@murumets-ee/content-api 0.9.0 → 0.11.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/dist/index.d.mts.map +1 -1
  2. package/dist/index.mjs +1 -1
  3. package/dist/index.mjs.map +1 -1
  4. package/package.json +7 -4
package/dist/index.d.mts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/handler.ts","../src/schema-endpoint.ts"],"mappings":";;;;;UAciB,UAAA;EAYA;EAVf,cAAA;;EAEA,MAAA;AAAA;;UAQe,iBAAA;EAMN;EAJT,MAAA;EAQe;EANf,oBAAA;;EAEA,SAAA;AAAA;;UAIe,WAAA;EAMJ;EAJX,aAAA;EAI2C;EAF3C,2BAAA;EAUe;EARf,QAAA,GAAW,MAAA,SAAe,iBAAA;AAAA;;UAQX,gBAAA;EASQ;EAPvB,QAAA,EAAU,MAAA;EAeuB;;;;;EARjC,eAAA,QAAuB,OAAA,CAAQ,iBAAA;EAPrB;;;;;;EAeV,YAAA,IAAgB,GAAA,EAAK,OAAA,KAAY,OAAA;IAAU,IAAA;EAAA;EAM3C;;;;EAAA,UAAA;EASQ;EANR,aAAA;EAYA;EATA,IAAA,GAAO,UAAA;EAS2B;EANlC,KAAA,GAAQ,WAAA;EAM4D;EAHpE,QAAA;EAGkF;EAAlF,OAAA,IAAW,GAAA;IAAO,MAAA;IAAgB,OAAA;IAAiB,MAAA;IAAiB,IAAA;EAAA;AAAA;AAAA,UAOrD,mBAAA,KAAwB,MAAA;EACvC,IAAA,EAAM,CAAA;EACN,IAAA;IACE,KAAA;IACA,KAAA;IACA,MAAA;IACA,OAAA,WAEA;IAAA,UAAA;EAAA;AAAA;AAAA,UAIa,qBAAA,KAA0B,MAAA;EACzC,IAAA,EAAM,CAAA;AAAA;AAAA,UAGS,oBAAA;EACf,IAAA;IAAQ,KAAA;EAAA;AAAA;AAAA,UAGO,oBAAA;EACf,KAAA;IACE,MAAA;IACA,OAAA;IACA,IAAA;EAAA;AAAA;;UASa,WAAA;EACf,IAAA;EACA,QAAA;EACA,OAAA;EACA,WAAA;AAAA;;UAIe,YAAA;EACf,IAAA;EACA,UAAA;EACA,MAAA,EAAQ,MAAA,SAAe,WAAA;AAAA;;UAIR,cAAA;EACf,QAAA,EAAU,YAAA;AAAA;;UAQK,YAAA;EACf,MAAA,EAAQ,OAAA;IAAU,IAAA;EAAA;AAAA;;;iBCHJ,uBAAA,CAAwB,MAAA,EAAQ,gBAAA;aAkXjC,OAAA,EAAO,GAAA,EAAO,YAAA,KAAY,OAAA,CAAA,QAAA;iBACtB,OAAA,KAAO,QAAA;AAAA;;;;iBCteV,cAAA,CAAe,MAAA,EAAQ,MAAA,GAAS,YAAA;;;;AFChD;iBEoBgB,mBAAA,CACd,QAAA,EAAU,MAAA,IACV,eAAA,GAAkB,UAAA,uBACjB,cAAA"}
1
+ {"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/handler.ts","../src/schema-endpoint.ts"],"mappings":";;;;;UAciB,UAAA;EAYA;EAVf,cAAA;;EAEA,MAAA;AAAA;;UAQe,iBAAA;EAMN;EAJT,MAAA;EAQe;EANf,oBAAA;;EAEA,SAAA;AAAA;;UAIe,WAAA;EAMJ;EAJX,aAAA;EAI2C;EAF3C,2BAAA;EAUe;EARf,QAAA,GAAW,MAAA,SAAe,iBAAA;AAAA;;UAQX,gBAAA;EASQ;EAPvB,QAAA,EAAU,MAAA;EAeuB;;;;;EARjC,eAAA,QAAuB,OAAA,CAAQ,iBAAA;EAPrB;;;;;;EAeV,YAAA,IAAgB,GAAA,EAAK,OAAA,KAAY,OAAA;IAAU,IAAA;EAAA;EAM3C;;;;EAAA,UAAA;EASQ;EANR,aAAA;EAYA;EATA,IAAA,GAAO,UAAA;EAS2B;EANlC,KAAA,GAAQ,WAAA;EAM4D;EAHpE,QAAA;EAGkF;EAAlF,OAAA,IAAW,GAAA;IAAO,MAAA;IAAgB,OAAA;IAAiB,MAAA;IAAiB,IAAA;EAAA;AAAA;AAAA,UAOrD,mBAAA,KAAwB,MAAA;EACvC,IAAA,EAAM,CAAA;EACN,IAAA;IACE,KAAA;IACA,KAAA;IACA,MAAA;IACA,OAAA,WAEA;IAAA,UAAA;EAAA;AAAA;AAAA,UAIa,qBAAA,KAA0B,MAAA;EACzC,IAAA,EAAM,CAAA;AAAA;AAAA,UAGS,oBAAA;EACf,IAAA;IAAQ,KAAA;EAAA;AAAA;AAAA,UAGO,oBAAA;EACf,KAAA;IACE,MAAA;IACA,OAAA;IACA,IAAA;EAAA;AAAA;;UASa,WAAA;EACf,IAAA;EACA,QAAA;EACA,OAAA;EACA,WAAA;AAAA;;UAIe,YAAA;EACf,IAAA;EACA,UAAA;EACA,MAAA,EAAQ,MAAA,SAAe,WAAA;AAAA;;UAIR,cAAA;EACf,QAAA,EAAU,YAAA;AAAA;;UAQK,YAAA;EACf,MAAA,EAAQ,OAAA;IAAU,IAAA;EAAA;AAAA;;;iBCFJ,uBAAA,CAAwB,MAAA,EAAQ,gBAAA;aAmXjC,OAAA,EAAO,GAAA,EAAO,YAAA,KAAY,OAAA,CAAA,QAAA;iBACtB,OAAA,KAAO,QAAA;AAAA;;;;iBCxeV,cAAA,CAAe,MAAA,EAAQ,MAAA,GAAS,YAAA;;;;AFChD;iBEoBgB,mBAAA,CACd,QAAA,EAAU,MAAA,IACV,eAAA,GAAkB,UAAA,uBACjB,cAAA"}
package/dist/index.mjs CHANGED
@@ -1,2 +1,2 @@
1
- import{LOCALE_PATTERN as e,escapeLikePattern as t,getApp as n,getContext as r,runWithContextAsync as i}from"@murumets-ee/core";import{schemaRegistry as a}from"@murumets-ee/db";import{CountCache as o,decodeCursor as s,encodeCursor as c,estimateRowCount as l}from"@murumets-ee/entity";import{QueryClient as u}from"@murumets-ee/entity/query";import{and as d,asc as f,desc as p,eq as m,gte as h,ilike as g,inArray as _,lte as v,or as y}from"drizzle-orm";import{z as b}from"zod";function x(e,t){let n=t?.entities?.[e];if(n?.cacheable===!1)return{"Cache-Control":`no-store`};let r=n?.maxAge??t?.defaultMaxAge??60,i=n?.staleWhileRevalidate??t?.defaultStaleWhileRevalidate??300;return{"Cache-Control":`public, max-age=${r}, stale-while-revalidate=${i}`}}function S(e,t){if(!t)return{};let n=e.headers.get(`Origin`);return!n||!t.allowedOrigins.includes(n)?{}:{"Access-Control-Allow-Origin":n,"Access-Control-Allow-Methods":`GET, OPTIONS`,"Access-Control-Allow-Headers":`Content-Type, Accept, Authorization`,"Access-Control-Max-Age":String(t.maxAge??3600),Vary:`Origin`}}function C(e,t){let n=S(e,t);return new Response(null,{status:204,headers:n})}const w=b.object({limit:b.coerce.number().int().min(1).max(100).default(20),offset:b.coerce.number().int().min(0).default(0),sort:b.string().regex(/^-?[a-zA-Z_]+$/).optional(),locale:b.string().regex(e).optional(),fields:b.string().optional(),search:b.string().max(200).optional(),cursor:b.string().max(500).optional()}),T=b.object({locale:b.string().regex(e).optional(),fields:b.string().optional()}),E=b.object({locale:b.string().regex(e).optional()}),D=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function O(e,t){switch(e.type){case`boolean`:return t===`true`?!0:t===`false`?!1:null;case`reference`:case`media`:return D.test(t)?t:null;case`select`:return e.options.includes(t)?t:null;case`date`:return t;case`text`:case`number`:return t;default:return null}}function k(e,t){if(!e)return;let n=e.split(`,`).map(e=>e.trim()).filter(e=>e in t&&!e.startsWith(`_`)&&t[e].type!==`blocks`);return n.length>0&&!n.includes(`id`)&&n.unshift(`id`),n.length>0?n:void 0}function A(e,t=200,n){return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":`application/json`,...n}})}function j(e,t,n,r){return A({error:{status:n,message:e,code:t}},n,r)}function M(e){return j(`Not found`,`NOT_FOUND`,404,e)}function N(e){let t={type:e.type};return e.required&&(t.required=!0),e.type===`select`&&(t.options=e.options),e.type===`reference`&&(t.cardinality=e.cardinality),t}function P(e){let t=e.allFields,n={};for(let[e,r]of Object.entries(t))e.startsWith(`_`)||(n[e]=N(r));return{name:e.name,pluralName:`${e.name}s`,fields:n}}function F(e,t){return{entities:e.filter(e=>t(e.name)).map(P)}}function I(e){let t=new Map;for(let n of e)t.set(n.name,n),t.set(`${n.name}s`,n);return t}function L(e,n){let r=a.get(e.name);if(!r)return;let i=e.allFields;for(let[e,a]of Object.entries(i))if(a.type===`text`&&(a.indexed||a.required)){let i=r[e];if(i)return g(i,`%${t(n)}%`)}}function R(e,t,n){if(!t)return;let r=t.startsWith(`-`),i=r?t.slice(1):t,o=n[i];if(!o||o.type===`blocks`)return;let s=a.get(e);if(!(!s||!s[i]))return r?p(s[i]):f(s[i])}function z(e,t,n){let r=a.get(e);if(!r)return[];let i=[];for(let[e,a]of t.searchParams.entries()){let t=e.match(/^filter\[([a-zA-Z_]+)\]$/);if(!t)continue;let o=t[1],s=n[o];if(!s||s.type===`blocks`)continue;let c=r[o];if(!c)continue;if(s.type===`date`){a.startsWith(`gte:`)?i.push(h(c,a.slice(4))):a.startsWith(`lte:`)?i.push(v(c,a.slice(4))):i.push(m(c,a));continue}let l=O(s,a);l!==null&&i.push(m(c,l))}return i}function B(e){let{entities:t,defaultLocale:f,publicRole:p=`public`,cors:h,cache:g,onError:v}=e,b=Math.min(e.maxLimit??100,100),D=I(t),O=new o(5e3),N=null,P=0;async function B(){let t=Date.now();return(!N||t-P>3e4)&&(N=await e.loadPermissions(),P=t),N}async function V(t){if(!e.authenticate)return p;try{return(await e.authenticate(t))?.role??p}catch{return p}}function H(e,t,n){return e(t,n,`view`)}function U(e){let t=n();return new u({entity:e,db:t.db.readOnly,logger:t.logger.child({entity:e.name}),countCache:O,contextResolver:()=>{let e=r();if(!(!e?.user||!e?.checker))return{user:e.user,checker:e.checker,scope:e.scope}}})}async function W(e,t,n){let r=new URL(e.url),i=w.safeParse(Object.fromEntries(r.searchParams));if(!i.success)return j(`Invalid query parameters`,`VALIDATION_ERROR`,400,n);let{limit:a,offset:o,sort:l,locale:u,fields:p,search:m,cursor:h}=i.data,_=Math.min(a,b),v=t.allFields,y;if(h){let e=s(h);if(!e)return j(`Invalid cursor`,`VALIDATION_ERROR`,400,n);if(!(e.field in v)&&e.field!==`id`)return j(`Invalid cursor field`,`VALIDATION_ERROR`,400,n);y=e}let S=[];if(m){let e=L(t,m);e&&S.push(e)}let C=z(t.name,r,v);S.push(...C);let T=R(t.name,l,v),E=k(p,v),D=U(t),O=u??f,M={where:S.length>0?d(...S):void 0,limit:_,offset:o,orderBy:T,select:E,locale:O,defaultLocale:f,cursor:y},[N,P]=await Promise.all([D.findMany(M),D.count({where:S.length>0?d(...S):void 0})]),F;if(N.length>0&&N.length===_){let e=N[N.length-1],t=y?.field??(l?l.startsWith(`-`)?l.slice(1):l:void 0),n=y?.direction??(l?.startsWith(`-`)?`desc`:`asc`);t&&e[t]!==void 0&&(F=c(e,t,n))}let I={...n,...x(t.name,g)};return A({data:N,meta:{total:P,limit:_,offset:o,hasMore:o+_<P,nextCursor:F}},200,I)}async function G(e,t,r){let i=new URL(e.url);return E.safeParse(Object.fromEntries(i.searchParams)).success?i.searchParams.get(`countMode`)===`estimate`?A({data:{count:await l(n().db.readOnly,t.name),estimate:!0}},200,{...r,...x(t.name,g)}):A({data:{count:await U(t).count()}},200,{...r,...x(t.name,g)}):j(`Invalid query parameters`,`VALIDATION_ERROR`,400,r)}async function K(e,t,n,r){let i=new URL(e.url),a=T.safeParse(Object.fromEntries(i.searchParams));if(!a.success)return j(`Invalid query parameters`,`VALIDATION_ERROR`,400,r);let{locale:o,fields:s}=a.data,c=t.allFields,l=k(s,c),u=o??f,d=await U(t).findById(n,{select:l,locale:u,defaultLocale:f});return d?A({data:d},200,{...r,...x(t.name,g)}):M(r)}async function q(e,t,r,i){let o=new URL(e.url),s=T.safeParse(Object.fromEntries(o.searchParams));if(!s.success)return j(`Invalid query parameters`,`VALIDATION_ERROR`,400,i);let c=t.allFields;if(!c.slug)return M(i);let{locale:l,fields:u}=s.data,p=k(u,c),h=l??f,v=a.get(t.name);if(!v?.slug)return M(i);let b=U(t),S=c.slug,C=m(v.slug,r);if(S.translatable&&h){let e=`${t.name}_translations`,i=a.get(e);if(i?.slug){let e=await n().db.readOnly.select({entityId:i.entityId}).from(i).where(d(m(i.slug,r),m(i.locale,h)));if(e.length>0){let t=e.map(e=>e.entityId);C=y(_(v.id,t),m(v.slug,r))}}}let w=await b.findMany({where:C,limit:1,select:p,locale:h,defaultLocale:f});return w.length===0?M(i):A({data:w[0]},200,{...i,...x(t.name,g)})}async function J(e,n){let r=S(e,h);try{let a=await n.params.then(e=>e.path);if(!a||a.length===0)return M(r);let o=await V(e),s=await B();return await i({user:{id:`public`,groups:o?[o]:[]},checker:s},async()=>{if(a[0]===`_schema`)return A(F(t,e=>H(s,o,e)),200,{...r,"Cache-Control":`no-store`});let n=a[0],i=D.get(n)??D.get(n.endsWith(`s`)?n.slice(0,-1):n);return!i||!H(s,o,i.name)?M(r):a.length===1?W(e,i,r):a[1]===`count`?G(e,i,r):a[1]===`slug`&&a[2]?q(e,i,a[2],r):a.length===2?K(e,i,a[1],r):M(r)})}catch(t){let n=t instanceof Error?t.message:`Internal server error`;return console.error(`[content-api] handler error:`,t),v?.({status:500,message:n,path:new URL(e.url).pathname}),j(`Internal server error`,`INTERNAL_ERROR`,500,r)}}return{GET:(e,t)=>J(e,t),OPTIONS:e=>C(e,h)}}export{F as buildSchemaResponse,B as createContentApiHandler,P as toSchemaEntity};
1
