@murumets-ee/entity 0.8.0 → 0.10.0

package/dist/index.d.mts

@@ -232,16 +232,29 @@ type InferEntity<E> = E extends {
 } ? InferEntityDTO<F> : never;
 //#endregion
 //#region src/behaviors/types.d.ts
+/**
+ * Context passed to behavior hooks. Resolved once per request by AdminClient
+ * from its `contextResolver` and forwarded into every hook so behaviors never
+ * have to reach into AsyncLocalStorage themselves — that pattern breaks under
+ * bundlers (e.g. Turbopack) that duplicate module instances across boundaries.
+ */
+interface BehaviorContext {
+  user?: {
+    id: string;
+    name?: string;
+    email?: string;
+  };
+}
 interface Behavior<F extends Record<string, FieldConfig> = {}> {
   name: string;
   fields?: F;
   hooks?: {
-    beforeCreate?: (data: Record<string, unknown>) => Promise<Record<string, unknown>>;
-    afterCreate?: (entity: Record<string, unknown>) => Promise<void>;
-    beforeUpdate?: (id: string, data: Record<string, unknown>) => Promise<Record<string, unknown>>;
-    afterUpdate?: (entity: Record<string, unknown>) => Promise<void>;
-    beforeDelete?: (id: string) => Promise<void>;
-    afterDelete?: (id: string) => Promise<void>;
+    beforeCreate?: (data: Record<string, unknown>, ctx?: BehaviorContext) => Promise<Record<string, unknown>>;
+    afterCreate?: (entity: Record<string, unknown>, ctx?: BehaviorContext) => Promise<void>;
+    beforeUpdate?: (id: string, data: Record<string, unknown>, ctx?: BehaviorContext) => Promise<Record<string, unknown>>;
+    afterUpdate?: (entity: Record<string, unknown>, ctx?: BehaviorContext) => Promise<void>;
+    beforeDelete?: (id: string, ctx?: BehaviorContext) => Promise<void>;
+    afterDelete?: (id: string, ctx?: BehaviorContext) => Promise<void>;
   };
 }
 //#endregion
@@ -391,10 +404,22 @@ declare const behavior: {
 interface CountCacheLike {
   get(key: string): number | undefined;
   set(key: string, count: number): void;
+  /**
+   * Cache-or-compute with single-flight semantics.
+   *
+   * If the entry is cached and unexpired, returns it immediately (no promise
+   * allocation in the hot path). Otherwise, if a refresh is already in flight
+   * for the same key, returns that in-flight promise instead of starting a
+   * second one — preventing the thundering-herd burst of identical
+   * `count(*)` queries when N concurrent requests cross the TTL boundary
+   * together.
+   */
+  getOrCompute(key: string, compute: () => Promise<number>): Promise<number> | number;
   invalidate(prefix: string): void;
 }
 declare class CountCache implements CountCacheLike {
   private cache;
+  private inflight;
   private ttlMs;
   constructor(ttlMs?: number);
   /**
@@ -406,10 +431,23 @@ declare class CountCache implements CountCacheLike {
    */
   set(key: string, count: number): void;
   /**
-   * Invalidate all cache entries whose key starts with the given prefix.
-   * Typically called with the entity name after mutations (create/update/delete).
+   * Cache-or-compute with single-flight semantics. See `CountCacheLike` doc.
+   *
+   * Cache hits return synchronously (the call site keeps the await but no
+   * actual microtask is scheduled). Cache misses register an in-flight
+   * promise so concurrent callers share one DB round-trip; the promise is
+   * removed once it resolves (or rejects) so the next miss can refresh.
+   * On rejection, nothing is cached — the next caller retries.
    */
-  invalidate(prefix: string): void;
+  getOrCompute(key: string, compute: () => Promise<number>): Promise<number> | number;
+  /**
+   * Invalidate all cache entries for a given entity name.
+   * Matches the exact entity name OR any key where the entity is followed
+   * by one of the cache-key separators (`:` for WHERE, `@` for scope).
