@murumets-ee/menus 0.99.0 → 0.102.0

package/dist/admin.d.mts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { AdminRoute, ToolkitApp } from "@murumets-ee/core";
+import { ResolvedMenuNavItem } from "@murumets-ee/blocks";
 
 //#region src/menu-item-schema.d.ts
 /**
@@ -249,6 +250,20 @@ interface MenuEditorStateResponse {
 }
 //#endregion
 //#region src/admin/routes.d.ts
+/**
+ * Most distinct handles one request resolves — the amplification bound.
+ *
+ * The number is `MAX_RENDERED_MENU_HANDLES` in `@murumets-ee/blocks/library`:
+ * what one canvas resolves when it opens, so what one canvas can come to need.
+ * Restated rather than imported because that entry is the whole block library
+ * and this module is on the `lumi.config.ts` load path; `routes.test.ts` holds
+ * the two equal.
+ */
+declare const MAX_RESOLVED_HANDLES = 8;
+/** `GET /api/admin/menus/resolved` — `null` for a handle with no published menu. */
+interface ResolvedMenusResponse {
+  menus: Record<string, ResolvedMenuNavItem[] | null>;
+}
 /**
  * Every admin route this package contributes, in the `AdminRoute[]` shape
  * `createAdminApiHandler` consumes.
@@ -289,5 +304,5 @@ declare function resolveMenuItemSummaries(app: ToolkitApp, refs: ReadonlyArray<{
   id: string;
 }>): Promise<Map<string, MenuItemSummary>>;
 //#endregion
-export { ANCHOR_PATTERN, type BlockAnchor, MAX_ANCHOR_LENGTH, MAX_MENU_DEPTH, MAX_MENU_TREE_NODES, type MenuEditorStateEntityType, type MenuEditorStateMenu, type MenuEditorStateResponse, type MenuItem, type MenuItemSummary, type MenuSchemaOptions, buildMenuItemSchema, buildMenuTreeSchema, measureMenuTree, menusRoutes, resolveMenuItemSummaries, validateTreeDepth };
+export { ANCHOR_PATTERN, type BlockAnchor, MAX_ANCHOR_LENGTH, MAX_MENU_DEPTH, MAX_MENU_TREE_NODES, MAX_RESOLVED_HANDLES, type MenuEditorStateEntityType, type MenuEditorStateMenu, type MenuEditorStateResponse, type MenuItem, type MenuItemSummary, type MenuSchemaOptions, type ResolvedMenusResponse, buildMenuItemSchema, buildMenuTreeSchema, measureMenuTree, menusRoutes, resolveMenuItemSummaries, validateTreeDepth };
 //# sourceMappingURL=admin.d.mts.map

package/dist/admin.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.mts","names":[],"sources":["../src/menu-item-schema.ts","../src/admin/editor-state.ts","../src/admin/routes.ts","../src/admin/summaries.ts"],"mappings":";;;;;;;;;cAkCa,cAAA;;;;AA4Fa;AAgB1B;;;cAhGa,mBAAA;;;;;;;;AAmHO;AAcpB;;;cAlGa,iBAAA;AAyHN;AAIP;;;;AAMgB;AAmHhB;AA7HO,cAtGM,cAAA,EAAc,MAAqB;;;;;;;;;;;;;;;;AAqOb;AAkDnC;;;;;;;;;KA5PY,aAAA;EACN,IAAA;EAAgB,MAAA;EAAgB,EAAA;EAAY,MAAA;AAAA;EAC5C,IAAA;EAAa,GAAA;AAAA;EACb,IAAA;EAAe,KAAA;AAAA;;AAoQV;AAYX;;;;AAAmE;AA0CnE;;;;AAAiE;;;KA1SrD,QAAA;ECrHK,yDDuHf,EAAA;EAEA,IAAA;ECxHA;;;;;;;;EDiIA,IAAA,GAAO,aAAA,cCtHI;EDwHX,KAAA,EAAO,MAAA,yBCpHiC;EDsHxC,OAAA,GAAU,MAAA;EACV,MAAA;EACA,QAAA,EAAU,QAAA;AAAA;;;;;;;;;;;;UAcK,eAAA;EC/HT;;;;;;EDsIN,KAAA;ECnIyB;EDqIzB,MAAA;ECpIA;EDsIA,SAAA;AAAA;;;;;;UAQe,WAAA;EC/Gb;EDiHF,MAAA;EChHW;EDkHX,KAAK;AAAA;;UAIU,iBAAA;EE6QD;;;;AAAyB;EFvQvC,cAAc;AAAA;;;;;;;iBAmHA,mBAAA,CACd,OAAA,EAAS,iBAAA,GACR,CAAA,CAAE,OAAA,CAAQ,QAAA,EAAU,CAAA,CAAE,UAAA;;iBAkDT,mBAAA,CACd,OAAA,EAAS,iBAAA,GACR,CAAA,CAAE,OAAA,CAAQ,QAAA,IAAY,CAAA,CAAE,UAAA;;UAKV,mBAAA;;EAEf,KAAA;;EAEA,SAAS;AAAA;;;;;;;;;;iBAYK,eAAA,CAAgB,IAAA,YAAgB,mBAAmB;;;;;;;iBA0CnD,iBAAA,CAAkB,IAAA,WAAe,QAAgB;;;;UC/ZhD,mBAAA;EACf,EAAA;EACA,MAAA;EACA,KAAA;EACA,QAAA;EACA,MAAA;EACA,IAAA,EAAM,QAAQ;ED6FsB;;;;;ECvFpC,WAAA;AAAA;ADyFwB;AAAA,UCrFT,yBAAA;EACf,IAAA;EACA,KAAK;AAAA;;UAIU,uBAAA;EACf,IAAA,EAAM,mBAAA;EDiHY;EC/GlB,SAAA,EAAW,QAAA,CAAS,MAAA,SAAe,eAAA;EACnC,OAAA,EAAS,aAAA;IAAgB,IAAA;IAAc,KAAA;EAAA;EACvC,aAAA;EDyGO;;;;;;;AAIW;AAcpB;ECjHE,gBAAA;EACA,WAAA,WAAsB,yBAAA;EACtB,UAAA;EDsHA;;;;AAIS;AAQX;;;;AAIO;AAIP;;;;AAMgB;EChId,KAAA;IACE,IAAA,EAAM,MAAA;IACN,SAAA;IACA,aAAA;IACA,SAAA;EAAA;AAAA;;;;;;;;ADsGO;AAQX;;;;AAIO;AAIP;;;iBE6QgB,WAAA,CAAA,GAAe,UAAU;;;;;;;;;;;;;;;;;;;;;iBC7WnB,wBAAA,CACpB,GAAA,EAAK,UAAA,EACL,IAAA,EAAM,aAAA;EAAgB,MAAA;EAAgB,EAAA;AAAA,KACrC,OAAA,CAAQ,GAAA,SAAY,eAAA"}