+ import{LOCALE_PATTERN as e,escapeLikePattern as t,getApp as n,getContext as r,runWithContextAsync as i}from"@murumets-ee/core";import{schemaRegistry as a}from"@murumets-ee/db";import{CountCache as o,decodeCursor as s,encodeCursor as c,estimateRowCount as l}from"@murumets-ee/entity";import{QueryClient as u}from"@murumets-ee/entity/query";import{and as d,asc as f,desc as p,eq as m,gte as h,ilike as g,inArray as _,lte as v,or as y}from"drizzle-orm";import{z as b}from"zod";function x(e,t){let n=t?.entities?.[e];if(n?.cacheable===!1)return{"Cache-Control":`no-store`};let r=n?.maxAge??t?.defaultMaxAge??60,i=n?.staleWhileRevalidate??t?.defaultStaleWhileRevalidate??300;return{"Cache-Control":`public, max-age=${r}, stale-while-revalidate=${i}`}}function S(e,t){if(!t)return{};let n=e.headers.get(`Origin`);return!n||!t.allowedOrigins.includes(n)?{}:{"Access-Control-Allow-Origin":n,"Access-Control-Allow-Methods":`GET, OPTIONS`,"Access-Control-Allow-Headers":`Content-Type, Accept, Authorization`,"Access-Control-Max-Age":String(t.maxAge??3600),Vary:`Origin`}}function C(e,t){let n=S(e,t);return new Response(null,{status:204,headers:n})}const w=b.object({limit:b.coerce.number().int().min(1).max(100).default(20),offset:b.coerce.number().int().min(0).default(0),sort:b.string().regex(/^-?[a-zA-Z_]+$/).optional(),locale:b.string().regex(e).optional(),fields:b.string().optional(),search:b.string().max(200).optional(),cursor:b.string().max(500).optional()}),T=b.object({locale:b.string().regex(e).optional(),fields:b.string().optional()}),E=b.object({locale:b.string().regex(e).optional()}),D=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function O(e,t){switch(e.type){case`boolean`:return t===`true`?!0:t===`false`?!1:null;case`reference`:case`media`:return D.test(t)?t:null;case`select`:return e.options.includes(t)?t:null;case`date`:return t;case`text`:case`number`:return t;default:return null}}function k(e,t){if(!e)return;let n=e.split(`,`).map(e=>e.trim()).filter(e=>{let n=t[e];return n!==void 0&&!e.startsWith(`_`)&&n.type!==`blocks`});return n.length>0&&!n.includes(`id`)&&n.unshift(`id`),n.length>0?n:void 0}function A(e,t=200,n){return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":`application/json`,...n}})}function j(e,t,n,r){return A({error:{status:n,message:e,code:t}},n,r)}function M(e){return j(`Not found`,`NOT_FOUND`,404,e)}function N(e){let t={type:e.type};return e.required&&(t.required=!0),e.type===`select`&&(t.options=e.options),e.type===`reference`&&(t.cardinality=e.cardinality),t}function P(e){let t=e.allFields,n={};for(let[e,r]of Object.entries(t))e.startsWith(`_`)||(n[e]=N(r));return{name:e.name,pluralName:`${e.name}s`,fields:n}}function F(e,t){return{entities:e.filter(e=>t(e.name)).map(P)}}function I(e){let t=new Map;for(let n of e)t.set(n.name,n),t.set(`${n.name}s`,n);return t}function L(e,n){let r=a.get(e.name);if(!r)return;let i=e.allFields;for(let[e,a]of Object.entries(i))if(a.type===`text`&&(a.indexed||a.required)){let i=r[e];if(i)return g(i,`%${t(n)}%`)}}function R(e,t,n){if(!t)return;let r=t.startsWith(`-`),i=r?t.slice(1):t,o=n[i];if(!o||o.type===`blocks`)return;let s=a.get(e);if(!(!s||!s[i]))return r?p(s[i]):f(s[i])}function z(e,t,n){let r=a.get(e);if(!r)return[];let i=[];for(let[e,a]of t.searchParams.entries()){let t=e.match(/^filter\[([a-zA-Z_]+)\]$/);if(!t)continue;let o=t[1];if(o===void 0)continue;let s=n[o];if(!s||s.type===`blocks`)continue;let c=r[o];if(!c)continue;if(s.type===`date`){a.startsWith(`gte:`)?i.push(h(c,a.slice(4))):a.startsWith(`lte:`)?i.push(v(c,a.slice(4))):i.push(m(c,a));continue}let l=O(s,a);l!==null&&i.push(m(c,l))}return i}function B(e){let{entities:t,defaultLocale:f,publicRole:p=`public`,cors:h,cache:g,onError:v}=e,b=Math.min(e.maxLimit??100,100),D=I(t),O=new o(5e3),N=null,P=0;async function B(){let t=Date.now();return(!N||t-P>3e4)&&(N=await e.loadPermissions(),P=t),N}async function V(t){if(!e.authenticate)return p;try{return(await e.authenticate(t))?.role??p}catch{return p}}function H(e,t,n){return e(t,n,`view`)}function U(e){let t=n();return new u({entity:e,db:t.db.readOnly,logger:t.logger.child({entity:e.name}),countCache:O,contextResolver:()=>{let e=r();if(!(!e?.user||!e?.checker))return{user:e.user,checker:e.checker,scope:e.scope}}})}async function W(e,t,n){let r=new URL(e.url),i=w.safeParse(Object.fromEntries(r.searchParams));if(!i.success)return j(`Invalid query parameters`,`VALIDATION_ERROR`,400,n);let{limit:a,offset:o,sort:l,locale:u,fields:p,search:m,cursor:h}=i.data,_=Math.min(a,b),v=t.allFields,y;if(h){let e=s(h);if(!e)return j(`Invalid cursor`,`VALIDATION_ERROR`,400,n);if(!(e.field in v)&&e.field!==`id`)return j(`Invalid cursor field`,`VALIDATION_ERROR`,400,n);y=e}let S=[];if(m){let e=L(t,m);e&&S.push(e)}let C=z(t.name,r,v);S.push(...C);let T=R(t.name,l,v),E=k(p,v),D=U(t),O=u??f,M={where:S.length>0?d(...S):void 0,limit:_,offset:o,orderBy:T,select:E,locale:O,defaultLocale:f,cursor:y},[N,P]=await Promise.all([D.findMany(M),D.count({where:S.length>0?d(...S):void 0})]),F;if(N.length>0&&N.length===_){let e=N[N.length-1],t=y?.field??(l?l.startsWith(`-`)?l.slice(1):l:void 0),n=y?.direction??(l?.startsWith(`-`)?`desc`:`asc`);t&&e[t]!==void 0&&(F=c(e,t,n))}let I={...n,...x(t.name,g)};return A({data:N,meta:{total:P,limit:_,offset:o,hasMore:o+_<P,nextCursor:F}},200,I)}async function G(e,t,r){let i=new URL(e.url);return E.safeParse(Object.fromEntries(i.searchParams)).success?i.searchParams.get(`countMode`)===`estimate`?A({data:{count:await l(n().db.readOnly,t.name),estimate:!0}},200,{...r,...x(t.name,g)}):A({data:{count:await U(t).count()}},200,{...r,...x(t.name,g)}):j(`Invalid query parameters`,`VALIDATION_ERROR`,400,r)}async function K(e,t,n,r){let i=new URL(e.url),a=T.safeParse(Object.fromEntries(i.searchParams));if(!a.success)return j(`Invalid query parameters`,`VALIDATION_ERROR`,400,r);let{locale:o,fields:s}=a.data,c=t.allFields,l=k(s,c),u=o??f,d=await U(t).findById(n,{select:l,locale:u,defaultLocale:f});return d?A({data:d},200,{...r,...x(t.name,g)}):M(r)}async function q(e,t,r,i){let o=new URL(e.url),s=T.safeParse(Object.fromEntries(o.searchParams));if(!s.success)return j(`Invalid query parameters`,`VALIDATION_ERROR`,400,i);let c=t.allFields;if(!c.slug)return M(i);let{locale:l,fields:u}=s.data,p=k(u,c),h=l??f,v=a.get(t.name);if(!v?.slug)return M(i);let b=U(t),S=c.slug,C=m(v.slug,r);if(S.translatable&&h){let e=`${t.name}_translations`,i=a.get(e);if(i?.slug){let e=await n().db.readOnly.select({entityId:i.entityId}).from(i).where(d(m(i.slug,r),m(i.locale,h)));if(e.length>0){let t=e.map(e=>e.entityId);C=y(_(v.id,t),m(v.slug,r))}}}let w=await b.findMany({where:C,limit:1,select:p,locale:h,defaultLocale:f});return w.length===0?M(i):A({data:w[0]},200,{...i,...x(t.name,g)})}async function J(e,n){let r=S(e,h);try{let a=await n.params.then(e=>e.path);if(!a||a.length===0)return M(r);let o=await V(e),s=await B();return await i({user:{id:`public`,groups:o?[o]:[]},checker:s},async()=>{if(a[0]===`_schema`)return A(F(t,e=>H(s,o,e)),200,{...r,"Cache-Control":`no-store`});let n=a[0];if(n===void 0)return M(r);let i=D.get(n)??D.get(n.endsWith(`s`)?n.slice(0,-1):n);return!i||!H(s,o,i.name)?M(r):a.length===1?W(e,i,r):a[1]===`count`?G(e,i,r):a[1]===`slug`&&a[2]?q(e,i,a[2],r):a.length===2&&a[1]!==void 0?K(e,i,a[1],r):M(r)})}catch(t){let n=t instanceof Error?t.message:`Internal server error`;return console.error(`[content-api] handler error:`,t),v?.({status:500,message:n,path:new URL(e.url).pathname}),j(`Internal server error`,`INTERNAL_ERROR`,500,r)}}return{GET:(e,t)=>J(e,t),OPTIONS:e=>C(e,h)}}export{F as buildSchemaResponse,B as createContentApiHandler,P as toSchemaEntity};
2
2
  //# sourceMappingURL=index.mjs.map
package/dist/index.mjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.mjs","names":[],"sources":["../src/cache.ts","../src/cors.ts","../src/query-params.ts","../src/response.ts","../src/schema-endpoint.ts","../src/handler.ts"],"sourcesContent":["/**\n * Cache-Control header builder.\n *\n * Defaults: public, max-age=60, stale-while-revalidate=300.\n * Per-entity overrides for hot content (low TTL) vs static pages (high TTL).\n */\n\nimport type { CacheConfig } from './types.js'\n\nexport function buildCacheHeaders(\n entityName: string,\n config: CacheConfig | undefined,\n): Record<string, string> {\n const entityConfig = config?.entities?.[entityName]\n\n if (entityConfig?.cacheable === false) {\n return { 'Cache-Control': 'no-store' }\n }\n\n const maxAge = entityConfig?.maxAge ?? config?.defaultMaxAge ?? 60\n const swr = entityConfig?.staleWhileRevalidate ?? config?.defaultStaleWhileRevalidate ?? 300\n\n return {\n 'Cache-Control': `public, max-age=${maxAge}, stale-while-revalidate=${swr}`,\n }\n}\n","/**\n * CORS — Origin allowlist with exact match.\n *\n * No wildcards, no regex. This is a CMS content API — you know which\n * frontends consume it. Vary: Origin ensures CDNs cache per-origin.\n */\n\nimport type { CorsConfig } from './types.js'\n\nexport function buildCorsHeaders(\n req: Request,\n config: CorsConfig | undefined,\n): Record<string, string> {\n if (!config) return {}\n\n const origin = req.headers.get('Origin')\n if (!origin) return {}\n\n // Exact match only\n if (!config.allowedOrigins.includes(origin)) return {}\n\n return {\n 'Access-Control-Allow-Origin': origin,\n 'Access-Control-Allow-Methods': 'GET, OPTIONS',\n 'Access-Control-Allow-Headers': 'Content-Type, Accept, Authorization',\n 'Access-Control-Max-Age': String(config.maxAge ?? 3600),\n Vary: 'Origin',\n }\n}\n\nexport function corsPreflightResponse(req: Request, config: CorsConfig | undefined): Response {\n const headers = buildCorsHeaders(req, config)\n return new Response(null, { status: 204, headers })\n}\n","/**\n * Query parameter validation — Zod schemas for all content API endpoints.\n *\n * All user input is validated before it touches QueryClient.\n * Pagination hard-capped at MAX_LIMIT. Sort/filter restricted to queryable columns.\n */\n\nimport { escapeLikePattern, LOCALE_PATTERN } from '@murumets-ee/core'\nimport type { FieldConfig } from '@murumets-ee/entity'\nimport { z } from 'zod'\n\nexport const MAX_LIMIT = 100\n\n/** List endpoint query params. */\nexport const listParamsSchema = z.object({\n limit: z.coerce.number().int().min(1).max(MAX_LIMIT).default(20),\n offset: z.coerce.number().int().min(0).default(0),\n sort: z\n .string()\n .regex(/^-?[a-zA-Z_]+$/)\n .optional(),\n locale: z.string().regex(LOCALE_PATTERN).optional(),\n fields: z.string().optional(),\n search: z.string().max(200).optional(),\n /** Opaque cursor for keyset pagination (base64-encoded JSON). */\n cursor: z.string().max(500).optional(),\n})\n\n/** Single entity query params. */\nexport const singleParamsSchema = z.object({\n locale: z.string().regex(LOCALE_PATTERN).optional(),\n fields: z.string().optional(),\n})\n\n/** Count endpoint query params. */\nexport const countParamsSchema = z.object({\n locale: z.string().regex(LOCALE_PATTERN).optional(),\n})\n\n// Re-export from core so existing imports from this module continue to work\nexport { escapeLikePattern }\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\n/**\n * Validate a filter value against the field type.