@murumets-ee/entity 0.9.0 → 0.11.0

package/dist/index.d.mts

@@ -74,6 +74,23 @@ interface BaseFieldConfig {
   translatable?: boolean;
   indexed?: boolean;
   unique?: boolean;
+  /**
+   * Marks the field as **system-managed**: stored as a real column, populated
+   * by behavior hooks or trusted server-side transitions, but NOT writable
+   * through the public `AdminClient.create/update` surface.
+   *
+   * - Caller-supplied values for internal fields are silently stripped before
+   *   hooks run (so an HTTP PATCH cannot poison a workflow state).
+   * - `beforeCreate` / `beforeUpdate` hooks may still set them (they run after
+   *   the strip), and the values are preserved through validation.
+   * - Trusted server code that needs to write internals directly — e.g.
+   *   workflow transitions invoked from an authorized admin route — must use
+   *   `AdminClient.updateInternal()`, which bypasses the strip.
+   *
+   * Use this flag on any field added by a behavior whose value represents a
+   * controlled state machine (e.g. `_workflowStatus`), not user input.
+   */
+  internal?: boolean;
   access?: {
     view?: string;
     edit?: string;
@@ -182,6 +199,17 @@ type FieldToTS<F extends FieldConfig> = F extends IdField ? string : F extends T
 type InferEntityDTO<Fields extends Record<string, FieldConfig>> = {
   id: string;
 } & { [K in keyof Fields as K extends 'id' ? never : Fields[K]['required'] extends true ? K : never]: FieldToTS<Fields[K]> } & { [K in keyof Fields as Fields[K]['required'] extends true ? never : K]?: FieldToTS<Fields[K]> | null };
+/** Fields that are auto-generated and should not appear in create input. */
+type AutoGeneratedFields = 'id' | 'createdAt' | 'updatedAt' | 'createdBy' | 'updatedBy' | '_version';
+/**
+ * The input type for creating an entity.
+ * - Omits auto-generated fields (id, timestamps, version)
+ * - Required fields stay required; optional fields stay optional
+ */
+type InferCreateInput<Fields extends Record<string, FieldConfig>> = Omit<{ [K in keyof Fields as K extends 'id' ? never : Fields[K]['required'] extends true ? K : never]: FieldToTS<Fields[K]> } & { [K in keyof Fields as Fields[K]['required'] extends true ? never : K]?: FieldToTS<Fields[K]> | null }, AutoGeneratedFields>;
+/** Fields that cannot be changed after creation. */
+type ImmutableFields = 'id' | 'createdAt' | 'createdBy';
+type InferUpdateInput<Fields extends Record<string, FieldConfig>> = { [K in keyof Fields as K extends ImmutableFields ? never : K]?: FieldToTS<Fields[K]> | null };
 /**
  * Behavior field types use `type` (not `interface`) because interfaces
  * lack implicit index signatures needed for Record<string, FieldConfig>.
@@ -237,6 +265,24 @@ type InferEntity<E> = E extends {
  * from its `contextResolver` and forwarded into every hook so behaviors never
  * have to reach into AsyncLocalStorage themselves — that pattern breaks under
  * bundlers (e.g. Turbopack) that duplicate module instances across boundaries.
+ *
+ * `loadCurrent` is a lazy, memoized loader for the *current* entity row,
+ * provided by AdminClient on update/delete codepaths. Hooks that need to
+ * validate against the existing state (e.g. workflowable's transition
+ * checker) call it; behaviors that don't, don't pay for the round trip.
+ * Returns `null` when no entity matches the id (rare — usually means the
+ * row was deleted concurrently). On create, `loadCurrent` is undefined.
+ *
+ * `viaInternal` is `true` when the hook is running on an `AdminClient.updateInternal`
+ * call (the trusted server-side path; public PATCH always sets it false).