+{"version":3,"file":"admin.d.mts","names":[],"sources":["../src/menu-item-schema.ts","../src/admin/editor-state.ts","../src/admin/routes.ts","../src/admin/summaries.ts"],"mappings":";;;;;;;;;;cAkCa,cAAA;;;;;AA4Fa;AAgB1B;;cAhGa,mBAAA;;;;;;;;;AAmHO;AAcpB;;cAlGa,iBAAA;;AAyHN;AAIP;;;;AAMgB;cAhHH,cAAA,EAAc,MAAqB;;;;;;;;;;;;;;;;;AAqOb;AAkDnC;;;;;;;;KA5PY,aAAA;EACN,IAAA;EAAgB,MAAA;EAAgB,EAAA;EAAY,MAAA;AAAA;EAC5C,IAAA;EAAa,GAAA;AAAA;EACb,IAAA;EAAe,KAAA;AAAA;;;AAoQV;AAYX;;;;AAAmE;AA0CnE;;;;AAAiE;;KA1SrD,QAAA;2DAEV,EAAA,UCvHkC;EDyHlC,IAAA;ECnHc;;;;;;;;ED4Hd,IAAA,GAAO,aAAA,cCtHI;EDwHX,KAAA,EAAO,MAAA,yBCpHQ;EDsHf,OAAA,GAAU,MAAA;EACV,MAAA;EACA,QAAA,EAAU,QAAA;AAAA;AClHZ;;;;;;;;;;;AAAA,UDgIiB,eAAA;EC/Hf;;;;;;EDsIA,KAAA;ECnIS;EDqIT,MAAA;ECrIuC;EDuIvC,SAAA;AAAA;;;;;;UAQe,WAAA;EChHb;EDkHF,MAAA;EChHE;EDkHF,KAAK;AAAA;;UAIU,iBAAA;;AEqRjB;;;;EF/QE,cAAc;AAAA;;;;;;;iBAmHA,mBAAA,CACd,OAAA,EAAS,iBAAA,GACR,CAAA,CAAE,OAAA,CAAQ,QAAA,EAAU,CAAA,CAAE,UAAA;;iBAkDT,mBAAA,CACd,OAAA,EAAS,iBAAA,GACR,CAAA,CAAE,OAAA,CAAQ,QAAA,IAAY,CAAA,CAAE,UAAA;;UAKV,mBAAA;;EAEf,KAAA;;EAEA,SAAS;AAAA;;;;;;;;;;iBAYK,eAAA,CAAgB,IAAA,YAAgB,mBAAmB;;;;;;;iBA0CnD,iBAAA,CAAkB,IAAA,WAAe,QAAgB;;;;UC/ZhD,mBAAA;EACf,EAAA;EACA,MAAA;EACA,KAAA;EACA,QAAA;EACA,MAAA;EACA,IAAA,EAAM,QAAQ;ED6FM;;;;;ECvFpB,WAAA;AAAA;;UAIe,yBAAA;EACf,IAAA;EACA,KAAK;AAAA;;UAIU,uBAAA;EACf,IAAA,EAAM,mBAAA;EDiHI;EC/GV,SAAA,EAAW,QAAA,CAAS,MAAA,SAAe,eAAA;EACnC,OAAA,EAAS,aAAA;IAAgB,IAAA;IAAc,KAAA;EAAA;EACvC,aAAA;EDyGA;;;;;;;;AAIkB;ECnGlB,gBAAA;EACA,WAAA,WAAsB,yBAAA;EACtB,UAAA;ED+G8B;;;;;AAWrB;AAQX;;;;AAIO;AAIP;;;;EC1HE,KAAA;IACE,IAAA,EAAM,MAAA;IACN,SAAA;IACA,aAAA;IACA,SAAA;EAAA;AAAA;;;;ADsGO;AAQX;;;;AAIO;AAIP;;cEqRa,oBAAA;;UAYI,qBAAA;EAKf,KAAA,EAAO,MAAM,SAAS,mBAAA;AAAA;;;;;;;;;;;;;;;iBAmHR,WAAA,CAAA,GAAe,UAAU;;;;;;;;;;;;;;;;;;;;;iBCzfnB,wBAAA,CACpB,GAAA,EAAK,UAAA,EACL,IAAA,EAAM,aAAA;EAAgB,MAAA;EAAgB,EAAA;AAAA,KACrC,OAAA,CAAQ,GAAA,SAAY,eAAA"}

package/dist/admin.mjs

@@ -1,2 +1,2 @@
-import{sanitizeHref as e}from"@murumets-ee/blocks/links";import{z as t}from"zod";import{combineAdminRoutes as n,defineAdminRoute as r,getContext as i,getCurrentApp as a,getCurrentScope as o,siteSecurityFields as s}from"@murumets-ee/core";import{VIEW_UNPUBLISHED_ACTION as c,auditable as l,defineEntity as u,field as d,getBlockTreeFieldName as f,getEntityTitleField as p,getSearchableConfig as m,publishable as h}from"@murumets-ee/entity";import{QueryClient as g}from"@murumets-ee/entity/query";import{eq as _,inArray as v}from"drizzle-orm";import{getContentConfig as y}from"@murumets-ee/content/plugin";const b=6,x=500,S=128,C=/^[A-Za-z0-9_-]+$/,w=t.discriminatedUnion(`kind`,[t.object({kind:t.literal(`entity`),entity:t.string().min(1).max(64),id:t.string().uuid(),anchor:t.string().min(1).max(128).regex(C).optional()}),t.object({kind:t.literal(`url`),url:t.string().min(1).max(2048).transform(t=>e(t)).refine(e=>e!==``,{message:`link url uses a disallowed protocol (allowed: http, https, mailto, tel, or a relative path)`})}),t.object({kind:t.literal(`email`),email:t.string().email().max(254)})]);function T(e,n){let r=new Set(n);return t.unknown().superRefine((e,n)=>{if(typeof e!