\n * Returns the validated value or null if invalid.\n */\nexport function validateFilterValue(fieldConfig: FieldConfig, raw: string): unknown {\n switch (fieldConfig.type) {\n case 'boolean':\n if (raw === 'true') return true\n if (raw === 'false') return false\n return null\n\n case 'reference':\n case 'media':\n return UUID_RE.test(raw) ? raw : null\n\n case 'select':\n return fieldConfig.options.includes(raw) ? raw : null\n\n case 'date':\n // Plain date or gte:/lte: prefix handled by caller\n return raw\n\n case 'text':\n case 'number':\n return raw\n\n default:\n return null\n }\n}\n\n/**\n * Parse field selection string into validated field names.\n * Unknown/internal field names are silently dropped (no info leakage).\n */\nexport function parseFieldSelection(\n fieldsParam: string | undefined,\n allFields: Record<string, FieldConfig>,\n): string[] | undefined {\n if (!fieldsParam) return undefined\n\n const requested = fieldsParam.split(',').map((f) => f.trim())\n const valid = requested.filter(\n (name) => name in allFields && !name.startsWith('_') && allFields[name].type !== 'blocks',\n )\n\n // Always include id\n if (valid.length > 0 && !valid.includes('id')) {\n valid.unshift('id')\n }\n\n return valid.length > 0 ? valid : undefined\n}\n","/**\n * Response helpers — JSON envelope builders.\n */\n\nexport function jsonResponse(\n data: unknown,\n status = 200,\n extraHeaders?: Record<string, string>,\n): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: {\n 'Content-Type': 'application/json',\n ...extraHeaders,\n },\n })\n}\n\nexport function errorResponse(\n message: string,\n code: string,\n status: number,\n extraHeaders?: Record<string, string>,\n): Response {\n return jsonResponse({ error: { status, message, code } }, status, extraHeaders)\n}\n\nexport function notFoundResponse(extraHeaders?: Record<string, string>): Response {\n return errorResponse('Not found', 'NOT_FOUND', 404, extraHeaders)\n}\n","/**\n * Schema introspection endpoint — GET /_schema\n *\n * Returns public-safe entity metadata for SDK generation.\n * Only exposes: type, required, options (select), cardinality (reference).\n * Internal fields (_version, _scopeId) excluded.\n * No hooks, behaviors, access rules, or implementation details.\n *\n * Response is filtered by the caller's role permissions — only entities\n * the role can 'view' are included.\n */\n\nimport type { Entity, FieldConfig } from '@murumets-ee/entity'\nimport type { SchemaEntity, SchemaField, SchemaResponse } from './types.js'\n\n/** Convert a FieldConfig to the public-safe SchemaField subset. */\nfunction toSchemaField(config: FieldConfig): SchemaField {\n const field: SchemaField = { type: config.type }\n\n if (config.required) {\n field.required = true\n }\n\n if (config.type === 'select') {\n field.options = config.options\n }\n\n if (config.type === 'reference') {\n field.cardinality = config.cardinality\n }\n\n return field\n}\n\n/** Convert an Entity to public-safe schema metadata. */\nexport function toSchemaEntity(entity: Entity): SchemaEntity {\n const allFields = entity.allFields as Record<string, FieldConfig>\n const fields: Record<string, SchemaField> = {}\n\n for (const [name, config] of Object.entries(allFields)) {\n // Skip internal fields\n if (name.startsWith('_')) continue\n fields[name] = toSchemaField(config)\n }\n\n return {\n name: entity.name,\n pluralName: `${entity.name}s`,\n fields,\n }\n}\n\n/**\n * Build the full /_schema response.\n * Only includes entities that pass the permission check.\n */\nexport function buildSchemaResponse(\n entities: Entity[],\n checkPermission: (entityName: string) => boolean,\n): SchemaResponse {\n const visible = entities.filter((e) => checkPermission(e.name))\n return {\n entities: visible.map(toSchemaEntity),\n }\n}\n","/**\n * Content API handler factory\n *\n * Creates a read-only catch-all route handler for public content delivery.\n * Mirrors the `createAdminApiHandler` pattern but with:\n * - No mutations (GET + OPTIONS only)\n * - Permission-gated (public role starts with 0 permissions)\n * - Published content only (QueryClient auto-filters)\n * - CORS + Cache-Control headers\n *\n * @example\n * ```typescript\n * // app/api/content/[...path]/route.ts\n * import { createContentApiHandler } from '@murumets-ee/content-api'\n * import { Article, Page } from '@/entities'\n *\n * const handler = createContentApiHandler({\n * entities: [Article, Page],\n * loadPermissions: async () => {\n * const roles = await loadRoles(getApp())\n * return buildPermissionChecker(roles)\n * },\n * cors: { allowedOrigins: ['https://www.example.com'] },\n * })\n *\n * export const { GET, OPTIONS } = handler\n * ```\n */\n\nimport type { PermissionChecker, RequestContext } from '@murumets-ee/core'\nimport { getApp, getContext, runWithContextAsync } from '@murumets-ee/core'\nimport { schemaRegistry } from '@murumets-ee/db'\nimport type { CursorInput, Entity, FieldConfig, SlugField } from '@murumets-ee/entity'\nimport { CountCache, decodeCursor, encodeCursor, estimateRowCount } from '@murumets-ee/entity'\nimport { QueryClient } from '@murumets-ee/entity/query'\nimport { and, asc, desc, eq, gte, ilike, inArray, lte, or, type SQL } from 'drizzle-orm'\nimport type { PgTableWithColumns } from 'drizzle-orm/pg-core'\nimport { buildCacheHeaders } from './cache.js'\nimport { buildCorsHeaders, corsPreflightResponse } from './cors.js'\nimport {\n countParamsSchema,\n escapeLikePattern,\n listParamsSchema,\n MAX_LIMIT,\n parseFieldSelection,\n singleParamsSchema,\n validateFilterValue,\n} from './query-params.js'\nimport { errorResponse, jsonResponse, notFoundResponse } from './response.js'\nimport { buildSchemaResponse } from './schema-endpoint.js'\nimport type { ContentApiConfig, RouteContext } from './types.js'\n\n// ---------------------------------------------------------------------------\n// Entity resolution (whitelist-based, same pattern as admin handler)\n// ---------------------------------------------------------------------------\n\nfunction buildEntityMap(entities: Entity[]): Map<string, Entity> {\n const map = new Map<string, Entity>()\n for (const entity of entities) {\n map.set(entity.name, entity)\n map.set(`${entity.name}s`, entity)\n }\n return map\n}\n\n// ---------------------------------------------------------------------------\n// Query helpers\n// ---------------------------------------------------------------------------\n\nfunction buildSearchCondition(entity: Entity, search: string): SQL | undefined {\n // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n const table = schemaRegistry.get(entity.name) as PgTableWithColumns<any> | undefined\n if (!table) return undefined\n\n const allFields = entity.allFields as Record<string, FieldConfig>\n for (const [fieldName, config] of Object.entries(allFields)) {\n if (config.type === 'text' && (config.indexed || config.required)) {\n const column = table[fieldName]\n if (column) return ilike(column, `%${escapeLikePattern(search)}%`)\n }\n }\n return undefined\n}\n\nfunction buildOrderBy(\n entityName: string,\n sortParam: string | undefined,\n allFields: Record<string, FieldConfig>,\n): SQL | undefined {\n if (!sortParam) return undefined\n\n const descending = sortParam.startsWith('-')\n const fieldName = descending ? sortParam.slice(1) : sortParam\n\n const fieldConfig = allFields[fieldName]\n if (!fieldConfig || fieldConfig.type === 'blocks') return undefined\n\n // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n const table = schemaRegistry.get(entityName) as PgTableWithColumns<any> | undefined\n if (!table || !table[fieldName]) return undefined\n\n return descending ? desc(table[fieldName]) : asc(table[fieldName])\n}\n\nfunction buildFilterConditions(\n entityName: string,\n url: URL,\n allFields: Record<string, FieldConfig>,\n): SQL[] {\n // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n const table = schemaRegistry.get(entityName) as PgTableWithColumns<any> | undefined\n if (!table) return []\n\n const conditions: SQL[] = []\n\n for (const [key, raw] of url.searchParams.entries()) {\n const match = key.match(/^filter\\[([a-zA-Z_]+)\\]$/)\n if (!match) continue\n\n const fieldName = match[1]\n const fieldConfig = allFields[fieldName]\n if (!fieldConfig || fieldConfig.type === 'blocks') continue\n\n const column = table[fieldName]\n if (!column) continue\n\n // Date range filters: gte: / lte: prefix\n if (fieldConfig.type === 'date') {\n if (raw.startsWith('gte:')) {\n conditions.push(gte(column, raw.slice(4)))\n } else if (raw.startsWith('lte:')) {\n conditions.push(lte(column, raw.slice(4)))\n } else {\n conditions.push(eq(column, raw))\n }\n continue\n }\n\n const validated = validateFilterValue(fieldConfig, raw)\n if (validated === null) continue\n conditions.push(eq(column, validated))\n }\n\n return conditions\n}\n\n// ---------------------------------------------------------------------------\n// Handler factory\n// ---------------------------------------------------------------------------\n\nexport function createContentApiHandler(config: ContentApiConfig) {\n const {\n entities,\n defaultLocale,\n publicRole = 'public',\n cors: corsConfig,\n cache: cacheConfig,\n onError,\n } = config\n const maxLimit = Math.min(config.maxLimit ?? MAX_LIMIT, MAX_LIMIT)\n const entityMap = buildEntityMap(entities)\n\n // Shared count cache — reduces COUNT(*) queries on paginated list pages.