+   * Avoids accidental cross-entity invalidation (e.g. invalidating 'user'
+   * must not clear 'users:where=...' entries).
+   */
+  invalidate(entityName: string): void;
   /**
    * Remove all expired entries. Useful for periodic cleanup in long-running processes.
    */
@@ -571,40 +609,6 @@ declare function defineEntity<F extends Record<string, FieldConfig>, const B ext
   id: IdField;
 } & ExtractBehaviorFields<B> & F>;
 //#endregion
-//#region src/shared/entity-data-ops.d.ts
-/**
- * Security context resolved per-request. Provided by the consumer
- * (e.g., via React.cache() in Next.js, or runAsCli for CLI).
- * The entity package has zero knowledge of how this is resolved.
- */
-interface SecurityContext {
-  user: {
-    id: string;
-    groups: string[];
-  };
-  checker: (role: string, resource: string, action: string) => boolean;
-  scope?: {
-    type: string;
-    id: string;
-  };
-}
-/**
- * Function that resolves the current request's security context.
- * Injected at construction time — the entity package never imports
- * @murumets-ee/core or any framework-specific code.
- *
- * Returns undefined only when intentionally skipping enforcement
- * (should not happen in production — throw ForbiddenError instead).
- */
-type ContextResolver = () => SecurityContext | undefined | Promise<SecurityContext | undefined>;
-/**
- * Thrown when a user lacks permission for an entity operation.
- * Consumers (api-handler) catch this and return HTTP 403.
- */
-declare class ForbiddenError extends Error {
-  constructor(message: string);
-}
-//#endregion
 //#region src/refs/find-usages.d.ts
 interface EntityUsage {
   sourceEntity: string;
@@ -841,8 +845,18 @@ declare function needsLocaleStatus(entity: Entity): boolean;
  * Check if an entity is publishable (has publishable() behavior).
  */
 declare function isPublishable(entity: Entity): boolean;
-/** Per-locale publish status table for publishable + translatable entities. */
-declare function generateLocaleStatusSchema(entity: Entity, parent: PgTable): _$drizzle_orm_pg_core0.PgTableWithColumns<{
+/**
+ * Check if an entity has blocks fields with translatable block content (non-localized mode).
+ */
+declare function hasTranslatableBlocks(entity: Entity): boolean;
+/**
+ * Generate layout translation table for non-localized blocks with translatable fields.
+ *
+ * `layoutParent` is optional — when provided, emits a `.references()` FK
+ * pointing at the corresponding `{entity}_layout` table (for migration
+ * generation).
+ */
+declare function generateLayoutTranslationSchema(entity: Entity, layoutParent?: PgTable): _$drizzle_orm_pg_core0.PgTableWithColumns<{
   name: string;
   schema: undefined;
   columns: {
@@ -863,8 +877,8 @@ declare function generateLocaleStatusSchema(entity: Entity, parent: PgTable): _$
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    entityId: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "entity_id";
+    layoutId: _$drizzle_orm_pg_core0.PgColumn<{
+      name: "layout_id";
       tableName: string;
       dataType: "string";
       columnType: "PgUUID";
@@ -899,625 +913,8 @@ declare function generateLocaleStatusSchema(entity: Entity, parent: PgTable): _$
     }, {}, {
       length: 10;
     }>;
-    status: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "status";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 20;
-    }>;
-    publishedAt: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "published_at";
-      tableName: string;
-      dataType: "date";
-      columnType: "PgTimestamp";
-      data: Date;
-      driverParam: string;
-      notNull: false;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-  };
-  dialect: "pg";
-}>;
-/** Drafts overlay table for publishable entities. */
-declare function generateDraftsSchema(entity: Entity, parent: PgTable): _$drizzle_orm_pg_core0.PgTableWithColumns<{
-  name: string;
-  schema: undefined;
-  columns: {
-    id: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "id";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgUUID";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: true;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    entityId: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "entity_id";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgUUID";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    locale: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "locale";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 10;
-    }>;
-    data: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "data";
-      tableName: string;
-      dataType: "json";
-      columnType: "PgJsonb";
-      data: unknown;
-      driverParam: unknown;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    createdBy: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "created_by";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 255;
-    }>;
-    createdByName: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "created_by_name";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: false;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 255;
-    }>;
-    createdAt: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "created_at";
-      tableName: string;
-      dataType: "date";
-      columnType: "PgTimestamp";
-      data: Date;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    updatedAt: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "updated_at";
-      tableName: string;
-      dataType: "date";
-      columnType: "PgTimestamp";
