,EAAU,GAC9B,GAAI,CAAC,GAAe,EAAY,OAAS,SAAU,SAEnD,IAAM,EAAS,EAAM,GACrB,GAAI,CAAC,EAAQ,SAGb,GAAI,EAAY,OAAS,OAAQ,CAC3B,EAAI,WAAW,OAAO,CACxB,EAAW,KAAK,EAAI,EAAQ,EAAI,MAAM,EAAE,CAAC,CAAC,CACjC,EAAI,WAAW,OAAO,CAC/B,EAAW,KAAK,EAAI,EAAQ,EAAI,MAAM,EAAE,CAAC,CAAC,CAE1C,EAAW,KAAK,EAAG,EAAQ,EAAI,CAAC,CAElC,SAGF,IAAM,EAAY,EAAoB,EAAa,EAAI,CACnD,IAAc,MAClB,EAAW,KAAK,EAAG,EAAQ,EAAU,CAAC,CAGxC,OAAO,EAOT,SAAgB,EAAwB,EAA0B,CAChE,GAAM,CACJ,WACA,gBACA,aAAa,SACb,KAAM,EACN,MAAO,EACP,WACE,EACE,EAAW,KAAK,IAAI,EAAO,UAAA,IAAA,IAAiC,CAC5D,EAAY,EAAe,EAAS,CAGpC,EAAa,IAAI,EAAW,IAAK,CAInC,EAA8C,KAC9C,EAAsB,EAE1B,eAAe,GAAyC,CACtD,IAAM,EAAM,KAAK,KAAK,CAKtB,OAJI,CAAC,GAAqB,EAAM,EAAsB,OACpD,EAAoB,MAAM,EAAO,iBAAiB,CAClD,EAAsB,GAEjB,EAKT,eAAe,EAAY,EAA+B,CACxD,GAAI,CAAC,EAAO,aAAc,OAAO,EACjC,GAAI,CAEF,OADe,MAAM,EAAO,aAAa,EAAI,GAC9B,MAAQ,OACjB,CACN,OAAO,GAMX,SAAS,EACP,EACA,EACA,EACS,CACT,OAAO,EAAQ,EAAM,EAAY,OAAO,CAK1C,SAAS,EAAa,EAA6B,CACjD,IAAM,EAAM,GAAQ,CACpB,OAAO,IAAI,EAAY,CACrB,SACA,GAAI,EAAI,GAAG,SACX,OAAQ,EAAI,OAAO,MAAM,CAAE,OAAQ,EAAO,KAAM,CAAC,CACjD,aACA,oBAAuB,CACrB,IAAM,EAAM,GAAY,CACpB,MAAC,GAAK,MAAQ,CAAC,GAAK,SACxB,MAAO,CAAE,KAAM,EAAI,KAAM,QAAS,EAAI,QAAS,MAAO,EAAI,MAAO,EAEpE,CAAC,CAKJ,eAAe,EACb,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CACtB,EAAS,EAAiB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CAC/E,GAAI,CAAC,EAAO,QACV,OAAO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAGxF,GAAM,CACJ,MAAO,EACP,SACA,OACA,SACA,SACA,SACA,OAAQ,GACN,EAAO,KACL,EAAQ,KAAK,IAAI,EAAU,EAAS,CACpC,EAAY,EAAO,UAGrB,EACJ,GAAI,EAAa,CACf,IAAM,EAAU,EAAa,EAAY,CACzC,GAAI,CAAC,EACH,OAAO,EAAc,iBAAkB,mBAAoB,IAAK,EAAY,CAG9E,GAAI,EAAE,EAAQ,SAAS,IAAc,EAAQ,QAAU,KACrD,OAAO,EAAc,uBAAwB,mBAAoB,IAAK,EAAY,CAEpF,EAAS,EAGX,IAAM,EAAe,EAAE,CACvB,GAAI,EAAQ,CACV,IAAM,EAAkB,EAAqB,EAAQ,EAAO,CACxD,GAAiB,EAAM,KAAK,EAAgB,CAGlD,IAAM,EAAmB,EAAsB,EAAO,KAAM,EAAK,EAAU,CAC3E,EAAM,KAAK,GAAG,EAAiB,CAE/B,IAAM,EAAU,EAAa,EAAO,KAAM,EAAM,EAAU,CACpD,EAAS,EAAoB,EAAQ,EAAU,CAE/C,EAAS,EAAa,EAAO,CAC7B,EAAiB,GAAU,EAC3B,EAAY,CAChB,MAAO,EAAM,OAAS,EAAI,EAAI,GAAG,EAAM,CAAG,IAAA,GAC1C,QACA,SACA,UACA,SACA,OAAQ,EACR,gBACA,SACD,CAEK,CAAC,EAAO,GAAS,MAAM,QAAQ,IAAI,CACvC,EAAO,SAAS,EAAU,CAC1B,EAAO,MAAM,CAAE,MAAO,EAAM,OAAS,EAAI,EAAI,GAAG,EAAM,CAAG,IAAA,GAAW,CAAC,CACtE,CAAC,CAGE,EACJ,GAAI,EAAM,OAAS,GAAK,EAAM,SAAW,EAAO,CAC9C,IAAM,EAAW,EAAM