=`object`||!e||Array.isArray(e))return;let i=Object.keys(e);if(i.length>r.size){n.addIssue({code:t.ZodIssueCode.custom,message:`too many locale keys — configured locales are: ${[...r].join(`, `)}`});return}for(let e of i)r.has(e)||n.addIssue({code:t.ZodIssueCode.custom,path:[e],message:`unknown locale key — configured locales are: ${[...r].join(`, `)}`})}).pipe(t.record(t.string(),e))}function E(e){let n=T(t.string().max(200),e.allowedLocales),r=T(t.boolean(),e.allowedLocales),i=t.lazy(()=>t.object({id:t.string().min(1).max(64),kind:t.enum([`link`,`header`]),link:w.optional(),label:n.nullable().default(null),enabled:r.optional(),newTab:t.boolean().optional(),children:t.array(i).default([])}).superRefine((e,n)=>{if(e.kind===`link`){e.link===void 0&&n.addIssue({code:t.ZodIssueCode.custom,path:[`link`],message:`a link item requires a link target`});return}e.link!==void 0&&n.addIssue({code:t.ZodIssueCode.custom,path:[`link`],message:`a header item must not carry a link target`}),(e.label===null||Object.keys(e.label).length===0)&&n.addIssue({code:t.ZodIssueCode.custom,path:[`label`],message:`a header item requires a label for at least one locale`})}));return i}function D(e){return t.array(E(e))}function O(e){if(!Array.isArray(e))return{depth:0,nodeCount:0};let t=0,n=0,r=e.map(e=>({node:e,depth:1}));for(;r.length>0;){let e=r.pop();if(e===void 0)break;let{node:i,depth:a}=e;if(typeof i!=`object`||!i||Array.isArray(i))continue;if(n++,a>t&&(t=a),n>500||t>6)return{depth:t,nodeCount:n};let o=i.children;if(Array.isArray(o)){let e=o;for(let t of e)r.push({node:t,depth:a+1})}}return{depth:t,nodeCount:n}}function ee(e,t){return O(e).depth<=t}const k=t.string().min(1).max(64),te=t.array(k).max(64).nullable().transform(e=>{if(e===null)return null;let t=[...new Set(e)];return t.length===0?null:t});function ne(e){if(!Array.isArray(e))return null;let t=e,n=[],r=new Set;for(let e of t)if(!(typeof e!=`string`||e.length===0)&&!(e.length>64)&&!r.has(e)&&(r.add(e),n.push(e),n.length===64))break;return n.length===0?null:n}function A(e){if(e.keys.includes(`entityTypes`))throw new t.ZodError([{code:`custom`,path:[`entityTypes`],message:`bulk update on '${e.entityName}' cannot write 'entityTypes': updateMany runs no per-row hooks, so the whitelist would bypass its schema check. A whitelist is per-menu — update each row individually, or write a migration for a one-off backfill.`}])}function re(e){return new t.ZodError(e.issues.map(e=>({...e,path:[`entityTypes`,...e.path]})))}function j(e){if(!(`entityTypes`in e))return e;let t=te.safeParse(e.entityTypes);if(!t.success)throw re(t.error);return{...e,entityTypes:t.data}}function M(){return{name:`menuEntityTypesValidation`,hooks:{beforeCreate:async e=>j(e),beforeUpdate:async(e,t)=>j(t)},assertBulkUpdate:A}}function N(e,n=[]){return new t.ZodError([{code:t.ZodIssueCode.custom,path:[`tree`,...n],message:e}])}function P(e){return new t.ZodError(e.issues.map(e=>({...e,path:[`tree`,...e.path]})))}function F(e){if(!(typeof e!=`number`||!Number.isInteger(e))&&!(e<1||e>6))return e}async function I(e,t,n){let r=F(e.maxDepth);if(r!==void 0)return r;if(!n)return 3;if(!t?.loadCurrent)throw Error(`menu: BehaviorContext.loadCurrent is unavailable — cannot validate the tree against the menu's maxDepth. Writes must go through AdminClient.update.`);return F((await t.loadCurrent())?.maxDepth)??3}async function L(e,t){let n=F(e.maxDepth);if(n===void 0)return;if(!t?.loadCurrent)throw Error(`menu: BehaviorContext.loadCurrent is unavailable — cannot validate the stored tree against the new maxDepth. Writes must go through AdminClient.update.