\n const countCache = new CountCache(5000)\n\n // Lazy-loaded permission checker — cached with 30s TTL\n const PERMISSION_CACHE_TTL_MS = 30_000\n let permissionChecker: PermissionChecker | null = null\n let permissionCacheTime = 0\n\n async function getChecker(): Promise<PermissionChecker> {\n const now = Date.now()\n if (!permissionChecker || now - permissionCacheTime > PERMISSION_CACHE_TTL_MS) {\n permissionChecker = await config.loadPermissions()\n permissionCacheTime = now\n }\n return permissionChecker\n }\n\n // -- Role resolution -------------------------------------------------------\n\n async function resolveRole(req: Request): Promise<string> {\n if (!config.authenticate) return publicRole\n try {\n const result = await config.authenticate(req)\n return result?.role ?? publicRole\n } catch {\n return publicRole\n }\n }\n\n // -- Permission check (returns 404 on deny to avoid info leakage) ----------\n\n function hasViewPermission(\n checker: PermissionChecker,\n role: string,\n entityName: string,\n ): boolean {\n return checker(role, entityName, 'view')\n }\n\n // -- Create QueryClient from entity ----------------------------------------\n\n function createClient(entity: Entity): QueryClient {\n const app = getApp()\n return new QueryClient({\n entity,\n db: app.db.readOnly,\n logger: app.logger.child({ entity: entity.name }),\n countCache,\n contextResolver: () => {\n const ctx = getContext()\n if (!ctx?.user || !ctx?.checker) return undefined\n return { user: ctx.user, checker: ctx.checker, scope: ctx.scope }\n },\n })\n }\n\n // -- Endpoint handlers -----------------------------------------------------\n\n async function handleList(\n req: Request,\n entity: Entity,\n corsHeaders: Record<string, string>,\n ): Promise<Response> {\n const url = new URL(req.url)\n const params = listParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n if (!params.success) {\n return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n }\n\n const {\n limit: rawLimit,\n offset,\n sort,\n locale,\n fields,\n search,\n cursor: cursorParam,\n } = params.data\n const limit = Math.min(rawLimit, maxLimit)\n const allFields = entity.allFields as Record<string, FieldConfig>\n\n // Cursor-based pagination (opt-in, replaces OFFSET when provided)\n let cursor: CursorInput | undefined\n if (cursorParam) {\n const decoded = decodeCursor(cursorParam)\n if (!decoded) {\n return errorResponse('Invalid cursor', 'VALIDATION_ERROR', 400, corsHeaders)\n }\n // Whitelist: cursor field must be a real field on the entity\n if (!(decoded.field in allFields) && decoded.field !== 'id') {\n return errorResponse('Invalid cursor field', 'VALIDATION_ERROR', 400, corsHeaders)\n }\n cursor = decoded\n }\n\n const where: SQL[] = []\n if (search) {\n const searchCondition = buildSearchCondition(entity, search)\n if (searchCondition) where.push(searchCondition)\n }\n\n const filterConditions = buildFilterConditions(entity.name, url, allFields)\n where.push(...filterConditions)\n\n const orderBy = buildOrderBy(entity.name, sort, allFields)\n const select = parseFieldSelection(fields, allFields)\n\n const client = createClient(entity)\n const resolvedLocale = locale ?? defaultLocale\n const queryOpts = {\n where: where.length > 0 ? and(...where) : undefined,\n limit,\n offset,\n orderBy,\n select,\n locale: resolvedLocale,\n defaultLocale,\n cursor,\n }\n\n const [items, total] = await Promise.all([\n client.findMany(queryOpts),\n client.count({ where: where.length > 0 ? and(...where) : undefined }),\n ])\n\n // Build nextCursor from last item for keyset pagination\n let nextCursor: string | undefined\n if (items.length > 0 && items.length === limit) {\n const lastItem = items[items.length - 1] as Record<string, unknown>\n // Derive sort field and direction from cursor or sort param\n const cursorField =\n cursor?.field ?? (sort ? (sort.startsWith('-') ? sort.slice(1) : sort) : undefined)\n const cursorDirection: 'asc' | 'desc' =\n cursor?.direction ?? (sort?.startsWith('-') ? 'desc' : 'asc')\n if (cursorField && lastItem[cursorField] !== undefined) {\n nextCursor = encodeCursor(lastItem, cursorField, cursorDirection)\n }\n }\n\n const headers = {\n ...corsHeaders,\n ...buildCacheHeaders(entity.name, cacheConfig),\n }\n\n return jsonResponse(\n {\n data: items,\n meta: { total, limit, offset, hasMore: offset + limit < total, nextCursor },\n },\n 200,\n headers,\n )\n }\n\n async function handleCount(\n req: Request,\n entity: Entity,\n corsHeaders: Record<string, string>,\n ): Promise<Response> {\n const url = new URL(req.url)\n const params = countParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n if (!params.success) {\n return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n }\n\n const countMode = url.searchParams.get('countMode')\n\n // Fast path: use Postgres row estimate for unfiltered counts\n if (countMode === 'estimate') {\n const app = getApp()\n const count = await estimateRowCount(app.db.readOnly, entity.name)\n return jsonResponse({ data: { count, estimate: true } }, 200, {\n ...corsHeaders,\n ...buildCacheHeaders(entity.name, cacheConfig),\n })\n }\n\n const client = createClient(entity)\n const count = await client.count()\n\n return jsonResponse({ data: { count } }, 200, {\n ...corsHeaders,\n ...buildCacheHeaders(entity.name, cacheConfig),\n })\n }\n\n async function handleById(\n req: Request,\n entity: Entity,\n id: string,\n corsHeaders: Record<string, string>,\n ): Promise<Response> {\n const url = new URL(req.url)\n const params = singleParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n if (!params.success) {\n return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n }\n\n const { locale, fields } = params.data\n const allFields = entity.allFields as Record<string, FieldConfig>\n const select = parseFieldSelection(fields, allFields)\n const resolvedLocale = locale ?? defaultLocale\n\n const client = createClient(entity)\n const item = await client.findById(id, {\n select,\n locale: resolvedLocale,\n defaultLocale,\n })\n if (!item) return notFoundResponse(corsHeaders)\n\n return jsonResponse({ data: item }, 200, {\n ...corsHeaders,\n ...buildCacheHeaders(entity.name, cacheConfig),\n })\n }\n\n async function handleBySlug(\n req: Request,\n entity: Entity,\n slug: string,\n corsHeaders: Record<string, string>,\n ): Promise<Response> {\n const url = new URL(req.url)\n const params = singleParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n if (!params.success) {\n return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n }\n\n // Check entity has a slug field\n const allFields = entity.allFields as Record<string, FieldConfig>\n if (!allFields.slug) return notFoundResponse(corsHeaders)\n\n const { locale, fields } = params.data\n const select = parseFieldSelection(fields, allFields)\n const resolvedLocale = locale ?? defaultLocale\n\n // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n const table = schemaRegistry.get(entity.name) as PgTableWithColumns<any> | undefined\n if (!table?.slug) return notFoundResponse(corsHeaders)\n\n const client = createClient(entity)\n const slugConfig = allFields.slug as SlugField\n\n // For translatable slugs, also search the translation table.\n // A non-default locale's slug may live in {entity}_translations, not the main table.\n let whereClause: SQL = eq(table.slug, slug)\n\n if (slugConfig.translatable && resolvedLocale) {\n const translationTableName = `${entity.name}_translations`\n // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n const translationTable = schemaRegistry.get(translationTableName) as\n | PgTableWithColumns<any>\n | undefined\n if (translationTable?.slug) {\n // Find entity IDs whose translated slug matches (for the requested locale)\n const app = getApp()\n const translationMatches = await app.db.readOnly\n .select({ entityId: translationTable.entityId })\n .from(translationTable)\n .where(and(eq(translationTable.slug, slug), eq(translationTable.locale, resolvedLocale)))\n\n if (translationMatches.length > 0) {\n const translatedIds = translationMatches.map((r) => r.entityId as string)\n // Match by translated slug OR by main table slug (fallback)\n whereClause = or(inArray(table.id, translatedIds), eq(table.slug, slug))!\n }\n }\n }\n\n const results = await client.findMany({\n where: whereClause,\n limit: 1,\n select,\n locale: resolvedLocale,\n defaultLocale,\n })\n\n if (results.length === 0) return notFoundResponse(corsHeaders)\n\n return jsonResponse({ data: results[0] }, 200, {\n ...corsHeaders,\n ...buildCacheHeaders(entity.name, cacheConfig),\n })\n }\n\n // -- Central dispatch -------------------------------------------------------\n\n async function handleGet(req: Request, ctx: RouteContext): Promise<Response> {\n const corsHeaders = buildCorsHeaders(req, corsConfig)\n\n try {\n const segments = await ctx.params.then((p) => p.path)\n if (!segments || segments.length === 0) {\n return notFoundResponse(corsHeaders)\n }\n\n // Resolve role + load permissions + establish request context\n const role = await resolveRole(req)\n const checker = await getChecker()\n\n const requestContext: RequestContext = {\n user: { id: 'public', groups: role ? [role] : [] },\n checker,\n }\n\n return await runWithContextAsync(requestContext, async () => {\n // /_schema — entity introspection (filtered by role)\n if (segments[0] === '_schema') {\n const schema = buildSchemaResponse(entities, (name) =>\n hasViewPermission(checker, role, name),\n )\n return jsonResponse(schema, 200, {\n ...corsHeaders,\n 'Cache-Control': 'no-store',\n })\n }\n\n // Resolve entity from whitelist\n const entityName = segments[0]\n const entity =\n entityMap.get(entityName) ??\n entityMap.get(entityName.endsWith('s') ? entityName.slice(0, -1) : entityName)\n\n // Entity not in whitelist OR role lacks view permission → 404\n if (!entity || !hasViewPermission(checker, role, entity.name)) {\n return notFoundResponse(corsHeaders)\n }\n\n // Route to handler\n if (segments.length === 1) {\n return handleList(req, entity, corsHeaders)\n }\n if (segments[1] === 'count') {\n return handleCount(req, entity, corsHeaders)\n }\n if (segments[1] === 'slug' && segments[2]) {\n return handleBySlug(req, entity, segments[2], corsHeaders)\n }\n if (segments.length === 2) {\n return handleById(req, entity, segments[1], corsHeaders)\n }\n\n return notFoundResponse(corsHeaders)\n }) // end runWithContextAsync\n } catch (err) {\n const message = err instanceof Error ? err.message : 'Internal server error'\n console.error('[content-api] handler error:', err)\n onError?.