,EAAM,OAAS,GAEhC,EACJ,GAAQ,QAAU,EAAQ,EAAK,WAAW,IAAI,CAAG,EAAK,MAAM,EAAE,CAAG,EAAQ,IAAA,IACrE,EACJ,GAAQ,YAAc,GAAM,WAAW,IAAI,CAAG,OAAS,OACrD,GAAe,EAAS,KAAiB,IAAA,KAC3C,EAAa,EAAa,EAAU,EAAa,EAAgB,EAIrE,IAAM,EAAU,CACd,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAED,OAAO,EACL,CACE,KAAM,EACN,KAAM,CAAE,QAAO,QAAO,SAAQ,QAAS,EAAS,EAAQ,EAAO,aAAY,CAC5E,CACD,IACA,EACD,CAGH,eAAe,EACb,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CAqB5B,OApBe,EAAkB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CACpE,QAIM,EAAI,aAAa,IAAI,YAAY,GAGjC,WAGT,EAAa,CAAE,KAAM,CAAE,MADhB,MAAM,EADR,GAAQ,CACqB,GAAG,SAAU,EAAO,KAAK,CAC7B,SAAU,GAAM,CAAE,CAAE,IAAK,CAC5D,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CAMG,EAAa,CAAE,KAAM,CAAE,MAFhB,MADC,EAAa,EAAO,CACR,OAAO,CAEG,CAAE,CAAE,IAAK,CAC5C,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CArBO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAwB1F,eAAe,EACb,EACA,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CACtB,EAAS,EAAmB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CACjF,GAAI,CAAC,EAAO,QACV,OAAO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAGxF,GAAM,CAAE,SAAQ,UAAW,EAAO,KAC5B,EAAY,EAAO,UACnB,EAAS,EAAoB,EAAQ,EAAU,CAC/C,EAAiB,GAAU,EAG3B,EAAO,MADE,EAAa,EAAO,CACT,SAAS,EAAI,CACrC,SACA,OAAQ,EACR,gBACD,CAAC,CAGF,OAFK,EAEE,EAAa,CAAE,KAAM,EAAM,CAAE,IAAK,CACvC,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CALgB,EAAiB,EAAY,CAQjD,eAAe,EACb,EACA,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CACtB,EAAS,EAAmB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CACjF,GAAI,CAAC,EAAO,QACV,OAAO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAIxF,IAAM,EAAY,EAAO,UACzB,GAAI,CAAC,EAAU,KAAM,OAAO,EAAiB,EAAY,CAEzD,GAAM,CAAE,SAAQ,UAAW,EAAO,KAC5B,EAAS,EAAoB,EAAQ,EAAU,CAC/C,EAAiB,GAAU,EAG3B,EAAQ,EAAe,IAAI,EAAO,KAAK,CAC7C,GAAI,CAAC,GAAO,KAAM,OAAO,EAAiB,EAAY,CAEtD,IAAM,EAAS,EAAa,EAAO,CAC7B,EAAa,EAAU,KAIzB,EAAmB,EAAG,EAAM,KAAM,EAAK,CAE3C,GAAI,EAAW,cAAgB,EAAgB,CAC7C,IAAM,EAAuB,GAAG,EAAO,KAAK,eAEtC,EAAmB,EAAe,IAAI,EAAqB,CAGjE,GAAI,GAAkB,KAAM,CAG1B,IAAM,EAAqB,MADf,GAAQ,CACiB,GAAG,SACrC,OAAO,CAAE,SAAU,EAAiB,SAAU,CAAC,CAC/C,KAAK,EAAiB,CACtB,MAAM,EAAI,EAAG,EAAiB,KAAM,EAAK,CAAE,EAAG,EAAiB,OAAQ,EAAe,CAAC,CAAC,CAE3F,GAAI,EAAmB,OAAS,EAAG,CACjC,IAAM,EAAgB,EAAmB,IAAK,GAAM,EAAE,SAAmB,CAEzE,EAAc,EAAG,