`);let{depth:r}=O((await t.loadCurrent())?.tree);if(r>n)throw N(`the stored menu tree is nested ${r} levels deep, deeper than this menu's new maxDepth (${n}) — flatten the tree first`)}async function R(e,t,n,r){let i=e.tree;if(i===void 0)return n&&await L(e,t),e;if(i===null||!Array.isArray(i))throw N(`menu tree must be an array of menu items`);let{depth:a,nodeCount:o}=O(i);if(o>500)throw N(`menu tree has too many items (max 500)`);if(a>6)throw N(`menu tree is nested too deeply (absolute max 6 levels)`);let s=D({allowedLocales:r()}).safeParse(i);if(!s.success)throw P(s.error);let c=await I(e,t,n);if(a>c)throw N(`menu tree is nested deeper than this menu's maxDepth (${c})`);return{...e,tree:s.data}}function ie(e){let t=e?.resolveAllowedLocales??(()=>y().locales.map(e=>e.code));return{name:`menuTreeValidation`,hooks:{beforeCreate:async(e,n)=>R(e,n,!1,t),beforeUpdate:async(e,n,r)=>R(n,r,!0,t)}}}const z=u({name:`menu`,site:`bound`,admin:{label:`Menus`,icon:`menu`},fields:{handle:d.slug({from:`title`}),title:d.text({required:!0}),maxDepth:d.number({default:3,min:1,max:6,integer:!0}),tree:d.json({refScan:!0,default:[]}),entityTypes:d.json({default:null})},behaviors:[l(),h(),ie(),M()],scope:`global`,access:{view:`public`,create:`group.admin`,update:`group.admin`,delete:`group.admin`}});function B(e,t){return e[t]}function V(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function H(e,t){if(!V(e))return;let n={};for(let[r,i]of Object.entries(e))t(i)&&(n[r]=i);return n}const U=e=>typeof e==`string`,W=e=>typeof e==`boolean`;function G(e){let t=500,n=0;function r(e,i){if(!Array.isArray(e))return[];let a=e;if(i>6)return n+=a.length,[];let o=[];for(let e of a){if(!V(e)){n++;continue}let a=e.id,s=e.kind;if(typeof a!=`string`||a.length===0){n++;continue}if(s!==`link`&&s!==`header`){n++;continue}let c;if(s===`link`){let t=w.safeParse(e.link);if(!t.success){n++;continue}c=t.data}else if(e.link!==void 0){n++;continue}if(t<=0){n++;continue}t--;let l=H(e.label,U),u=l!==void 0&&Object.keys(l).length>0?l:void 0,d=H(e.enabled,W),f=d!==void 0&&Object.keys(d).length>0?d:void 0;o.push({id:a,kind:s,link:c,label:u??null,enabled:f,newTab:typeof e.newTab==`boolean`?e.newTab:void 0,children:r(e.children,i+1)})}return o}return{items:r(e,1),dropped:n}}function K(e){let t=new Set,n=[];function r(e){for(let i of e){let e=i.link;if(e?.kind===`entity`){let r=`${e.entity}:${e.id}`;t.has(r)||(t.add(r),n.push({entity:e.entity,id:e.id}))}r(i.children)}}return r(e),n}const q=1e3;function J(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function ae(e){let t=e.props;if(!J(t))return;let n=t.anchor;if(typeof n!=`string`||n.length===0||n.length>128||!C.test(n))return;let r=t.anchorLabel;return{anchor:n,label:typeof r==`string`&&r.length>0&&r.length<=200?r:n}}function oe(e,t){let n=[];if(!Array.isArray(e))return{anchors:n,truncated:!1,visited:0};let r=e,i=0,a=!1;r.length>1e3&&(a=!0);let o=[];for(let e=Math.min(r.length,q)-1;e>=0;e--)o.push(r[e]);for(;o.length>0;){if(i>=1e3||n.length>=200){a=!0;break}let e=o.pop();if(i++,!J(e))continue;let t=ae(e);t!==void 0&&n.push(t);let r=e.children;if(Array.isArray(r)){let e=r,t=Math.max(q-i,0);e.length>t&&(a=!0);for(let n=Math.min(e.length,t)-1;n>=0;n--)o.push(e[n])}}return a&&t?.warn({visited:i,collected:n.length,nodeBudget:q,resultCap:200},`anchor collection stopped at a hard bound — the returned list is incomplete`),{anchors:n,truncated:a,visited:i}}function Y(e,t){return`${e}:${t}`}const se={title:null,exists:!1,published:null};function ce(e){let t=new Map,n=0,r=0;for(let i of e){if(typeof i.entity!=`string`||typeof i.id!=`string`||i.entity.length===0||i.id.length===0)continue;let e=t.get(i.entity);if(!e?.has(i.id)){if(n>=500){r++;continue}n++,e?e.add(i.id):t.set(i.entity,new Set([i.id]))}}let i=Math.max(0,t.size-16);return{groups:t,droppedRefs:r,droppedGroups:i}}async function X(e,t){let n=new Map;if(t.length===0)return n;let r=e.logger.child({resolve:`menu-item-summaries`}),{groups:i,droppedRefs:a,droppedGroups:o}=ce(t);return a>0&&r.warn({dropped:a,cap:500},`menu item summaries dropped targets over the ref budget — some rows will show no status`),o>0&&r.warn({dropped:o,cap:16},`menu item summaries dropped entity-type groups over the fan-out cap`),await Promise.all([...i.entries()].slice(0,16).map(([t,i])=>le(e,r,t,i,n))),n}async function le(e,t,n,r,i){let a=e.entities.get(n);if(a===void 0)return;let o=p(a),s=o!