+ * Hooks SHOULD treat this as informational only — the route layer has
+ * authorized the *capability*, but the hook is still responsible for
+ * enforcing structural invariants. Workflowable, for example, validates
+ * the `_workflowStatus` transition table on every update regardless of
+ * `viaInternal` so that even a route-layer bug cannot push the workflow
+ * row into an illegal state. Use `viaInternal` when a hook genuinely
+ * needs to differentiate (e.g. side effects that should only fire when
+ * a real user — not the seed loader — initiates the change).
  */
 interface BehaviorContext {
   user?: {
@@ -244,6 +290,8 @@ interface BehaviorContext {
     name?: string;
     email?: string;
   };
+  loadCurrent?: () => Promise<Record<string, unknown> | null>;
+  viaInternal?: boolean;
 }
 interface Behavior<F extends Record<string, FieldConfig> = {}> {
   name: string;
@@ -404,10 +452,22 @@ declare const behavior: {
 interface CountCacheLike {
   get(key: string): number | undefined;
   set(key: string, count: number): void;
+  /**
+   * Cache-or-compute with single-flight semantics.
+   *
+   * If the entry is cached and unexpired, returns it immediately (no promise
+   * allocation in the hot path). Otherwise, if a refresh is already in flight
+   * for the same key, returns that in-flight promise instead of starting a
+   * second one — preventing the thundering-herd burst of identical
+   * `count(*)` queries when N concurrent requests cross the TTL boundary
+   * together.
+   */
+  getOrCompute(key: string, compute: () => Promise<number>): Promise<number> | number;
   invalidate(prefix: string): void;
 }
 declare class CountCache implements CountCacheLike {
   private cache;
+  private inflight;
   private ttlMs;
   constructor(ttlMs?: number);
   /**
@@ -419,10 +479,23 @@ declare class CountCache implements CountCacheLike {
    */
   set(key: string, count: number): void;
   /**
-   * Invalidate all cache entries whose key starts with the given prefix.
-   * Typically called with the entity name after mutations (create/update/delete).
+   * Cache-or-compute with single-flight semantics. See `CountCacheLike` doc.
+   *
+   * Cache hits return synchronously (the call site keeps the await but no
+   * actual microtask is scheduled). Cache misses register an in-flight
+   * promise so concurrent callers share one DB round-trip; the promise is
+   * removed once it resolves (or rejects) so the next miss can refresh.
+   * On rejection, nothing is cached — the next caller retries.
    */
-  invalidate(prefix: string): void;
+  getOrCompute(key: string, compute: () => Promise<number>): Promise<number> | number;
+  /**
+   * Invalidate all cache entries for a given entity name.
+   * Matches the exact entity name OR any key where the entity is followed
+   * by one of the cache-key separators (`:` for WHERE, `@` for scope).
+   * Avoids accidental cross-entity invalidation (e.g. invalidating 'user'
+   * must not clear 'users:where=...' entries).
+   */
+  invalidate(entityName: string): void;
   /**
    * Remove all expired entries. Useful for periodic cleanup in long-running processes.
    */
@@ -584,42 +657,6 @@ declare function defineEntity<F extends Record<string, FieldConfig>, const B ext
   id: IdField;
 } & ExtractBehaviorFields<B> & F>;
 //#endregion
-//#region src/shared/entity-data-ops.d.ts
-/**
- * Security context resolved per-request. Provided by the consumer
- * (e.g., via React.cache() in Next.js, or runAsCli for CLI).
- * The entity package has zero knowledge of how this is resolved.
- */
-interface SecurityContext {
-  user: {
-    id: string;
-    groups: string[];
-    name?: string;
-    email?: string;
-  };
-  checker: (role: string, resource: string, action: string) => boolean;
-  scope?: {
-    type: string;
-    id: string;
-  };
-}
-/**
- * Function that resolves the current request's security context.
- * Injected at construction time — the entity package never imports
- * @murumets-ee/core or any framework-specific code.
- *
- * Returns undefined only when intentionally skipping enforcement
- * (should not happen in production — throw ForbiddenError instead).
- */
-type ContextResolver = () => SecurityContext | undefined | Promise<SecurityContext | undefined>;
-/**
- * Thrown when a user lacks permission for an entity operation.