({\n status: 500,\n message,\n path: new URL(req.url).pathname,\n })\n return errorResponse('Internal server error', 'INTERNAL_ERROR', 500, corsHeaders)\n }\n }\n\n return {\n GET: (req: Request, ctx: RouteContext) => handleGet(req, ctx),\n OPTIONS: (req: Request) => corsPreflightResponse(req, corsConfig),\n }\n}\n"],"mappings":"0dASA,SAAgB,EACd,EACA,EACwB,CACxB,IAAM,EAAe,GAAQ,WAAW,GAExC,GAAI,GAAc,YAAc,GAC9B,MAAO,CAAE,gBAAiB,WAAY,CAGxC,IAAM,EAAS,GAAc,QAAU,GAAQ,eAAiB,GAC1D,EAAM,GAAc,sBAAwB,GAAQ,6BAA+B,IAEzF,MAAO,CACL,gBAAiB,mBAAmB,EAAO,2BAA2B,IACvE,CCfH,SAAgB,EACd,EACA,EACwB,CACxB,GAAI,CAAC,EAAQ,MAAO,EAAE,CAEtB,IAAM,EAAS,EAAI,QAAQ,IAAI,SAAS,CAMxC,MALI,CAAC,GAGD,CAAC,EAAO,eAAe,SAAS,EAAO,CAAS,EAAE,CAE/C,CACL,8BAA+B,EAC/B,+BAAgC,eAChC,+BAAgC,sCAChC,yBAA0B,OAAO,EAAO,QAAU,KAAK,CACvD,KAAM,SACP,CAGH,SAAgB,EAAsB,EAAc,EAA0C,CAC5F,IAAM,EAAU,EAAiB,EAAK,EAAO,CAC7C,OAAO,IAAI,SAAS,KAAM,CAAE,OAAQ,IAAK,UAAS,CAAC,CClBrD,MAAa,EAAmB,EAAE,OAAO,CACvC,MAAO,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAA,IAAc,CAAC,QAAQ,GAAG,CAChE,OAAQ,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CACjD,KAAM,EACH,QAAQ,CACR,MAAM,iBAAiB,CACvB,UAAU,CACb,OAAQ,EAAE,QAAQ,CAAC,MAAM,EAAe,CAAC,UAAU,CACnD,OAAQ,EAAE,QAAQ,CAAC,UAAU,CAC7B,OAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAEtC,OAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CACvC,CAAC,CAGW,EAAqB,EAAE,OAAO,CACzC,OAAQ,EAAE,QAAQ,CAAC,MAAM,EAAe,CAAC,UAAU,CACnD,OAAQ,EAAE,QAAQ,CAAC,UAAU,CAC9B,CAAC,CAGW,EAAoB,EAAE,OAAO,CACxC,OAAQ,EAAE,QAAQ,CAAC,MAAM,EAAe,CAAC,UAAU,CACpD,CAAC,CAKI,EAAU,kEAMhB,SAAgB,EAAoB,EAA0B,EAAsB,CAClF,OAAQ,EAAY,KAApB,CACE,IAAK,UAGH,OAFI,IAAQ,OAAe,GACvB,IAAQ,QAAgB,GACrB,KAET,IAAK,YACL,IAAK,QACH,OAAO,EAAQ,KAAK,EAAI,CAAG,EAAM,KAEnC,IAAK,SACH,OAAO,EAAY,QAAQ,SAAS,EAAI,CAAG,EAAM,KAEnD,IAAK,OAEH,OAAO,EAET,IAAK,OACL,IAAK,SACH,OAAO,EAET,QACE,OAAO,MAQb,SAAgB,EACd,EACA,EACsB,CACtB,GAAI,CAAC,EAAa,OAGlB,IAAM,EADY,EAAY,MAAM,IAAI,CAAC,IAAK,GAAM,EAAE,MAAM,CAAC,CACrC,OACrB,GAAS,KAAQ,GAAa,CAAC,EAAK,WAAW,IAAI,EAAI,EAAU,GAAM,OAAS,SAClF,CAOD,OAJI,EAAM,OAAS,GAAK,CAAC,EAAM,SAAS,KAAK,EAC3C,EAAM,QAAQ,KAAK,CAGd,EAAM,OAAS,EAAI,EAAQ,IAAA,GC3FpC,SAAgB,EACd,EACA,EAAS,IACT,EACU,CACV,OAAO,IAAI,SAAS,KAAK,UAAU,EAAK,CAAE,CACxC,SACA,QAAS,CACP,eAAgB,mBAChB,GAAG,EACJ,CACF,CAAC,CAGJ,SAAgB,EACd,EACA,EACA,EACA,EACU,CACV,OAAO,EAAa,CAAE,MAAO,CAAE,SAAQ,UAAS,OAAM,CAAE,CAAE,EAAQ,EAAa,CAGjF,SAAgB,EAAiB,EAAiD,CAChF,OAAO,EAAc,YAAa,YAAa,IAAK,EAAa,CCZnE,SAAS,EAAc,EAAkC,CACvD,IAAM,EAAqB,CAAE,KAAM,EAAO,KAAM,CAchD,OAZI,EAAO,WACT,EAAM,SAAW,IAGf,EAAO,OAAS,WAClB,EAAM,QAAU,EAAO,SAGrB,EAAO,OAAS,cAClB,EAAM,YAAc,EAAO,aAGtB,EAIT,SAAgB,EAAe,EAA8B,CAC3D,IAAM,EAAY,EAAO,UACnB,EAAsC,EAAE,CAE9C,IAAK,GAAM,CAAC,EAAM,KAAW,OAAO,QAAQ,EAAU,CAEhD,EAAK,WAAW,IAAI,GACxB,EAAO,GAAQ,EAAc,EAAO,EAGtC,MAAO,CACL,KAAM,EAAO,KACb,WAAY,GAAG,EAAO,KAAK,GAC3B,SACD,CAOH,SAAgB,EACd,EACA,EACgB,CAEhB,MAAO,CACL,SAFc,EAAS,OAAQ,GAAM,EAAgB,EAAE,KAAK,CAAC,CAE3C,IAAI,EAAe,CACtC,CCPH,SAAS,EAAe,EAAyC,CAC/D,IAAM,EAAM,IAAI,IAChB,IAAK,IAAM,KAAU,EACnB,EAAI,IAAI,EAAO,KAAM,EAAO,CAC5B,EAAI,IAAI,GAAG,EAAO,KAAK,GAAI,EAAO,CAEpC,OAAO,EAOT,SAAS,EAAqB,EAAgB,EAAiC,CAE7E,IAAM,EAAQ,EAAe,IAAI,EAAO,KAAK,CAC7C,GAAI,CAAC,EAAO,OAEZ,IAAM,EAAY,EAAO,UACzB,IAAK,GAAM,CAAC,EAAW,KAAW,OAAO,QAAQ,EAAU,CACzD,GAAI,EAAO,OAAS,SAAW,EAAO,SAAW,EAAO,UAAW,CACjE,IAAM,EAAS,EAAM,GACrB,GAAI,EAAQ,OAAO,EAAM,EAAQ,IAAI,EAAkB,EAAO,CAAC,GAAG,EAMxE,SAAS,EACP,EACA,EACA,EACiB,CACjB,GAAI,CAAC,EAAW,OAEhB,IAAM,EAAa,EAAU,WAAW,IAAI,CACtC,EAAY,EAAa,EAAU,MAAM,EAAE,CAAG,EAE9C,EAAc,EAAU,GAC9B,GAAI,CAAC,GAAe,EAAY,OAAS,SAAU,OAGnD,IAAM,EAAQ,EAAe,IAAI,EAAW,CACxC,MAAC,GAAS,CAAC,EAAM,IAErB,OAAO,EAAa,EAAK,EAAM,GAAW,CAAG,EAAI,EAAM,GAAW,CAGpE,SAAS,EACP,EACA,EACA,EACO,CAEP,IAAM,EAAQ,EAAe,IAAI,EAAW,CAC5C,GAAI,CAAC,EAAO,MAAO,EAAE,CAErB,IAAM,EAAoB,EAAE,CAE5B,IAAK,GAAM,CAAC,EAAK,KAAQ,EAAI,aAAa,SAAS,CAAE,CACnD,IAAM,EAAQ,EAAI,MAAM,2BAA2B,CACnD,GAAI,CAAC,EAAO,SAEZ,IAAM,EAAY,EAAM,GAClB,EAAc,EAAU,GAC9B,GAAI,CAAC,GAAe,EAAY,OAAS,SAAU,SAEnD,IAAM,EAAS,EAAM,GACrB,GAAI,CAAC,EAAQ,SAGb,GAAI,EAAY,OAAS,OAAQ,CAC3B,EAAI,WAAW,OAAO,CACxB,EAAW,KAAK,EAAI,EAAQ,EAAI,MAAM,EAAE,CAAC,CAAC,CACjC,EAAI,WAAW,OAAO,CAC/B,EAAW,KAAK,EAAI,EAAQ,EAAI,MAAM,EAAE,CAAC,CAAC,CAE1C,EAAW,KAAK,EAAG,EAAQ,EAAI,CAAC,CAElC,SAGF,IAAM,EAAY,EAAoB,EAAa,EAAI,CACnD,IAAc,MAClB,EAAW,KAAK,EAAG,EAAQ,EAAU,CAAC,CAGxC,OAAO,EAOT,SAAgB,EAAwB,EAA0B,CAChE,GAAM,CACJ,WACA,gBACA,aAAa,SACb,KAAM,EACN,MAAO,EACP,WACE,EACE,EAAW,KAAK,IAAI,EAAO,UAAA,IAAA,IAAiC,CAC5D,EAAY,EAAe,EAAS,CAGpC,EAAa,IAAI,EAAW,IAAK,CAInC,EAA8C,KAC9C,EAAsB,EAE1B,eAAe,GAAyC,CACtD,IAAM,EAAM,KAAK,KAAK,CAKtB,OAJI,CAAC,GAAqB,EAAM,EAAsB,OACpD,EAAoB,MAAM,EAAO,iBAAiB,CAClD,EAAsB,GAEjB,EAKT,eAAe,EAAY,EAA+B,CACxD,GAAI,CAAC,EAAO,aAAc,OAAO,EACjC,GAAI,CAEF,OADe,MAAM,EAAO,aAAa,EAAI,GAC9B,MAAQ,OACjB,CACN,OAAO,GAMX,SAAS,EACP,EACA,EACA,EACS,CACT,OAAO,EAAQ,EAAM,EAAY,OAAO,CAK1C,SAAS,EAAa,EAA6B,CACjD,IAAM,EAAM,GAAQ,CACpB,OAAO,IAAI,EAAY,CACrB,SACA,GAAI,EAAI,GAAG,SACX,OAAQ,EAAI,OAAO,MAAM,CAAE,OAAQ,EAAO,KAAM,CAAC,CACjD,aACA,oBAAuB,CACrB,IAAM,EAAM,GAAY,CACpB,MAAC,GAAK,MAAQ,CAAC,GAAK,SACxB,MAAO,CAAE,KAAM,EAAI,KAAM,QAAS,EAAI,QAAS,MAAO,EAAI,MAAO,EAEpE,CAAC,CAKJ,eAAe,EACb,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CACtB,EAAS,EAAiB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CAC/E,GAAI,CAAC,EAAO,QACV,OAAO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAGxF,GAAM,CACJ,MAAO,EACP,SACA,OACA,SACA,SACA,SACA,OAAQ,GACN,EAAO,KACL,EAAQ,KAAK,IAAI,EAAU,EAAS,CACpC,EAAY,EAAO,UAGrB,EACJ,GAAI,EAAa,CACf,IAAM,EAAU,EAAa,EAAY,CACzC,GAAI,CAAC,EACH,OAAO,EAAc,iBAAkB,mBAAoB,IAAK,EAAY,CAG9E,GAAI,EAAE,EAAQ,SAAS,IAAc,EAAQ,QAAU,KACrD,OAAO,EAAc,uBAAwB,mBAAoB,IAAK,EAAY,CAEpF,EAAS,EAGX,IAAM,EAAe,EAAE,CACvB,GAAI,EAAQ,CACV,IAAM,EAAkB,EAAqB,EAAQ,EAAO,CACxD,GAAiB,EAAM,KAAK,EAAgB,CAGlD,IAAM,EAAmB,EAAsB,EAAO,KAAM,EAAK,EAAU,CAC3E,EAAM,KAAK,GAAG,EAAiB,CAE/B,IAAM,EAAU,EAAa,EAAO,KAAM,EAAM,EAAU,CACpD,EAAS,EAAoB,EAAQ,EAAU,CAE/C,EAAS,EAAa,EAAO,CAC7B,EAAiB,GAAU,EAC3B,EAAY,CAChB,MAAO,EAAM,OAAS,EAAI,EAAI,GAAG,EAAM,CAAG,IAAA,GAC1C,QACA,SACA,UACA,SACA,OAAQ,EACR,gBACA,SACD,CAEK,CAAC,EAAO,GAAS,MAAM,QAAQ,IAAI,CACvC,EAAO,SAAS,EAAU,CAC1B,EAAO,MAAM,CAAE,MAAO,EAAM,OAAS,EAAI,EAAI,GAAG,EAAM,CAAG,IAAA,GAAW,CAAC,CACtE,CAAC,CAGE,EACJ,GAAI,EAAM,OAAS,GAAK,EAAM,SAAW,EAAO,CAC9C,IAAM,EAAW,EAAM,EAAM,OAAS,GAEhC,EACJ,GAAQ,QAAU,EAAQ,EAAK,WAAW,IAAI,CAAG,EAAK,MAAM,EAAE,CAAG,EAAQ,IAAA,IACrE,EACJ,GAAQ,YAAc,GAAM,WAAW,IAAI,CAAG,OAAS,OACrD,GAAe,EAAS,KAAiB,IAAA,KAC3C,EAAa,EAAa,EAAU,EAAa,EAAgB,EAIrE,IAAM,EAAU,CACd,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAED,OAAO,EACL,CACE,KAAM,EACN,KAAM,CAAE,QAAO,QAAO,SAAQ,QAAS,EAAS,EAAQ,EAAO,aAAY,CAC5E,CACD,IACA,EACD,CAGH,eAAe,EACb,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CAqB5B,OApBe,EAAkB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CACpE,QAIM,EAAI,aAAa,IAAI,YAAY,GAGjC,WAGT,EAAa,CAAE,KAAM,CAAE,MADhB,MAAM,EADR,GAAQ,CACqB,GAAG,SAAU,EAAO,KAAK,CAC7B,SAAU,GAAM,CAAE,CAAE,IAAK,CAC5D,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CAMG,EAAa,CAAE,KAAM,CAAE,MAFhB,MADC,EAAa,EAAO,CACR,OAAO,CAEG,CAAE,CAAE,IAAK,CAC5C,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CArBO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAwB1F,eAAe,EACb,EACA,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CACtB,EAAS,EAAmB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CACjF,GAAI,CAAC,EAAO,QACV,OAAO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAGxF,GAAM,CAAE,SAAQ,UAAW,EAAO,KAC5B,EAAY,EAAO,UACnB,EAAS,EAAoB,EAAQ,EAAU,CAC/C,EAAiB,GAAU,EAG3B,EAAO,MADE,EAAa,EAAO,CACT,SAAS,EAAI,CACrC,SACA,OAAQ,EACR,gBACD,CAAC,CAGF,OAFK,EAEE,EAAa,CAAE,KAAM,EAAM,CAAE,IAAK,CACvC,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CALgB,EAAiB,EAAY,CAQjD,eAAe,EACb,EACA,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CACtB,EAAS,EAAmB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CACjF,GAAI,CAAC,EAAO,QACV,OAAO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAIxF,IAAM,EAAY,EAAO,UACzB,GAAI,CAAC,EAAU,KAAM,OAAO,EAAiB,EAAY,CAEzD,GAAM,CAAE,SAAQ,UAAW,EAAO,KAC5B,EAAS,EAAoB,EAAQ,EAAU,CAC/C,EAAiB,GAAU,EAG3B,EAAQ,EAAe,IAAI,EAAO,KAAK,CAC7C,GAAI,CAAC,GAAO,KAAM,OAAO,EAAiB,EAAY,CAEtD,IAAM,EAAS,EAAa,EAAO,CAC7B,EAAa,EAAU,KAIzB,EAAmB,EAAG,EAAM,KAAM,EAAK,CAE3C,GAAI,EAAW,cAAgB,EAAgB,CAC7C,IAAM,EAAuB,GAAG,EAAO,KAAK,eAEtC,EAAmB,EAAe,IAAI,EAAqB,CAGjE,GAAI,GAAkB,KAAM,CAG1B,IAAM,EAAqB,MADf,GAAQ,CACiB,GAAG,SACrC,OAAO,CAAE,SAAU,EAAiB,SAAU,CAAC,CAC/C,KAAK,EAAiB,CACtB,MAAM,EAAI,EAAG,EAAiB,KAAM,EAAK,CAAE,EAAG,EAAiB,OAAQ,EAAe,CAAC,CAAC,CAE3F,GAAI,EAAmB,OAAS,EAAG,CACjC,IAAM,EAAgB,EAAmB,IAAK,GAAM,EAAE,SAAmB,CAEzE,EAAc,EAAG,EAAQ,EAAM,GAAI,EAAc,CAAE,EAAG,EAAM,KAAM,EAAK,CAAC,GAK9E,IAAM,EAAU,MAAM,EAAO,SAAS,CACpC,MAAO,EACP,MAAO,EACP,SACA,OAAQ,EACR,gBACD,CAAC,CAIF,OAFI,EAAQ,SAAW,EAAU,EAAiB,EAAY,CAEvD,EAAa,CAAE,KAAM,EAAQ,GAAI,CAAE,IAAK,CAC7C,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CAKJ,eAAe,EAAU,EAAc,EAAsC,CAC3E,IAAM,EAAc,EAAiB,EAAK,EAAW,CAErD,GAAI,CACF,IAAM,EAAW,MAAM,EAAI,OAAO,KAAM,GAAM,EAAE,KAAK,CACrD,GAAI,CAAC,GAAY,EAAS,SAAW,EACnC,OAAO,EAAiB,EAAY,CAItC,IAAM,EAAO,MAAM,EAAY,EAAI,CAC7B,EAAU,MAAM,GAAY,CAOlC,OAAO,MAAM,EAL0B,CACrC,KAAM,CAAE,GAAI,SAAU,OAAQ,EAAO,CAAC,EAAK,CAAG,EAAE,CAAE,CAClD,UACD,CAEgD,SAAY,CAE7D,GAAI,EAAS,KAAO,UAIlB,OAAO,EAHQ,EAAoB,EAAW,GAC5C,EAAkB,EAAS,EAAM,EAAK,CACvC,CAC2B,IAAK,CAC/B,GAAG,EACH,gBAAiB,WAClB,CAAC,CAIJ,IAAM,EAAa,EAAS,GACtB,EACJ,EAAU,IAAI,EAAW,EACzB,EAAU,IAAI,EAAW,SAAS,IAAI,CAAG,EAAW,MAAM,EAAG,GAAG,CAAG,EAAW,CAqBhF,MAlBI,CAAC,GAAU,CAAC,EAAkB,EAAS,EAAM,EAAO,KAAK,CACpD,EAAiB,EAAY,CAIlC,EAAS,SAAW,EACf,EAAW,EAAK,EAAQ,EAAY,CAEzC,EAAS,KAAO,QACX,EAAY,EAAK,EAAQ,EAAY,CAE1C,EAAS,KAAO,QAAU,EAAS,GAC9B,EAAa,EAAK,EAAQ,EAAS,GAAI,EAAY,CAExD,EAAS,SAAW,EACf,EAAW,EAAK,EAAQ,EAAS,GAAI,EAAY,CAGnD,EAAiB,EAAY,EAClC,OACK,EAAK,CACZ,IAAM,EAAU,aAAe,MAAQ,EAAI,QAAU,wBAOrD,OANA,QAAQ,MAAM,+BAAgC,EAAI,CAClD,IAAU,CACR,OAAQ,IACR,UACA,KAAM,IAAI,IAAI,EAAI,IAAI,CAAC,SACxB,CAAC,CACK,EAAc,wBAAyB,iBAAkB,IAAK,EAAY,EAIrF,MAAO,CACL,KAAM,EAAc,IAAsB,EAAU,EAAK,EAAI,CAC7D,QAAU,GAAiB,EAAsB,EAAK,EAAW,CAClE"}
1
+ {"version":3,"file":"index.mjs","names":[],"sources":["../src/cache.ts","../src/cors.ts","../src/query-params.ts","../src/response.ts","../src/schema-endpoint.ts","../src/handler.ts"],"sourcesContent":["/**\n * Cache-Control header builder.\n *\n * Defaults: public, max-age=60, stale-while-revalidate=300.\n * Per-entity overrides for hot content (low TTL) vs static pages (high TTL).\n */\n\nimport type { CacheConfig } from './types.js'\n\nexport function buildCacheHeaders(\n entityName: string,\n config: CacheConfig | undefined,\n): Record<string, string> {\n const entityConfig = config?.entities?.[entityName]\n\n if (entityConfig?.cacheable === false) {\n return { 'Cache-Control': 'no-store' }\n }\n\n const maxAge = entityConfig?.maxAge ?? config?.defaultMaxAge ?? 60\n const swr = entityConfig?.staleWhileRevalidate ?? config?.defaultStaleWhileRevalidate ?? 300\n\n return {\n 'Cache-Control': `public, max-age=${maxAge}, stale-while-revalidate=${swr}`,\n }\n}\n","/**\n * CORS — Origin allowlist with exact match.\n *\n * No wildcards, no regex. This is a CMS content API — you know which\n * frontends consume it. Vary: Origin ensures CDNs cache per-origin.\n */\n\nimport type { CorsConfig } from './types.js'\n\nexport function buildCorsHeaders(\n req: Request,\n config: CorsConfig | undefined,\n): Record<string, string> {\n if (!config) return {}\n\n const origin = req.headers.get('Origin')\n if (!origin) return {}\n\n // Exact match only\n if (!config.allowedOrigins.includes(origin)) return {}\n\n return {\n 'Access-Control-Allow-Origin': origin,\n 'Access-Control-Allow-Methods': 'GET, OPTIONS',\n 'Access-Control-Allow-Headers': 'Content-Type, Accept, Authorization',\n 'Access-Control-Max-Age': String(config.maxAge ?? 3600),\n Vary: 'Origin',\n }\n}\n\nexport function corsPreflightResponse(req: Request, config: CorsConfig | undefined): Response {\n const headers = buildCorsHeaders(req, config)\n return new Response(null, { status: 204, headers })\n}\n","/**\n * Query parameter validation — Zod schemas for all content API endpoints.\n *\n * All user input is validated before it touches QueryClient.