==`id`,c=a.behaviors?.some(e=>e.name===`publishable`)??!1,l=[...r];try{let t=e.getClient(a),r=await t.findMany({where:v(B(t.getTable(),`id`),l),limit:l.length}),u=new Set;for(let e of r){let t=e,r=t.id;if(typeof r!=`string`)continue;let a=s?t[o]:void 0;u.add(r),i.set(Y(n,r),{title:typeof a==`string`&&a.length>0?a:null,exists:!0,published:c?t.status===`published`:null})}if((a.scope??`global`)===`global`)for(let e of l)u.has(e)||i.set(Y(n,e),se)}catch(e){t.warn({entity:n,count:l.length,error:String(e)},`menu item summaries could not be resolved for this entity type`)}}const ue=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function Z(e,t=200){return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":`application/json`}})}function Q(e,t){return Z({error:e},t)}function $(){return Z([])}function de(e){return f(e)??null}const fe=r({prefix:`menus`,path:`anchors`,method:`GET`,permission:`menu:view`,defaultRoles:[`admin`],description:`List a published document's addressable block anchors for the menu editor's anchor picker.`,handler:async(e,t)=>{let n=new URL(e.url).searchParams,r=n.get(`entity`),i=n.get(`id`);if(r===null||r.length===0)return Q(`query param 'entity' is required`,400);if(r.length>64)return Q(`query param 'entity' is too long`,400);if(i===null||!ue.test(i))return Q(`query param 'id' must be a uuid`,400);let l=a();if(l===void 0)return Q(`Internal error`,500);let u=l.logger.child({route:`menus/anchors`,entity:r});if(!t.checkPermission(r,`view`))return u.debug({userId:t.user.id,role:t.user.role},`anchors lookup returned empty — caller holds no view grant on the target entity`),$();let d=l.entities.get(r);if(d===void 0)return $();let f=de(d);if(f===null)return $();let p=o(),m=await new g({entity:d,db:l.db.readOnly,logger:u,contextResolver:()=>({user:{id:t.user.id,groups:[t.user.role??`viewer`]},checker:(e,n,r)=>r!==c&&t.checkPermission(n,r),...p!==void 0&&{scope:p},...s(void 0,l)})}).findById(i,{...t.locale!==void 0&&{locale:t.locale},...t.defaultLocale!==void 0&&{defaultLocale:t.defaultLocale}});if(m===null)return $();let{anchors:h}=oe(m[f],u);return Z(h)}}),pe=async(e,t)=>{let n=new URL(e.url).searchParams.get(`handle`);if(n===null||n.length===0)return Q(`query param 'handle' is required`,400);if(n.length>128)return Q(`query param 'handle' is too long`,400);let r=a();if(r===void 0)return Q(`Internal error`,500);let o=r.logger.child({route:`menus/editor-state`}),s=r.getClient(z),c=(await s.findMany({where:_(B(s.getTable(),`handle`),n),limit:1}))[0];if(c===void 0)return Q(`Menu not found`,404);let l=c.id,u=typeof c.title==`string`?c.title:``,d=c.maxDepth,f=typeof d==`number`&&Number.isInteger(d)&&d>=1?Math.min(d,6):3,p=c.status===`published`?`published`:`draft`,h=i()?.availableLocales,g=t.defaultLocale??h?.[0]??`en`,v=h&&h.length>0?[...h]:[],y=(v.includes(g)?v:[g,...v]).map(e=>({code:e,label:e})),b=await me(r,l,o),x=b?.data,{items:S,dropped:C}=G(x!==void 0&&`tree`in x?x.tree:c.tree);C>0&&o.warn({menuId:l,handle:n,dropped:C},`menu editor-state: stored tree contained items that could not be read — the embedded editor shows the rest`);let w=await X(r,K(S)),T=Object.fromEntries(w),E=[...r.entities.values()].filter(e=>m(e)!