- * Consumers (api-handler) catch this and return HTTP 403.
- */
-declare class ForbiddenError extends Error {
-  constructor(message: string);
-}
-//#endregion
 //#region src/refs/find-usages.d.ts
 interface EntityUsage {
   sourceEntity: string;
@@ -843,6 +880,15 @@ declare function generateLayoutSchema(entity: Entity, parent?: PgTable): _$drizz
   };
   dialect: "pg";
 }> | null;
+/**
+ * Check whether an entity has a behavior with the given name.
+ *
+ * Single source of truth replacing per-behavior predicates that used to
+ * inline the `entity.behaviors?.some(b => b.name === 'X') ?? false`
+ * pattern across the codebase. Use this whenever you need to branch on a
+ * behavior's presence — admin UI, schema generation, route dispatch, etc.
+ */
+declare function hasBehavior(entity: Entity, name: string): boolean;
 /**
  * Check if an entity has the versionable behavior
  */
@@ -856,8 +902,18 @@ declare function needsLocaleStatus(entity: Entity): boolean;
  * Check if an entity is publishable (has publishable() behavior).
  */
 declare function isPublishable(entity: Entity): boolean;
-/** Per-locale publish status table for publishable + translatable entities. */
-declare function generateLocaleStatusSchema(entity: Entity, parent: PgTable): _$drizzle_orm_pg_core0.PgTableWithColumns<{
+/**
+ * Check if an entity has blocks fields with translatable block content (non-localized mode).
+ */
+declare function hasTranslatableBlocks(entity: Entity): boolean;
+/**
+ * Generate layout translation table for non-localized blocks with translatable fields.
+ *
+ * `layoutParent` is optional — when provided, emits a `.references()` FK
+ * pointing at the corresponding `{entity}_layout` table (for migration
+ * generation).
+ */
+declare function generateLayoutTranslationSchema(entity: Entity, layoutParent?: PgTable): _$drizzle_orm_pg_core0.PgTableWithColumns<{
   name: string;
   schema: undefined;
   columns: {
@@ -878,8 +934,8 @@ declare function generateLocaleStatusSchema(entity: Entity, parent: PgTable): _$
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    entityId: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "entity_id";
+    layoutId: _$drizzle_orm_pg_core0.PgColumn<{
+      name: "layout_id";
       tableName: string;
       dataType: "string";
       columnType: "PgUUID";
@@ -914,625 +970,8 @@ declare function generateLocaleStatusSchema(entity: Entity, parent: PgTable): _$
     }, {}, {
       length: 10;
     }>;
-    status: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "status";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 20;
-    }>;
-    publishedAt: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "published_at";
-      tableName: string;
-      dataType: "date";
-      columnType: "PgTimestamp";
-      data: Date;
-      driverParam: string;
-      notNull: false;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-  };
-  dialect: "pg";
-}>;
-/** Drafts overlay table for publishable entities. */
-declare function generateDraftsSchema(entity: Entity, parent: PgTable): _$drizzle_orm_pg_core0.PgTableWithColumns<{
-  name: string;
-  schema: undefined;
-  columns: {
-    id: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "id";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgUUID";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: true;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    entityId: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "entity_id";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgUUID";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    locale: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "locale";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 10;
-    }>;
-    data: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "data";
-      tableName: string;
-      dataType: "json";
-      columnType: "PgJsonb";
-      data: unknown;
-      driverParam: unknown;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    createdBy: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "created_by";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 255;
-    }>;
-    createdByName: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "created_by_name";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: false;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 255;
-    }>;
-    createdAt: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "created_at";
-      tableName: string;
-      dataType: "date";
-      columnType: "PgTimestamp";
-      data: Date;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    updatedAt: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "updated_at";
-      tableName: string;
-      dataType: "date";
-      columnType: "PgTimestamp";
-      data: Date;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-  };
-  dialect: "pg";
-}>;
-/** Versions history table for versionable entities. */
-declare function generateVersionsSchema(entity: Entity, parent: PgTable): _$drizzle_orm_pg_core0.PgTableWithColumns<{
-  name: string;
-  schema: undefined;
-  columns: {