EAAQ,EAAM,GAAI,EAAc,CAAE,EAAG,EAAM,KAAM,EAAK,CAAC,GAK9E,IAAM,EAAU,MAAM,EAAO,SAAS,CACpC,MAAO,EACP,MAAO,EACP,SACA,OAAQ,EACR,gBACD,CAAC,CAIF,OAFI,EAAQ,SAAW,EAAU,EAAiB,EAAY,CAEvD,EAAa,CAAE,KAAM,EAAQ,GAAI,CAAE,IAAK,CAC7C,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CAKJ,eAAe,EAAU,EAAc,EAAsC,CAC3E,IAAM,EAAc,EAAiB,EAAK,EAAW,CAErD,GAAI,CACF,IAAM,EAAW,MAAM,EAAI,OAAO,KAAM,GAAM,EAAE,KAAK,CACrD,GAAI,CAAC,GAAY,EAAS,SAAW,EACnC,OAAO,EAAiB,EAAY,CAItC,IAAM,EAAO,MAAM,EAAY,EAAI,CAC7B,EAAU,MAAM,GAAY,CAOlC,OAAO,MAAM,EAL0B,CACrC,KAAM,CAAE,GAAI,SAAU,OAAQ,EAAO,CAAC,EAAK,CAAG,EAAE,CAAE,CAClD,UACD,CAEgD,SAAY,CAE7D,GAAI,EAAS,KAAO,UAIlB,OAAO,EAHQ,EAAoB,EAAW,GAC5C,EAAkB,EAAS,EAAM,EAAK,CACvC,CAC2B,IAAK,CAC/B,GAAG,EACH,gBAAiB,WAClB,CAAC,CAIJ,IAAM,EAAa,EAAS,GACtB,EACJ,EAAU,IAAI,EAAW,EACzB,EAAU,IAAI,EAAW,SAAS,IAAI,CAAG,EAAW,MAAM,EAAG,GAAG,CAAG,EAAW,CAqBhF,MAlBI,CAAC,GAAU,CAAC,EAAkB,EAAS,EAAM,EAAO,KAAK,CACpD,EAAiB,EAAY,CAIlC,EAAS,SAAW,EACf,EAAW,EAAK,EAAQ,EAAY,CAEzC,EAAS,KAAO,QACX,EAAY,EAAK,EAAQ,EAAY,CAE1C,EAAS,KAAO,QAAU,EAAS,GAC9B,EAAa,EAAK,EAAQ,EAAS,GAAI,EAAY,CAExD,EAAS,SAAW,EACf,EAAW,EAAK,EAAQ,EAAS,GAAI,EAAY,CAGnD,EAAiB,EAAY,EAClC,OACK,EAAK,CACZ,IAAM,EAAU,aAAe,MAAQ,EAAI,QAAU,wBAOrD,OANA,QAAQ,MAAM,+BAAgC,EAAI,CAClD,IAAU,CACR,OAAQ,IACR,UACA,KAAM,IAAI,IAAI,EAAI,IAAI,CAAC,SACxB,CAAC,CACK,EAAc,wBAAyB,iBAAkB,IAAK,EAAY,EAIrF,MAAO,CACL,KAAM,EAAc,IAAsB,EAAU,EAAK,EAAI,CAC7D,QAAU,GAAiB,EAAsB,EAAK,EAAW,CAClE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@murumets-ee/content-api",
-  "version": "0.3.0",
+  "version": "0.4.5",
   "license": "Elastic-2.0",
   "type": "module",
   "exports": {
@@ -12,21 +12,21 @@
   "files": [
     "dist"
   ],
-  "scripts": {
-    "build": "tsdown",
-    "dev": "tsdown --watch",
-    "test": "vitest"
-  },
   "dependencies": {
-    "@murumets-ee/core": "workspace:*",
-    "@murumets-ee/entity": "workspace:*",
-    "@murumets-ee/db": "workspace:*",
     "drizzle-orm": "^0.45.1",
-    "zod": "^3.24.1"
+    "zod": "^3.24.1",
+    "@murumets-ee/db": "0.4.5",
+    "@murumets-ee/entity": "0.4.5",
+    "@murumets-ee/core": "0.4.5"
   },
   "devDependencies": {
     "tsdown": "^0.21.7",
     "typescript": "^5.7.2",
     "vitest": "^2.1.8"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "dev": "tsdown --watch",
+    "test": "vitest"
   }
-}
+}