==void 0&&t.checkPermission(e.name,`view`)).map(e=>({name:e.name,label:e.admin?.labelSingular??e.admin?.label??e.name})),D=t.checkPermission(`menu`,`publish`);return Z({menu:{id:l,handle:n,title:u,maxDepth:f,status:p,tree:S,entityTypes:ne(x!==void 0&&`entityTypes`in x?x.entityTypes:c.entityTypes)},summaries:T,locales:y,defaultLocale:g,droppedItemCount:C,entityTypes:E,canPublish:D,...b!==void 0&&{draft:b}})};async function me(e,t,n){try{let{ContentClient:n}=await import(`@murumets-ee/content/client`),r=await new n({admin:e.getClient(z),entity:z}).getDraft(t,`_`);return r?{data:r.data,createdBy:r.createdBy,createdByName:r.createdByName,updatedAt:r.updatedAt instanceof Date?r.updatedAt.toISOString():String(r.updatedAt)}:void 0}catch(e){n.warn({err:e,menuId:t},`menu editor-state: draft state unavailable — continuing without`);return}}const he=r({prefix:`menus`,path:`editor-state`,method:`GET`,permission:`menu:view`,defaultRoles:[`admin`],description:`Read a menu's full tree + editor metadata by handle, for the blocks editor's in-place Tier 3 menu surface.`,handler:pe});function ge(){return n([fe,he])}export{C as ANCHOR_PATTERN,S as MAX_ANCHOR_LENGTH,b as MAX_MENU_DEPTH,x as MAX_MENU_TREE_NODES,E as buildMenuItemSchema,D as buildMenuTreeSchema,O as measureMenuTree,ge as menusRoutes,X as resolveMenuItemSummaries,ee as validateTreeDepth};
+import{a as e,c as t,d as n,f as r,i,l as a,n as o,o as s,r as c,s as l,t as u,u as d}from"./columns-D9y6Mvcp.mjs";import{resolveLinkHref as f}from"@murumets-ee/blocks/links";import{z as p}from"zod";import{combineAdminRoutes as m,defineAdminRoute as h,getContext as g,getCurrentApp as _,getCurrentScope as v,siteSecurityFields as y}from"@murumets-ee/core";import{VIEW_UNPUBLISHED_ACTION as b,getBlockTreeFieldName as x,getEntityTitleField as S,getSearchableConfig as C}from"@murumets-ee/entity";import{QueryClient as w}from"@murumets-ee/entity/query";import{eq as ee,inArray as T}from"drizzle-orm";function E(e,t,n){if(typeof e!=`object`||!e||Array.isArray(e))return;let r=e;for(let e of t===n?[t]:[t,n]){if(!Object.hasOwn(r,e))continue;let t=r[e];if(typeof t==`string`&&t.length>0)return t}}function D(e,t){if(typeof e!=`object`||!e||Array.isArray(e))return;let n=e;if(!Object.hasOwn(n,t))return;let r=n[t];return typeof r==`boolean`?r:void 0}function O(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function k(t,n,r,i){let a=new Map,o=new Map,s=500,c=0;function l(e,t,n){let r=e.get(t);r?r.add(n):e.set(t,new Set([n]))}function u(t,d){if(d>i||!Array.isArray(t))return[];let f=t,p=[];for(let t of f){if(s<=0){c++;continue}if(!O(t))continue;let i=t.id,f=t.kind;if(typeof i!=`string`||i.length===0||f!==`link`&&f!==`header`||D(t.enabled,n)===!1)continue;s--;let m;if(f===`link`){let n=e.safeParse(t.link);if(!n.success)continue;m=n.data}else if(t.link!==void 0)continue;let h=u(t.children,d+1);m?.kind===`entity`&&(l(a,m.entity,m.id),E(t.label,n,r)===void 0&&l(o,m.entity,m.id)),p.push({id:i,kind:f,link:m,label:t.label,newTab:t.newTab===!0,children:h})}return p}return{nodes:u(t,1),idsByType:a,titleIdsByType:o,droppedForBudget:c}}async function A(e,t,n,r){let i=new Map,a=new Map,o=new Map,s=[...e.idsByType.entries()];return s.length>16&&n.logger?.warn({handle:r,locale:t,entityTypes:s.length,cap:16},`menu resolution dropped entity-type groups over the fan-out cap`),await Promise.all(s.slice(0,16).map(async([r,s])=>{let c=[...s],l=await n.resolveCanonicalPaths(r,c,t);if(i.set(r,l),l.size===0)return;let u=[...l.keys()],d=await n.filterPublished(r,u,t);a.set(r,d);let f=e.titleIdsByType.get(r);if(f===void 0)return;let p=u.filter(e=>f.has(e)&&d.has(e));p.length!