-    id: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "id";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgUUID";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: true;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    entityId: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "entity_id";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgUUID";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    version: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "version";
-      tableName: string;
-      dataType: "number";
-      columnType: "PgInteger";
-      data: number;
-      driverParam: string | number;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    locale: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "locale";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 10;
-    }>;
-    data: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "data";
-      tableName: string;
-      dataType: "json";
-      columnType: "PgJsonb";
-      data: unknown;
-      driverParam: unknown;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    delta: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "delta";
-      tableName: string;
-      dataType: "json";
-      columnType: "PgJsonb";
-      data: unknown;
-      driverParam: unknown;
-      notNull: false;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    status: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "status";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: false;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 20;
-    }>;
-    createdBy: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "created_by";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: false;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 255;
-    }>;
-    createdByName: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "created_by_name";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: false;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 255;
-    }>;
-    createdAt: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "created_at";
-      tableName: string;
-      dataType: "date";
-      columnType: "PgTimestamp";
-      data: Date;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    isAutosave: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "is_autosave";
-      tableName: string;
-      dataType: "boolean";
-      columnType: "PgBoolean";
-      data: boolean;
-      driverParam: boolean;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-  };
-  dialect: "pg";
-}>;
-/**
- * Shared content locks table — one per project, independent of any entity.
- * Included exactly once in `buildRuntimeSchema()` when any entity is publishable.
- */
-declare function generateContentLocksSchema(): _$drizzle_orm_pg_core0.PgTableWithColumns<{
-  name: "toolkit_content_locks";
-  schema: undefined;
-  columns: {
-    id: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "id";
-      tableName: "toolkit_content_locks";
-      dataType: "string";
-      columnType: "PgUUID";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: true;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    entityType: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "entity_type";
-      tableName: "toolkit_content_locks";
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 100;
-    }>;
-    entityId: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "entity_id";
-      tableName: "toolkit_content_locks";
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 255;
-    }>;
-    locale: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "locale";
-      tableName: "toolkit_content_locks";
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 10;
-    }>;
-    lockedBy: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "locked_by";
-      tableName: "toolkit_content_locks";
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 255;
-    }>;
-    lockedByName: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "locked_by_name";
-      tableName: "toolkit_content_locks";
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: false;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 255;
-    }>;
-    lockedAt: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "locked_at";
-      tableName: "toolkit_content_locks";
-      dataType: "date";
-      columnType: "PgTimestamp";
-      data: Date;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    expiresAt: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "expires_at";
-      tableName: "toolkit_content_locks";
-      dataType: "date";
-      columnType: "PgTimestamp";
-      data: Date;
-      driverParam: string;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-  };
-  dialect: "pg";
-}>;
-/**
- * Check if an entity has blocks fields with translatable block content (non-localized mode).
- */
-declare function hasTranslatableBlocks(entity: Entity): boolean;
-/**
- * Generate layout translation table for non-localized blocks with translatable fields.
- *
- * `layoutParent` is optional — when provided, emits a `.references()` FK
- * pointing at the corresponding `{entity}_layout` table (for migration
- * generation).