-      data: Date;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-  };
-  dialect: "pg";
-}>;
-/** Versions history table for versionable entities. */
-declare function generateVersionsSchema(entity: Entity, parent: PgTable): _$drizzle_orm_pg_core0.PgTableWithColumns<{
-  name: string;
-  schema: undefined;
-  columns: {
-    id: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "id";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgUUID";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: true;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    entityId: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "entity_id";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgUUID";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    version: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "version";
-      tableName: string;
-      dataType: "number";
-      columnType: "PgInteger";
-      data: number;
-      driverParam: string | number;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    locale: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "locale";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 10;
-    }>;
-    data: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "data";
-      tableName: string;
-      dataType: "json";
-      columnType: "PgJsonb";
-      data: unknown;
-      driverParam: unknown;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    delta: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "delta";
-      tableName: string;
-      dataType: "json";
-      columnType: "PgJsonb";
-      data: unknown;
-      driverParam: unknown;
-      notNull: false;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    status: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "status";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: false;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 20;
-    }>;
-    createdBy: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "created_by";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: false;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 255;
-    }>;
-    createdByName: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "created_by_name";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: false;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 255;
-    }>;
-    createdAt: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "created_at";
-      tableName: string;
-      dataType: "date";
-      columnType: "PgTimestamp";
-      data: Date;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    isAutosave: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "is_autosave";
-      tableName: string;
-      dataType: "boolean";
-      columnType: "PgBoolean";
-      data: boolean;
-      driverParam: boolean;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-  };
-  dialect: "pg";
-}>;
-/**
- * Shared content locks table — one per project, independent of any entity.
- * Included exactly once in `buildRuntimeSchema()` when any entity is publishable.
- */
-declare function generateContentLocksSchema(): _$drizzle_orm_pg_core0.PgTableWithColumns<{
-  name: "toolkit_content_locks";
-  schema: undefined;
-  columns: {
-    id: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "id";
-      tableName: "toolkit_content_locks";
-      dataType: "string";
-      columnType: "PgUUID";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: true;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    entityType: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "entity_type";
-      tableName: "toolkit_content_locks";
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 100;
-    }>;
-    entityId: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "entity_id";
-      tableName: "toolkit_content_locks";
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 255;
-    }>;
-    locale: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "locale";
-      tableName: "toolkit_content_locks";
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 10;
-    }>;
-    lockedBy: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "locked_by";
-      tableName: "toolkit_content_locks";
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 255;
-    }>;
-    lockedByName: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "locked_by_name";
-      tableName: "toolkit_content_locks";
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: false;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 255;
-    }>;
-    lockedAt: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "locked_at";
-      tableName: "toolkit_content_locks";
-      dataType: "date";
-      columnType: "PgTimestamp";
-      data: Date;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    expiresAt: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "expires_at";
-      tableName: "toolkit_content_locks";
-      dataType: "date";
-      columnType: "PgTimestamp";
-      data: Date;
-      driverParam: string;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-  };
-  dialect: "pg";
-}>;
-/**
- * Check if an entity has blocks fields with translatable block content (non-localized mode).
- */
-declare function hasTranslatableBlocks(entity: Entity): boolean;
-/**
- * Generate layout translation table for non-localized blocks with translatable fields.
- *
- * `layoutParent` is optional — when provided, emits a `.references()` FK
- * pointing at the corresponding `{entity}_layout` table (for migration
- * generation).