\n * Pagination hard-capped at MAX_LIMIT. Sort/filter restricted to queryable columns.\n */\n\nimport { escapeLikePattern, LOCALE_PATTERN } from '@murumets-ee/core'\nimport type { FieldConfig } from '@murumets-ee/entity'\nimport { z } from 'zod'\n\nexport const MAX_LIMIT = 100\n\n/** List endpoint query params. */\nexport const listParamsSchema = z.object({\n limit: z.coerce.number().int().min(1).max(MAX_LIMIT).default(20),\n offset: z.coerce.number().int().min(0).default(0),\n sort: z\n .string()\n .regex(/^-?[a-zA-Z_]+$/)\n .optional(),\n locale: z.string().regex(LOCALE_PATTERN).optional(),\n fields: z.string().optional(),\n search: z.string().max(200).optional(),\n /** Opaque cursor for keyset pagination (base64-encoded JSON). */\n cursor: z.string().max(500).optional(),\n})\n\n/** Single entity query params. */\nexport const singleParamsSchema = z.object({\n locale: z.string().regex(LOCALE_PATTERN).optional(),\n fields: z.string().optional(),\n})\n\n/** Count endpoint query params. */\nexport const countParamsSchema = z.object({\n locale: z.string().regex(LOCALE_PATTERN).optional(),\n})\n\n// Re-export from core so existing imports from this module continue to work\nexport { escapeLikePattern }\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\n/**\n * Validate a filter value against the field type.\n * Returns the validated value or null if invalid.\n */\nexport function validateFilterValue(fieldConfig: FieldConfig, raw: string): unknown {\n switch (fieldConfig.type) {\n case 'boolean':\n if (raw === 'true') return true\n if (raw === 'false') return false\n return null\n\n case 'reference':\n case 'media':\n return UUID_RE.test(raw) ? raw : null\n\n case 'select':\n return fieldConfig.options.includes(raw) ? raw : null\n\n case 'date':\n // Plain date or gte:/lte: prefix handled by caller\n return raw\n\n case 'text':\n case 'number':\n return raw\n\n default:\n return null\n }\n}\n\n/**\n * Parse field selection string into validated field names.\n * Unknown/internal field names are silently dropped (no info leakage).\n */\nexport function parseFieldSelection(\n fieldsParam: string | undefined,\n allFields: Record<string, FieldConfig>,\n): string[] | undefined {\n if (!fieldsParam) return undefined\n\n const requested = fieldsParam.split(',').map((f) => f.trim())\n const valid = requested.filter((name) => {\n const config = allFields[name]\n return config !== undefined && !name.startsWith('_') && config.type !== 'blocks'\n })\n\n // Always include id\n if (valid.length > 0 && !valid.includes('id')) {\n valid.unshift('id')\n }\n\n return valid.length > 0 ? valid : undefined\n}\n","/**\n * Response helpers — JSON envelope builders.\n */\n\nexport function jsonResponse(\n data: unknown,\n status = 200,\n extraHeaders?: Record<string, string>,\n): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: {\n 'Content-Type': 'application/json',\n ...extraHeaders,\n },\n })\n}\n\nexport function errorResponse(\n message: string,\n code: string,\n status: number,\n extraHeaders?: Record<string, string>,\n): Response {\n return jsonResponse({ error: { status, message, code } }, status, extraHeaders)\n}\n\nexport function notFoundResponse(extraHeaders?: Record<string, string>): Response {\n return errorResponse('Not found', 'NOT_FOUND', 404, extraHeaders)\n}\n","/**\n * Schema introspection endpoint — GET /_schema\n *\n * Returns public-safe entity metadata for SDK generation.\n * Only exposes: type, required, options (select), cardinality (reference).\n * Internal fields (_version, _scopeId) excluded.\n * No hooks, behaviors, access rules, or implementation details.\n *\n * Response is filtered by the caller's role permissions — only entities\n * the role can 'view' are included.\n */\n\nimport type { Entity, FieldConfig } from '@murumets-ee/entity'\nimport type { SchemaEntity, SchemaField, SchemaResponse } from './types.js'\n\n/** Convert a FieldConfig to the public-safe SchemaField subset. */\nfunction toSchemaField(config: FieldConfig): SchemaField {\n const field: SchemaField = { type: config.type }\n\n if (config.required) {\n field.required = true\n }\n\n if (config.type === 'select') {\n field.options = config.options\n }\n\n if (config.type === 'reference') {\n field.cardinality = config.cardinality\n }\n\n return field\n}\n\n/** Convert an Entity to public-safe schema metadata. */\nexport function toSchemaEntity(entity: Entity): SchemaEntity {\n const allFields = entity.allFields as Record<string, FieldConfig>\n const fields: Record<string, SchemaField> = {}\n\n for (const [name, config] of Object.entries(allFields)) {\n // Skip internal fields\n if (name.startsWith('_')) continue\n fields[name] = toSchemaField(config)\n }\n\n return {\n name: entity.name,\n pluralName: `${entity.name}s`,\n fields,\n }\n}\n\n/**\n * Build the full /_schema response.\n * Only includes entities that pass the permission check.\n */\nexport function buildSchemaResponse(\n entities: Entity[],\n checkPermission: (entityName: string) => boolean,\n): SchemaResponse {\n const visible = entities.filter((e) => checkPermission(e.name))\n return {\n entities: visible.map(toSchemaEntity),\n }\n}\n","/**\n * Content API handler factory\n *\n * Creates a read-only catch-all route handler for public content delivery.\n * Mirrors the `createAdminApiHandler` pattern but with:\n * - No mutations (GET + OPTIONS only)\n * - Permission-gated (public role starts with 0 permissions)\n * - Published content only (QueryClient auto-filters)\n * - CORS + Cache-Control headers\n *\n * @example\n * ```typescript\n * // app/api/content/[...path]/route.ts\n * import { createContentApiHandler } from '@murumets-ee/content-api'\n * import { Article, Page } from '@/entities'\n *\n * const handler = createContentApiHandler({\n * entities: [Article, Page],\n * loadPermissions: async () => {\n * const roles = await loadRoles(getApp())\n * return buildPermissionChecker(roles)\n * },\n * cors: { allowedOrigins: ['https://www.example.com'] },\n * })\n *\n * export const { GET, OPTIONS } = handler\n * ```\n */\n\nimport type { PermissionChecker, RequestContext } from '@murumets-ee/core'\nimport { getApp, getContext, runWithContextAsync } from '@murumets-ee/core'\nimport { schemaRegistry } from '@murumets-ee/db'\nimport type { CursorInput, Entity, FieldConfig, SlugField } from '@murumets-ee/entity'\nimport { CountCache, decodeCursor, encodeCursor, estimateRowCount } from '@murumets-ee/entity'\nimport { QueryClient } from '@murumets-ee/entity/query'\nimport { and, asc, desc, eq, gte, ilike, inArray, lte, or, type SQL } from 'drizzle-orm'\nimport type { PgTableWithColumns } from 'drizzle-orm/pg-core'\nimport { buildCacheHeaders } from './cache.js'\nimport { buildCorsHeaders, corsPreflightResponse } from './cors.js'\nimport {\n countParamsSchema,\n escapeLikePattern,\n listParamsSchema,\n MAX_LIMIT,\n parseFieldSelection,\n singleParamsSchema,\n validateFilterValue,\n} from './query-params.js'\nimport { errorResponse, jsonResponse, notFoundResponse } from './response.js'\nimport { buildSchemaResponse } from './schema-endpoint.js'\nimport type { ContentApiConfig, RouteContext } from './types.js'\n\n// ---------------------------------------------------------------------------\n// Entity resolution (whitelist-based, same pattern as admin handler)\n// ---------------------------------------------------------------------------\n\nfunction buildEntityMap(entities: Entity[]): Map<string, Entity> {\n const map = new Map<string, Entity>()\n for (const entity of entities) {\n map.set(entity.name, entity)\n map.set(`${entity.name}s`, entity)\n }\n return map\n}\n\n// ---------------------------------------------------------------------------\n// Query helpers\n// ---------------------------------------------------------------------------\n\nfunction buildSearchCondition(entity: Entity, search: string): SQL | undefined {\n // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n const table = schemaRegistry.get(entity.name) as PgTableWithColumns<any> | undefined\n if (!table) return undefined\n\n const allFields = entity.allFields as Record<string, FieldConfig>\n for (const [fieldName, config] of Object.entries(allFields)) {\n if (config.type === 'text' && (config.indexed || config.required)) {\n const column = table[fieldName]\n if (column) return ilike(column, `%${escapeLikePattern(search)}%`)\n }\n }\n return undefined\n}\n\nfunction buildOrderBy(\n entityName: string,\n sortParam: string | undefined,\n allFields: Record<string, FieldConfig>,\n): SQL | undefined {\n if (!sortParam) return undefined\n\n const descending = sortParam.startsWith('-')\n const fieldName = descending ? sortParam.slice(1) : sortParam\n\n const fieldConfig = allFields[fieldName]\n if (!fieldConfig || fieldConfig.type === 'blocks') return undefined\n\n // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n const table = schemaRegistry.get(entityName) as PgTableWithColumns<any> | undefined\n if (!table || !table[fieldName]) return undefined\n\n return descending ? desc(table[fieldName]) : asc(table[fieldName])\n}\n\nfunction buildFilterConditions(\n entityName: string,\n url: URL,\n allFields: Record<string, FieldConfig>,\n): SQL[] {\n // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n const table = schemaRegistry.get(entityName) as PgTableWithColumns<any> | undefined\n if (!table) return []\n\n const conditions: SQL[] = []\n\n for (const [key, raw] of url.searchParams.entries()) {\n const match = key.match(/^filter\\[([a-zA-Z_]+)\\]$/)\n if (!match) continue\n\n const fieldName = match[1]\n if (fieldName === undefined) continue\n const fieldConfig = allFields[fieldName]\n if (!fieldConfig || fieldConfig.type === 'blocks') continue\n\n const column = table[fieldName]\n if (!column) continue\n\n // Date range filters: gte: / lte: prefix\n if (fieldConfig.type === 'date') {\n if (raw.startsWith('gte:')) {\n conditions.push(gte(column, raw.slice(4)))\n } else if (raw.startsWith('lte:')) {\n conditions.push(lte(column, raw.slice(4)))\n } else {\n conditions.push(eq(column, raw))\n }\n continue\n }\n\n const validated = validateFilterValue(fieldConfig, raw)\n if (validated === null) continue\n conditions.push(eq(column, validated))\n }\n\n return conditions\n}\n\n// ---------------------------------------------------------------------------\n// Handler factory\n// ---------------------------------------------------------------------------\n\nexport function createContentApiHandler(config: ContentApiConfig) {\n const {\n entities,\n defaultLocale,\n publicRole = 'public',\n cors: corsConfig,\n cache: cacheConfig,\n onError,\n } = config\n const maxLimit = Math.min(config.maxLimit ?? MAX_LIMIT, MAX_LIMIT)\n const entityMap = buildEntityMap(entities)\n\n // Shared count cache — reduces COUNT(*) queries on paginated list pages.