- */
-declare function generateLayoutTranslationSchema(entity: Entity, layoutParent?: PgTable): _$drizzle_orm_pg_core0.PgTableWithColumns<{
-  name: string;
-  schema: undefined;
-  columns: {
-    id: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "id";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgUUID";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: true;
-      isPrimaryKey: true;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    layoutId: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "layout_id";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgUUID";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: undefined;
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {}>;
-    locale: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "locale";
-      tableName: string;
-      dataType: "string";
-      columnType: "PgVarchar";
-      data: string;
-      driverParam: string;
-      notNull: true;
-      hasDefault: false;
-      isPrimaryKey: false;
-      isAutoincrement: false;
-      hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
-      baseColumn: never;
-      identity: undefined;
-      generated: undefined;
-    }, {}, {
-      length: 10;
-    }>;
-    fields: _$drizzle_orm_pg_core0.PgColumn<{
-      name: "fields";
+    fields: _$drizzle_orm_pg_core0.PgColumn<{
+      name: "fields";
       tableName: string;
       dataType: "json";
       columnType: "PgJsonb";
@@ -1567,5 +1006,41 @@ declare function generateLayoutTranslationSchema(entity: Entity, layoutParent?:
  */
 declare function buildEntitySchemaMap(entities: Entity[]): Record<string, PgTable>;
 //#endregion
-export { type AuditableFields, type Behavior, type BehaviorContext, type BlockDefinitionRef, type BlocksField, type BooleanField, type ContextResolver, CountCache, type CountCacheLike, type CursorInput, type DateField, type Entity, type EntityAdminConfig, type EntityDefinition, type EntityInput, type EntityUsage, type FieldConfig, type FieldToTS, ForbiddenError, type IdField, type InferEntity, type InferEntityDTO, type JsonField, type JsonValue, type MediaField, type NumberField, type PublishableFields, type ReferenceField, ReferencedEntityError, type RichTextField, type SecurityContext, type SelectField, type SlugField, type TextField, auditable, behavior, buildCursorCondition, buildEntitySchemaMap, decodeCursor, defineEntity, encodeCursor, estimateRowCount, field, generateContentLocksSchema, generateDraftsSchema, generateLayoutSchema, generateLayoutTranslationSchema, generateLocaleStatusSchema, generateSchema, generateTranslationSchema, generateVersionsSchema, hasBlocksFields, hasTranslatableBlocks, hierarchical, isPublishable, isVersionable, needsLocaleStatus, publishable, revisionable, sluggable, slugify, timestamped };
+//#region src/shared/entity-data-ops.d.ts
+/**
+ * Security context resolved per-request. Provided by the consumer
+ * (e.g., via React.cache() in Next.js, or runAsCli for CLI).
+ * The entity package has zero knowledge of how this is resolved.
+ */
+interface SecurityContext {
+  user: {
+    id: string;
+    groups: string[];
+    name?: string;
+    email?: string;
+  };
+  checker: (role: string, resource: string, action: string) => boolean;
+  scope?: {
+    type: string;
+    id: string;
+  };
+}
+/**
+ * Function that resolves the current request's security context.
+ * Injected at construction time — the entity package never imports
+ * @murumets-ee/core or any framework-specific code.
+ *
+ * Returns undefined only when intentionally skipping enforcement
+ * (should not happen in production — throw ForbiddenError instead).
+ */
+type ContextResolver = () => SecurityContext | undefined | Promise<SecurityContext | undefined>;
+/**
+ * Thrown when a user lacks permission for an entity operation.
+ * Consumers (api-handler) catch this and return HTTP 403.
+ */
+declare class ForbiddenError extends Error {
+  constructor(message: string);
+}
+//#endregion
+export { type AuditableFields, type Behavior, type BehaviorContext, type BlockDefinitionRef, type BlocksField, type BooleanField, type ContextResolver, CountCache, type CountCacheLike, type CursorInput, type DateField, type Entity, type EntityAdminConfig, type EntityDefinition, type EntityInput, type EntityUsage, type FieldConfig, type FieldToTS, ForbiddenError, type IdField, type InferCreateInput, type InferEntity, type InferEntityDTO, type InferUpdateInput, type JsonField, type JsonValue, type MediaField, type NumberField, type PublishableFields, type ReferenceField, ReferencedEntityError, type RichTextField, type SecurityContext, type SelectField, type SlugField, type TextField, auditable, behavior, buildCursorCondition, buildEntitySchemaMap, decodeCursor, defineEntity, encodeCursor, estimateRowCount, field, generateLayoutSchema, generateLayoutTranslationSchema, generateSchema, generateTranslationSchema, hasBehavior, hasBlocksFields, hasTranslatableBlocks, hierarchical, isPublishable, isVersionable, needsLocaleStatus, publishable, revisionable, sluggable, slugify, timestamped };
 //# sourceMappingURL=index.d.mts.map