==0&&o.set(r,await n.resolveTitles(r,p,t))})),{paths:i,published:a,titles:o}}function j(e,t,n,r){let i=[];for(let a of e){let e=j(a.children,t,n,r),o=E(a.label,t,r.defaultLocale);if(a.kind===`header`){if(e.length===0||o===void 0)continue;i.push({id:a.id,kind:`header`,label:o,href:null,newTab:!1,isActive:!1,inActiveTrail:!1,children:e});continue}let s=a.link;if(s===void 0)continue;let c,l=o;if(s.kind===`entity`){let e=n.paths.get(s.entity)?.get(s.id);if(e===void 0||n.published.get(s.entity)?.has(s.id)!==!0)continue;c=s.anchor===void 0?e:`${e}#${s.anchor}`,l??=n.titles.get(s.entity)?.get(s.id)}else c=f(s);c===null||c.length===0||l===void 0||l.length===0||i.push({id:a.id,kind:`link`,label:l,href:c,newTab:a.newTab,isActive:!1,inActiveTrail:!1,children:e})}return i}function M(e){let t=e.indexOf(`#`),n=t===-1?e:e.slice(0,t);return n.length>1&&n.endsWith(`/`)?n.slice(0,-1):n}function N(e,t){let n=!1;return{items:e.map(e=>{let r=N(e.children,t),i=e.href!==null&&M(e.href)===t,a=r.containsActive;return(i||a)&&(n=!0),{...e,isActive:i,inActiveTrail:a,children:r.items}}),containsActive:n}}function P(e,t){return{...e,items:N(e.items,M(t)).items}}async function F(e,t,n){if(e.length===0||e.length>128)return null;let r=await n.getMenuRow(e);if(r===null)return null;let i=r.maxDepth,a=typeof i==`number`&&Number.isInteger(i)&&i>=1?Math.min(i,6):3,o=k(r.tree,t.locale,n.defaultLocale,a);o.droppedForBudget>0&&n.logger?.warn({handle:e,locale:t.locale,dropped:o.droppedForBudget,cap:500},`menu resolution dropped items over the node budget`);let s=await A(o,t.locale,n,e),c={handle:e,items:j(o.nodes,t.locale,s,n)};return t.currentPath===void 0?c:P(c,t.currentPath)}function I(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function L(e,t){if(!I(e))return;let n={};for(let[r,i]of Object.entries(e))t(i)&&(n[r]=i);return n}const te=e=>typeof e==`string`,ne=e=>typeof e==`boolean`;function R(t){let n=500,r=0;function i(t,a){if(!Array.isArray(t))return[];let o=t;if(a>6)return r+=o.length,[];let s=[];for(let t of o){if(!I(t)){r++;continue}let o=t.id,c=t.kind;if(typeof o!=`string`||o.length===0){r++;continue}if(c!==`link`&&c!==`header`){r++;continue}let l;if(c===`link`){let n=e.safeParse(t.link);if(!n.success){r++;continue}l=n.data}else if(t.link!==void 0){r++;continue}if(n<=0){r++;continue}n--;let u=L(t.label,te),d=u!==void 0&&Object.keys(u).length>0?u:void 0,f=L(t.enabled,ne),p=f!==void 0&&Object.keys(f).length>0?f:void 0;s.push({id:o,kind:c,link:l,label:d??null,enabled:p,newTab:typeof t.newTab==`boolean`?t.newTab:void 0,children:i(t.children,a+1)})}return s}return{items:i(t,1),dropped:r}}function z(e){let t=new Set,n=[];function r(e){for(let i of e){let e=i.link;if(e?.kind===`entity`){let r=`${e.entity}:${e.id}`;t.has(r)||(t.add(r),n.push({entity:e.entity,id:e.id}))}r(i.children)}}return r(e),n}const B=1e3;function V(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function H(e){let t=e.props;if(!V(t))return;let n=t.anchor;if(typeof n!=`string`||n.length===0||n.length>128||!i.test(n))return;let r=t.anchorLabel;return{anchor:n,label:typeof r==`string`&&r.length>0&&r.length<=200?r:n}}function U(e,t){let n=[];if(!Array.isArray(e))return{anchors:n,truncated:!1,visited:0};let r=e,i=0,a=!1;r.length>1e3&&(a=!0);let o=[];for(let e=Math.min(r.length,B)-1;e>=0;e--)o.push(r[e]);for(;o.length>0;){if(i>=1e3||n.length>=200){a=!0;break}let e=o.pop();if(i++,!V(e))continue;let t=H(e);t!==void 0&&n.push(t);let r=e.children;if(Array.isArray(r)){let e=r,t=Math.max(B-i,0);e.length>t&&(a=!0);for(let n=Math.min(e.length,t)-1;n>=0;n--)o.push(e[n])}}return a&&t?.warn({visited:i,collected:n.length,nodeBudget:B,resultCap:200},`anchor collection stopped at a hard bound — the returned list is incomplete`),{anchors:n,truncated:a,visited:i}}function W(e,t){return`${e}:${t}`}const G={title:null,exists:!1,published:null};function K(e){let t=new Map,n=0,r=0;for(let i of e){if(typeof i.entity!