\n const countCache = new CountCache(5000)\n\n // Lazy-loaded permission checker — cached with 30s TTL\n const PERMISSION_CACHE_TTL_MS = 30_000\n let permissionChecker: PermissionChecker | null = null\n let permissionCacheTime = 0\n\n async function getChecker(): Promise<PermissionChecker> {\n const now = Date.now()\n if (!permissionChecker || now - permissionCacheTime > PERMISSION_CACHE_TTL_MS) {\n permissionChecker = await config.loadPermissions()\n permissionCacheTime = now\n }\n return permissionChecker\n }\n\n // -- Role resolution -------------------------------------------------------\n\n async function resolveRole(req: Request): Promise<string> {\n if (!config.authenticate) return publicRole\n try {\n const result = await config.authenticate(req)\n return result?.role ?? publicRole\n } catch {\n return publicRole\n }\n }\n\n // -- Permission check (returns 404 on deny to avoid info leakage) ----------\n\n function hasViewPermission(\n checker: PermissionChecker,\n role: string,\n entityName: string,\n ): boolean {\n return checker(role, entityName, 'view')\n }\n\n // -- Create QueryClient from entity ----------------------------------------\n\n function createClient(entity: Entity): QueryClient {\n const app = getApp()\n return new QueryClient({\n entity,\n db: app.db.readOnly,\n logger: app.logger.child({ entity: entity.name }),\n countCache,\n contextResolver: () => {\n const ctx = getContext()\n if (!ctx?.user || !ctx?.checker) return undefined\n return { user: ctx.user, checker: ctx.checker, scope: ctx.scope }\n },\n })\n }\n\n // -- Endpoint handlers -----------------------------------------------------\n\n async function handleList(\n req: Request,\n entity: Entity,\n corsHeaders: Record<string, string>,\n ): Promise<Response> {\n const url = new URL(req.url)\n const params = listParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n if (!params.success) {\n return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n }\n\n const {\n limit: rawLimit,\n offset,\n sort,\n locale,\n fields,\n search,\n cursor: cursorParam,\n } = params.data\n const limit = Math.min(rawLimit, maxLimit)\n const allFields = entity.allFields as Record<string, FieldConfig>\n\n // Cursor-based pagination (opt-in, replaces OFFSET when provided)\n let cursor: CursorInput | undefined\n if (cursorParam) {\n const decoded = decodeCursor(cursorParam)\n if (!decoded) {\n return errorResponse('Invalid cursor', 'VALIDATION_ERROR', 400, corsHeaders)\n }\n // Whitelist: cursor field must be a real field on the entity\n if (!(decoded.field in allFields) && decoded.field !== 'id') {\n return errorResponse('Invalid cursor field', 'VALIDATION_ERROR', 400, corsHeaders)\n }\n cursor = decoded\n }\n\n const where: SQL[] = []\n if (search) {\n const searchCondition = buildSearchCondition(entity, search)\n if (searchCondition) where.push(searchCondition)\n }\n\n const filterConditions = buildFilterConditions(entity.name, url, allFields)\n where.push(...filterConditions)\n\n const orderBy = buildOrderBy(entity.name, sort, allFields)\n const select = parseFieldSelection(fields, allFields)\n\n const client = createClient(entity)\n const resolvedLocale = locale ?? defaultLocale\n const queryOpts = {\n where: where.length > 0 ? and(...where) : undefined,\n limit,\n offset,\n orderBy,\n select,\n locale: resolvedLocale,\n defaultLocale,\n cursor,\n }\n\n const [items, total] = await Promise.all([\n client.findMany(queryOpts),\n client.count({ where: where.length > 0 ? and(...where) : undefined }),\n ])\n\n // Build nextCursor from last item for keyset pagination\n let nextCursor: string | undefined\n if (items.length > 0 && items.length === limit) {\n const lastItem = items[items.length - 1] as Record<string, unknown>\n // Derive sort field and direction from cursor or sort param\n const cursorField =\n cursor?.field ?? (sort ? (sort.startsWith('-') ? sort.slice(1) : sort) : undefined)\n const cursorDirection: 'asc' | 'desc' =\n cursor?.direction ?? (sort?.startsWith('-') ? 'desc' : 'asc')\n if (cursorField && lastItem[cursorField] !== undefined) {\n nextCursor = encodeCursor(lastItem, cursorField, cursorDirection)\n }\n }\n\n const headers = {\n ...corsHeaders,\n ...buildCacheHeaders(entity.name, cacheConfig),\n }\n\n return jsonResponse(\n {\n data: items,\n meta: { total, limit, offset, hasMore: offset + limit < total, nextCursor },\n },\n 200,\n headers,\n )\n }\n\n async function handleCount(\n req: Request,\n entity: Entity,\n corsHeaders: Record<string, string>,\n ): Promise<Response> {\n const url = new URL(req.url)\n const params = countParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n if (!params.success) {\n return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n }\n\n const countMode = url.searchParams.get('countMode')\n\n // Fast path: use Postgres row estimate for unfiltered counts\n if (countMode === 'estimate') {\n const app = getApp()\n const count = await estimateRowCount(app.db.readOnly, entity.name)\n return jsonResponse({ data: { count, estimate: true } }, 200, {\n ...corsHeaders,\n ...buildCacheHeaders(entity.name, cacheConfig),\n })\n }\n\n const client = createClient(entity)\n const count = await client.count()\n\n return jsonResponse({ data: { count } }, 200, {\n ...corsHeaders,\n ...buildCacheHeaders(entity.name, cacheConfig),\n })\n }\n\n async function handleById(\n req: Request,\n entity: Entity,\n id: string,\n corsHeaders: Record<string, string>,\n ): Promise<Response> {\n const url = new URL(req.url)\n const params = singleParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n if (!params.success) {\n return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n }\n\n const { locale, fields } = params.data\n const allFields = entity.allFields as Record<string, FieldConfig>\n const select = parseFieldSelection(fields, allFields)\n const resolvedLocale = locale ?? defaultLocale\n\n const client = createClient(entity)\n const item = await client.findById(id, {\n select,\n locale: resolvedLocale,\n defaultLocale,\n })\n if (!item) return notFoundResponse(corsHeaders)\n\n return jsonResponse({ data: item }, 200, {\n ...corsHeaders,\n ...buildCacheHeaders(entity.name, cacheConfig),\n })\n }\n\n async function handleBySlug(\n req: Request,\n entity: Entity,\n slug: string,\n corsHeaders: Record<string, string>,\n ): Promise<Response> {\n const url = new URL(req.url)\n const params = singleParamsSchema.safeParse(Object.fromEntries(url.searchParams))\n if (!params.success) {\n return errorResponse('Invalid query parameters', 'VALIDATION_ERROR', 400, corsHeaders)\n }\n\n // Check entity has a slug field\n const allFields = entity.allFields as Record<string, FieldConfig>\n if (!allFields.slug) return notFoundResponse(corsHeaders)\n\n const { locale, fields } = params.data\n const select = parseFieldSelection(fields, allFields)\n const resolvedLocale = locale ?? defaultLocale\n\n // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n const table = schemaRegistry.get(entity.name) as PgTableWithColumns<any> | undefined\n if (!table?.slug) return notFoundResponse(corsHeaders)\n\n const client = createClient(entity)\n const slugConfig = allFields.slug as SlugField\n\n // For translatable slugs, also search the translation table.\n // A non-default locale's slug may live in {entity}_translations, not the main table.\n let whereClause: SQL = eq(table.slug, slug)\n\n if (slugConfig.translatable && resolvedLocale) {\n const translationTableName = `${entity.name}_translations`\n // biome-ignore lint/suspicious/noExplicitAny: dynamic table columns require PgTableWithColumns<any>\n const translationTable = schemaRegistry.get(translationTableName) as\n | PgTableWithColumns<any>\n | undefined\n if (translationTable?.slug) {\n // Find entity IDs whose translated slug matches (for the requested locale)\n const app = getApp()\n const translationMatches = await app.db.readOnly\n .select({ entityId: translationTable.entityId })\n .from(translationTable)\n .where(and(eq(translationTable.slug, slug), eq(translationTable.locale, resolvedLocale)))\n\n if (translationMatches.length > 0) {\n const translatedIds = translationMatches.map((r) => r.entityId as string)\n // Match by translated slug OR by main table slug (fallback)\n whereClause = or(inArray(table.id, translatedIds), eq(table.slug, slug))!\n }\n }\n }\n\n const results = await client.findMany({\n where: whereClause,\n limit: 1,\n select,\n locale: resolvedLocale,\n defaultLocale,\n })\n\n if (results.length === 0) return notFoundResponse(corsHeaders)\n\n return jsonResponse({ data: results[0] }, 200, {\n ...corsHeaders,\n ...buildCacheHeaders(entity.name, cacheConfig),\n })\n }\n\n // -- Central dispatch -------------------------------------------------------\n\n async function handleGet(req: Request, ctx: RouteContext): Promise<Response> {\n const corsHeaders = buildCorsHeaders(req, corsConfig)\n\n try {\n const segments = await ctx.params.then((p) => p.path)\n if (!segments || segments.length === 0) {\n return notFoundResponse(corsHeaders)\n }\n\n // Resolve role + load permissions + establish request context\n const role = await resolveRole(req)\n const checker = await getChecker()\n\n const requestContext: RequestContext = {\n user: { id: 'public', groups: role ? [role] : [] },\n checker,\n }\n\n return await runWithContextAsync(requestContext, async () => {\n // /_schema — entity introspection (filtered by role)\n if (segments[0] === '_schema') {\n const schema = buildSchemaResponse(entities, (name) =>\n hasViewPermission(checker, role, name),\n )\n return jsonResponse(schema, 200, {\n ...corsHeaders,\n 'Cache-Control': 'no-store',\n })\n }\n\n // Resolve entity from whitelist\n const entityName = segments[0]\n if (entityName === undefined) return notFoundResponse(corsHeaders)\n const entity =\n entityMap.get(entityName) ??\n entityMap.get(entityName.endsWith('s') ? entityName.slice(0, -1) : entityName)\n\n // Entity not in whitelist OR role lacks view permission → 404\n if (!entity || !hasViewPermission(checker, role, entity.name)) {\n return notFoundResponse(corsHeaders)\n }\n\n // Route to handler\n if (segments.length === 1) {\n return handleList(req, entity, corsHeaders)\n }\n if (segments[1] === 'count') {\n return handleCount(req, entity, corsHeaders)\n }\n if (segments[1] === 'slug' && segments[2]) {\n return handleBySlug(req, entity, segments[2], corsHeaders)\n }\n if (segments.length === 2 && segments[1] !== undefined) {\n return handleById(req, entity, segments[1], corsHeaders)\n }\n\n return notFoundResponse(corsHeaders)\n }) // end runWithContextAsync\n } catch (err) {\n const message = err instanceof Error ? err.message : 'Internal server error'\n console.error('[content-api] handler error:', err)\n onError?.