- */
-declare function generateLayoutTranslationSchema(entity: Entity, layoutParent?: PgTable): _$drizzle_orm_pg_core0.PgTableWithColumns<{
-  name: string;
-  schema: undefined;
-  columns: {
-    id: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "id";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgUUID";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: true;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    layoutId: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "layout_id";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgUUID";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    locale: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "locale";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 10;
-    }>;
-    fields: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "fields";
+    fields: _$drizzle_orm_pg_core0.PgColumn<{
+      name: "fields";
       tableName: string;
       dataType: "json";
       columnType: "PgJsonb";
@@ -1552,5 +949,41 @@ declare function generateLayoutTranslationSchema(entity: Entity, layoutParent?:
  */
 declare function buildEntitySchemaMap(entities: Entity[]): Record<string, PgTable>;
 //#endregion
-export { type AuditableFields, type Behavior, type BlockDefinitionRef, type BlocksField, type BooleanField, type ContextResolver, CountCache, type CountCacheLike, type CursorInput, type DateField, type Entity, type EntityAdminConfig, type EntityDefinition, type EntityInput, type EntityUsage, type FieldConfig, type FieldToTS, ForbiddenError, type IdField, type InferEntity, type InferEntityDTO, type JsonField, type JsonValue, type MediaField, type NumberField, type PublishableFields, type ReferenceField, ReferencedEntityError, type RichTextField, type SecurityContext, type SelectField, type SlugField, type TextField, auditable, behavior, buildCursorCondition, buildEntitySchemaMap, decodeCursor, defineEntity, encodeCursor, estimateRowCount, field, generateContentLocksSchema, generateDraftsSchema, generateLayoutSchema, generateLayoutTranslationSchema, generateLocaleStatusSchema, generateSchema, generateTranslationSchema, generateVersionsSchema, hasBlocksFields, hasTranslatableBlocks, hierarchical, isPublishable, isVersionable, needsLocaleStatus, publishable, revisionable, sluggable, slugify, timestamped };
+//#region src/shared/entity-data-ops.d.ts
+/**
+ * Security context resolved per-request. Provided by the consumer
+ * (e.g., via React.cache() in Next.js, or runAsCli for CLI).
+ * The entity package has zero knowledge of how this is resolved.
+ */
+interface SecurityContext {
+  user: {
+    id: string;
+    groups: string[];
+    name?: string;
+    email?: string;
+  };
+  checker: (role: string, resource: string, action: string) => boolean;
+  scope?: {
+    type: string;
+    id: string;
+  };
+}
+/**
+ * Function that resolves the current request's security context.
+ * Injected at construction time — the entity package never imports
+ * @murumets-ee/core or any framework-specific code.
+ *
+ * Returns undefined only when intentionally skipping enforcement
+ * (should not happen in production — throw ForbiddenError instead).
+ */
+type ContextResolver = () => SecurityContext | undefined | Promise<SecurityContext | undefined>;
+/**
+ * Thrown when a user lacks permission for an entity operation.
+ * Consumers (api-handler) catch this and return HTTP 403.
+ */
+declare class ForbiddenError extends Error {
+  constructor(message: string);
+}
+//#endregion
+export { type AuditableFields, type Behavior, type BehaviorContext, type BlockDefinitionRef, type BlocksField, type BooleanField, type ContextResolver, CountCache, type CountCacheLike, type CursorInput, type DateField, type Entity, type EntityAdminConfig, type EntityDefinition, type EntityInput, type EntityUsage, type FieldConfig, type FieldToTS, ForbiddenError, type IdField, type InferEntity, type InferEntityDTO, type JsonField, type JsonValue, type MediaField, type NumberField, type PublishableFields, type ReferenceField, ReferencedEntityError, type RichTextField, type SecurityContext, type SelectField, type SlugField, type TextField, auditable, behavior, buildCursorCondition, buildEntitySchemaMap, decodeCursor, defineEntity, encodeCursor, estimateRowCount, field, generateLayoutSchema, generateLayoutTranslationSchema, generateSchema, generateTranslationSchema, hasBlocksFields, hasTranslatableBlocks, hierarchical, isPublishable, isVersionable, needsLocaleStatus, publishable, revisionable, sluggable, slugify, timestamped };
 //# sourceMappingURL=index.d.mts.map