({\n status: 500,\n message,\n path: new URL(req.url).pathname,\n })\n return errorResponse('Internal server error', 'INTERNAL_ERROR', 500, corsHeaders)\n }\n }\n\n return {\n GET: (req: Request, ctx: RouteContext) => handleGet(req, ctx),\n OPTIONS: (req: Request) => corsPreflightResponse(req, corsConfig),\n }\n}\n"],"mappings":"0dASA,SAAgB,EACd,EACA,EACwB,CACxB,IAAM,EAAe,GAAQ,WAAW,GAExC,GAAI,GAAc,YAAc,GAC9B,MAAO,CAAE,gBAAiB,WAAY,CAGxC,IAAM,EAAS,GAAc,QAAU,GAAQ,eAAiB,GAC1D,EAAM,GAAc,sBAAwB,GAAQ,6BAA+B,IAEzF,MAAO,CACL,gBAAiB,mBAAmB,EAAO,2BAA2B,IACvE,CCfH,SAAgB,EACd,EACA,EACwB,CACxB,GAAI,CAAC,EAAQ,MAAO,EAAE,CAEtB,IAAM,EAAS,EAAI,QAAQ,IAAI,SAAS,CAMxC,MALI,CAAC,GAGD,CAAC,EAAO,eAAe,SAAS,EAAO,CAAS,EAAE,CAE/C,CACL,8BAA+B,EAC/B,+BAAgC,eAChC,+BAAgC,sCAChC,yBAA0B,OAAO,EAAO,QAAU,KAAK,CACvD,KAAM,SACP,CAGH,SAAgB,EAAsB,EAAc,EAA0C,CAC5F,IAAM,EAAU,EAAiB,EAAK,EAAO,CAC7C,OAAO,IAAI,SAAS,KAAM,CAAE,OAAQ,IAAK,UAAS,CAAC,CClBrD,MAAa,EAAmB,EAAE,OAAO,CACvC,MAAO,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAA,IAAc,CAAC,QAAQ,GAAG,CAChE,OAAQ,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CACjD,KAAM,EACH,QAAQ,CACR,MAAM,iBAAiB,CACvB,UAAU,CACb,OAAQ,EAAE,QAAQ,CAAC,MAAM,EAAe,CAAC,UAAU,CACnD,OAAQ,EAAE,QAAQ,CAAC,UAAU,CAC7B,OAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CAEtC,OAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,UAAU,CACvC,CAAC,CAGW,EAAqB,EAAE,OAAO,CACzC,OAAQ,EAAE,QAAQ,CAAC,MAAM,EAAe,CAAC,UAAU,CACnD,OAAQ,EAAE,QAAQ,CAAC,UAAU,CAC9B,CAAC,CAGW,EAAoB,EAAE,OAAO,CACxC,OAAQ,EAAE,QAAQ,CAAC,MAAM,EAAe,CAAC,UAAU,CACpD,CAAC,CAKI,EAAU,kEAMhB,SAAgB,EAAoB,EAA0B,EAAsB,CAClF,OAAQ,EAAY,KAApB,CACE,IAAK,UAGH,OAFI,IAAQ,OAAe,GACvB,IAAQ,QAAgB,GACrB,KAET,IAAK,YACL,IAAK,QACH,OAAO,EAAQ,KAAK,EAAI,CAAG,EAAM,KAEnC,IAAK,SACH,OAAO,EAAY,QAAQ,SAAS,EAAI,CAAG,EAAM,KAEnD,IAAK,OAEH,OAAO,EAET,IAAK,OACL,IAAK,SACH,OAAO,EAET,QACE,OAAO,MAQb,SAAgB,EACd,EACA,EACsB,CACtB,GAAI,CAAC,EAAa,OAGlB,IAAM,EADY,EAAY,MAAM,IAAI,CAAC,IAAK,GAAM,EAAE,MAAM,CAAC,CACrC,OAAQ,GAAS,CACvC,IAAM,EAAS,EAAU,GACzB,OAAO,IAAW,IAAA,IAAa,CAAC,EAAK,WAAW,IAAI,EAAI,EAAO,OAAS,UACxE,CAOF,OAJI,EAAM,OAAS,GAAK,CAAC,EAAM,SAAS,KAAK,EAC3C,EAAM,QAAQ,KAAK,CAGd,EAAM,OAAS,EAAI,EAAQ,IAAA,GC5FpC,SAAgB,EACd,EACA,EAAS,IACT,EACU,CACV,OAAO,IAAI,SAAS,KAAK,UAAU,EAAK,CAAE,CACxC,SACA,QAAS,CACP,eAAgB,mBAChB,GAAG,EACJ,CACF,CAAC,CAGJ,SAAgB,EACd,EACA,EACA,EACA,EACU,CACV,OAAO,EAAa,CAAE,MAAO,CAAE,SAAQ,UAAS,OAAM,CAAE,CAAE,EAAQ,EAAa,CAGjF,SAAgB,EAAiB,EAAiD,CAChF,OAAO,EAAc,YAAa,YAAa,IAAK,EAAa,CCZnE,SAAS,EAAc,EAAkC,CACvD,IAAM,EAAqB,CAAE,KAAM,EAAO,KAAM,CAchD,OAZI,EAAO,WACT,EAAM,SAAW,IAGf,EAAO,OAAS,WAClB,EAAM,QAAU,EAAO,SAGrB,EAAO,OAAS,cAClB,EAAM,YAAc,EAAO,aAGtB,EAIT,SAAgB,EAAe,EAA8B,CAC3D,IAAM,EAAY,EAAO,UACnB,EAAsC,EAAE,CAE9C,IAAK,GAAM,CAAC,EAAM,KAAW,OAAO,QAAQ,EAAU,CAEhD,EAAK,WAAW,IAAI,GACxB,EAAO,GAAQ,EAAc,EAAO,EAGtC,MAAO,CACL,KAAM,EAAO,KACb,WAAY,GAAG,EAAO,KAAK,GAC3B,SACD,CAOH,SAAgB,EACd,EACA,EACgB,CAEhB,MAAO,CACL,SAFc,EAAS,OAAQ,GAAM,EAAgB,EAAE,KAAK,CAAC,CAE3C,IAAI,EAAe,CACtC,CCPH,SAAS,EAAe,EAAyC,CAC/D,IAAM,EAAM,IAAI,IAChB,IAAK,IAAM,KAAU,EACnB,EAAI,IAAI,EAAO,KAAM,EAAO,CAC5B,EAAI,IAAI,GAAG,EAAO,KAAK,GAAI,EAAO,CAEpC,OAAO,EAOT,SAAS,EAAqB,EAAgB,EAAiC,CAE7E,IAAM,EAAQ,EAAe,IAAI,EAAO,KAAK,CAC7C,GAAI,CAAC,EAAO,OAEZ,IAAM,EAAY,EAAO,UACzB,IAAK,GAAM,CAAC,EAAW,KAAW,OAAO,QAAQ,EAAU,CACzD,GAAI,EAAO,OAAS,SAAW,EAAO,SAAW,EAAO,UAAW,CACjE,IAAM,EAAS,EAAM,GACrB,GAAI,EAAQ,OAAO,EAAM,EAAQ,IAAI,EAAkB,EAAO,CAAC,GAAG,EAMxE,SAAS,EACP,EACA,EACA,EACiB,CACjB,GAAI,CAAC,EAAW,OAEhB,IAAM,EAAa,EAAU,WAAW,IAAI,CACtC,EAAY,EAAa,EAAU,MAAM,EAAE,CAAG,EAE9C,EAAc,EAAU,GAC9B,GAAI,CAAC,GAAe,EAAY,OAAS,SAAU,OAGnD,IAAM,EAAQ,EAAe,IAAI,EAAW,CACxC,MAAC,GAAS,CAAC,EAAM,IAErB,OAAO,EAAa,EAAK,EAAM,GAAW,CAAG,EAAI,EAAM,GAAW,CAGpE,SAAS,EACP,EACA,EACA,EACO,CAEP,IAAM,EAAQ,EAAe,IAAI,EAAW,CAC5C,GAAI,CAAC,EAAO,MAAO,EAAE,CAErB,IAAM,EAAoB,EAAE,CAE5B,IAAK,GAAM,CAAC,EAAK,KAAQ,EAAI,aAAa,SAAS,CAAE,CACnD,IAAM,EAAQ,EAAI,MAAM,2BAA2B,CACnD,GAAI,CAAC,EAAO,SAEZ,IAAM,EAAY,EAAM,GACxB,GAAI,IAAc,IAAA,GAAW,SAC7B,IAAM,EAAc,EAAU,GAC9B,GAAI,CAAC,GAAe,EAAY,OAAS,SAAU,SAEnD,IAAM,EAAS,EAAM,GACrB,GAAI,CAAC,EAAQ,SAGb,GAAI,EAAY,OAAS,OAAQ,CAC3B,EAAI,WAAW,OAAO,CACxB,EAAW,KAAK,EAAI,EAAQ,EAAI,MAAM,EAAE,CAAC,CAAC,CACjC,EAAI,WAAW,OAAO,CAC/B,EAAW,KAAK,EAAI,EAAQ,EAAI,MAAM,EAAE,CAAC,CAAC,CAE1C,EAAW,KAAK,EAAG,EAAQ,EAAI,CAAC,CAElC,SAGF,IAAM,EAAY,EAAoB,EAAa,EAAI,CACnD,IAAc,MAClB,EAAW,KAAK,EAAG,EAAQ,EAAU,CAAC,CAGxC,OAAO,EAOT,SAAgB,EAAwB,EAA0B,CAChE,GAAM,CACJ,WACA,gBACA,aAAa,SACb,KAAM,EACN,MAAO,EACP,WACE,EACE,EAAW,KAAK,IAAI,EAAO,UAAA,IAAA,IAAiC,CAC5D,EAAY,EAAe,EAAS,CAGpC,EAAa,IAAI,EAAW,IAAK,CAInC,EAA8C,KAC9C,EAAsB,EAE1B,eAAe,GAAyC,CACtD,IAAM,EAAM,KAAK,KAAK,CAKtB,OAJI,CAAC,GAAqB,EAAM,EAAsB,OACpD,EAAoB,MAAM,EAAO,iBAAiB,CAClD,EAAsB,GAEjB,EAKT,eAAe,EAAY,EAA+B,CACxD,GAAI,CAAC,EAAO,aAAc,OAAO,EACjC,GAAI,CAEF,OADe,MAAM,EAAO,aAAa,EAAI,GAC9B,MAAQ,OACjB,CACN,OAAO,GAMX,SAAS,EACP,EACA,EACA,EACS,CACT,OAAO,EAAQ,EAAM,EAAY,OAAO,CAK1C,SAAS,EAAa,EAA6B,CACjD,IAAM,EAAM,GAAQ,CACpB,OAAO,IAAI,EAAY,CACrB,SACA,GAAI,EAAI,GAAG,SACX,OAAQ,EAAI,OAAO,MAAM,CAAE,OAAQ,EAAO,KAAM,CAAC,CACjD,aACA,oBAAuB,CACrB,IAAM,EAAM,GAAY,CACpB,MAAC,GAAK,MAAQ,CAAC,GAAK,SACxB,MAAO,CAAE,KAAM,EAAI,KAAM,QAAS,EAAI,QAAS,MAAO,EAAI,MAAO,EAEpE,CAAC,CAKJ,eAAe,EACb,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CACtB,EAAS,EAAiB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CAC/E,GAAI,CAAC,EAAO,QACV,OAAO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAGxF,GAAM,CACJ,MAAO,EACP,SACA,OACA,SACA,SACA,SACA,OAAQ,GACN,EAAO,KACL,EAAQ,KAAK,IAAI,EAAU,EAAS,CACpC,EAAY,EAAO,UAGrB,EACJ,GAAI,EAAa,CACf,IAAM,EAAU,EAAa,EAAY,CACzC,GAAI,CAAC,EACH,OAAO,EAAc,iBAAkB,mBAAoB,IAAK,EAAY,CAG9E,GAAI,EAAE,EAAQ,SAAS,IAAc,EAAQ,QAAU,KACrD,OAAO,EAAc,uBAAwB,mBAAoB,IAAK,EAAY,CAEpF,EAAS,EAGX,IAAM,EAAe,EAAE,CACvB,GAAI,EAAQ,CACV,IAAM,EAAkB,EAAqB,EAAQ,EAAO,CACxD,GAAiB,EAAM,KAAK,EAAgB,CAGlD,IAAM,EAAmB,EAAsB,EAAO,KAAM,EAAK,EAAU,CAC3E,EAAM,KAAK,GAAG,EAAiB,CAE/B,IAAM,EAAU,EAAa,EAAO,KAAM,EAAM,EAAU,CACpD,EAAS,EAAoB,EAAQ,EAAU,CAE/C,EAAS,EAAa,EAAO,CAC7B,EAAiB,GAAU,EAC3B,EAAY,CAChB,MAAO,EAAM,OAAS,EAAI,EAAI,GAAG,EAAM,CAAG,IAAA,GAC1C,QACA,SACA,UACA,SACA,OAAQ,EACR,gBACA,SACD,CAEK,CAAC,EAAO,GAAS,MAAM,QAAQ,IAAI,CACvC,EAAO,SAAS,EAAU,CAC1B,EAAO,MAAM,CAAE,MAAO,EAAM,OAAS,EAAI,EAAI,GAAG,EAAM,CAAG,IAAA,GAAW,CAAC,CACtE,CAAC,CAGE,EACJ,GAAI,EAAM,OAAS,GAAK,EAAM,SAAW,EAAO,CAC9C,IAAM,EAAW,EAAM,EAAM,OAAS,GAEhC,EACJ,GAAQ,QAAU,EAAQ,EAAK,WAAW,IAAI,CAAG,EAAK,MAAM,EAAE,CAAG,EAAQ,IAAA,IACrE,EACJ,GAAQ,YAAc,GAAM,WAAW,IAAI,CAAG,OAAS,OACrD,GAAe,EAAS,KAAiB,IAAA,KAC3C,EAAa,EAAa,EAAU,EAAa,EAAgB,EAIrE,IAAM,EAAU,CACd,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAED,OAAO,EACL,CACE,KAAM,EACN,KAAM,CAAE,QAAO,QAAO,SAAQ,QAAS,EAAS,EAAQ,EAAO,aAAY,CAC5E,CACD,IACA,EACD,CAGH,eAAe,EACb,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CAqB5B,OApBe,EAAkB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CACpE,QAIM,EAAI,aAAa,IAAI,YAAY,GAGjC,WAGT,EAAa,CAAE,KAAM,CAAE,MADhB,MAAM,EADR,GAAQ,CACqB,GAAG,SAAU,EAAO,KAAK,CAC7B,SAAU,GAAM,CAAE,CAAE,IAAK,CAC5D,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CAMG,EAAa,CAAE,KAAM,CAAE,MAFhB,MADC,EAAa,EAAO,CACR,OAAO,CAEG,CAAE,CAAE,IAAK,CAC5C,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CArBO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAwB1F,eAAe,EACb,EACA,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CACtB,EAAS,EAAmB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CACjF,GAAI,CAAC,EAAO,QACV,OAAO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAGxF,GAAM,CAAE,SAAQ,UAAW,EAAO,KAC5B,EAAY,EAAO,UACnB,EAAS,EAAoB,EAAQ,EAAU,CAC/C,EAAiB,GAAU,EAG3B,EAAO,MADE,EAAa,EAAO,CACT,SAAS,EAAI,CACrC,SACA,OAAQ,EACR,gBACD,CAAC,CAGF,OAFK,EAEE,EAAa,CAAE,KAAM,EAAM,CAAE,IAAK,CACvC,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CALgB,EAAiB,EAAY,CAQjD,eAAe,EACb,EACA,EACA,EACA,EACmB,CACnB,IAAM,EAAM,IAAI,IAAI,EAAI,IAAI,CACtB,EAAS,EAAmB,UAAU,OAAO,YAAY,EAAI,aAAa,CAAC,CACjF,GAAI,CAAC,EAAO,QACV,OAAO,EAAc,2BAA4B,mBAAoB,IAAK,EAAY,CAIxF,IAAM,EAAY,EAAO,UACzB,GAAI,CAAC,EAAU,KAAM,OAAO,EAAiB,EAAY,CAEzD,GAAM,CAAE,SAAQ,UAAW,EAAO,KAC5B,EAAS,EAAoB,EAAQ,EAAU,CAC/C,EAAiB,GAAU,EAG3B,EAAQ,EAAe,IAAI,EAAO,KAAK,CAC7C,GAAI,CAAC,GAAO,KAAM,OAAO,EAAiB,EAAY,CAEtD,IAAM,EAAS,EAAa,EAAO,CAC7B,EAAa,EAAU,KAIzB,EAAmB,EAAG,EAAM,KAAM,EAAK,CAE3C,GAAI,EAAW,cAAgB,EAAgB,CAC7C,IAAM,EAAuB,GAAG,EAAO,KAAK,eAEtC,EAAmB,EAAe,IAAI,EAAqB,CAGjE,GAAI,GAAkB,KAAM,CAG1B,IAAM,EAAqB,MADf,GAAQ,CACiB,GAAG,SACrC,OAAO,CAAE,SAAU,EAAiB,SAAU,CAAC,CAC/C,KAAK,EAAiB,CACtB,MAAM,EAAI,EAAG,EAAiB,KAAM,EAAK,CAAE,EAAG,EAAiB,OAAQ,EAAe,CAAC,CAAC,CAE3F,GAAI,EAAmB,OAAS,EAAG,CACjC,IAAM,EAAgB,EAAmB,IAAK,GAAM,EAAE,SAAmB,CAEzE,EAAc,EAAG,EAAQ,EAAM,GAAI,EAAc,CAAE,EAAG,EAAM,KAAM,EAAK,CAAC,GAK9E,IAAM,EAAU,MAAM,EAAO,SAAS,CACpC,MAAO,EACP,MAAO,EACP,SACA,OAAQ,EACR,gBACD,CAAC,CAIF,OAFI,EAAQ,SAAW,EAAU,EAAiB,EAAY,CAEvD,EAAa,CAAE,KAAM,EAAQ,GAAI,CAAE,IAAK,CAC7C,GAAG,EACH,GAAG,EAAkB,EAAO,KAAM,EAAY,CAC/C,CAAC,CAKJ,eAAe,EAAU,EAAc,EAAsC,CAC3E,IAAM,EAAc,EAAiB,EAAK,EAAW,CAErD,GAAI,CACF,IAAM,EAAW,MAAM,EAAI,OAAO,KAAM,GAAM,EAAE,KAAK,CACrD,GAAI,CAAC,GAAY,EAAS,SAAW,EACnC,OAAO,EAAiB,EAAY,CAItC,IAAM,EAAO,MAAM,EAAY,EAAI,CAC7B,EAAU,MAAM,GAAY,CAOlC,OAAO,MAAM,EAL0B,CACrC,KAAM,CAAE,GAAI,SAAU,OAAQ,EAAO,CAAC,EAAK,CAAG,EAAE,CAAE,CAClD,UACD,CAEgD,SAAY,CAE7D,GAAI,EAAS,KAAO,UAIlB,OAAO,EAHQ,EAAoB,EAAW,GAC5C,EAAkB,EAAS,EAAM,EAAK,CACvC,CAC2B,IAAK,CAC/B,GAAG,EACH,gBAAiB,WAClB,CAAC,CAIJ,IAAM,EAAa,EAAS,GAC5B,GAAI,IAAe,IAAA,GAAW,OAAO,EAAiB,EAAY,CAClE,IAAM,EACJ,EAAU,IAAI,EAAW,EACzB,EAAU,IAAI,EAAW,SAAS,IAAI,CAAG,EAAW,MAAM,EAAG,GAAG,CAAG,EAAW,CAqBhF,MAlBI,CAAC,GAAU,CAAC,EAAkB,EAAS,EAAM,EAAO,KAAK,CACpD,EAAiB,EAAY,CAIlC,EAAS,SAAW,EACf,EAAW,EAAK,EAAQ,EAAY,CAEzC,EAAS,KAAO,QACX,EAAY,EAAK,EAAQ,EAAY,CAE1C,EAAS,KAAO,QAAU,EAAS,GAC9B,EAAa,EAAK,EAAQ,EAAS,GAAI,EAAY,CAExD,EAAS,SAAW,GAAK,EAAS,KAAO,IAAA,GACpC,EAAW,EAAK,EAAQ,EAAS,GAAI,EAAY,CAGnD,EAAiB,EAAY,EAClC,OACK,EAAK,CACZ,IAAM,EAAU,aAAe,MAAQ,EAAI,QAAU,wBAOrD,OANA,QAAQ,MAAM,+BAAgC,EAAI,CAClD,IAAU,CACR,OAAQ,IACR,UACA,KAAM,IAAI,IAAI,EAAI,IAAI,CAAC,SACxB,CAAC,CACK,EAAc,wBAAyB,iBAAkB,IAAK,EAAY,EAIrF,MAAO,CACL,KAAM,EAAc,IAAsB,EAAU,EAAK,EAAI,CAC7D,QAAU,GAAiB,EAAsB,EAAK,EAAW,CAClE"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@murumets-ee/content-api",
3
- "version": "0.9.0",
3
+ "version": "0.11.0",
4
4
  "license": "Elastic-2.0",
5
5
  "type": "module",
6
6
  "exports": {
@@ -15,15 +15,18 @@
15
15
  "dependencies": {
16
16
  "drizzle-orm": "^0.45.2",
17
17
  "zod": "^3.24.1",
18
- "@murumets-ee/core": "0.9.0",
19
- "@murumets-ee/entity": "0.9.0",
20
- "@murumets-ee/db": "0.9.0"
18
+ "@murumets-ee/core": "0.11.0",
19
+ "@murumets-ee/entity": "0.11.0",
20
+ "@murumets-ee/db": "0.11.0"
21
21
  },
22
22
  "devDependencies": {
23
23
  "tsdown": "^0.21.7",
24
24
  "typescript": "^5.7.2",
25
25
  "vitest": "^2.1.8"
26
26
  },
27
+ "typeCoverage": {
28
+ "atLeast": 98.6
29
+ },
27
30
  "scripts": {
28
31
  "build": "tsdown",
29
32
  "dev": "tsdown --watch",