=`string`||typeof i.id!=`string`||i.entity.length===0||i.id.length===0)continue;let e=t.get(i.entity);if(!e?.has(i.id)){if(n>=500){r++;continue}n++,e?e.add(i.id):t.set(i.entity,new Set([i.id]))}}let i=Math.max(0,t.size-16);return{groups:t,droppedRefs:r,droppedGroups:i}}async function q(e,t){let n=new Map;if(t.length===0)return n;let r=e.logger.child({resolve:`menu-item-summaries`}),{groups:i,droppedRefs:a,droppedGroups:o}=K(t);return a>0&&r.warn({dropped:a,cap:500},`menu item summaries dropped targets over the ref budget — some rows will show no status`),o>0&&r.warn({dropped:o,cap:16},`menu item summaries dropped entity-type groups over the fan-out cap`),await Promise.all([...i.entries()].slice(0,16).map(([t,i])=>J(e,r,t,i,n))),n}async function J(e,t,n,r,i){let a=e.entities.get(n);if(a===void 0)return;let o=S(a),s=o!==`id`,c=a.behaviors?.some(e=>e.name===`publishable`)??!1,l=[...r];try{let t=e.getClient(a),r=await t.findMany({where:T(u(t.getTable(),`id`),l),limit:l.length}),d=new Set;for(let e of r){let t=e,r=t.id;if(typeof r!=`string`)continue;let a=s?t[o]:void 0;d.add(r),i.set(W(n,r),{title:typeof a==`string`&&a.length>0?a:null,exists:!0,published:c?t.status===`published`:null})}if((a.scope??`global`)===`global`)for(let e of l)d.has(e)||i.set(W(n,e),G)}catch(e){t.warn({entity:n,count:l.length,error:String(e)},`menu item summaries could not be resolved for this entity type`)}}const Y=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;function X(e,t=200){return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":`application/json`}})}function Z(e,t){return X({error:e},t)}function Q(){return X([])}function re(e){return x(e)??null}const ie=h({prefix:`menus`,path:`anchors`,method:`GET`,permission:`menu:view`,defaultRoles:[`admin`],description:`List a published document's addressable block anchors for the menu editor's anchor picker.`,tokens:`accept`,handler:async(e,t)=>{let n=new URL(e.url).searchParams,r=n.get(`entity`),i=n.get(`id`);if(r===null||r.length===0)return Z(`query param 'entity' is required`,400);if(r.length>64)return Z(`query param 'entity' is too long`,400);if(i===null||!Y.test(i))return Z(`query param 'id' must be a uuid`,400);let a=_();if(a===void 0)return Z(`Internal error`,500);let o=a.logger.child({route:`menus/anchors`,entity:r});if(!t.checkPermission(r,`view`))return o.debug({userId:t.user.id,role:t.user.role},`anchors lookup returned empty — caller holds no view grant on the target entity`),Q();let s=a.entities.get(r);if(s===void 0)return Q();let c=re(s);if(c===null)return Q();let l=v(),u=await new w({entity:s,db:a.db.readOnly,logger:o,contextResolver:()=>({user:{id:t.user.id,groups:[t.user.role??`viewer`]},checker:(e,n,r)=>r!==b&&t.checkPermission(n,r),...l!==void 0&&{scope:l},...y(void 0,a)})}).findById(i,{...t.locale!==void 0&&{locale:t.locale},...t.defaultLocale!==void 0&&{defaultLocale:t.defaultLocale}});if(u===null)return Q();let{anchors:d}=U(u[c],o);return X(d)}}),ae=async(e,t)=>{let n=new URL(e.url).searchParams.get(`handle`);if(n===null||n.length===0)return Z(`query param 'handle' is required`,400);if(n.length>128)return Z(`query param 'handle' is too long`,400);let r=_();if(r===void 0)return Z(`Internal error`,500);let i=r.logger.child({route:`menus/editor-state`}),a=r.getClient(o),s=(await a.findMany({where:ee(u(a.getTable(),`handle`),n),limit:1}))[0];if(s===void 0)return Z(`Menu not found`,404);let l=s.id,d=typeof s.title==`string`?s.title:``,f=s.maxDepth,p=typeof f==`number`&&Number.isInteger(f)&&f>=1?Math.min(f,6):3,m=s.status===`published`?`published`:`draft`,h=g()?.availableLocales,v=t.defaultLocale??h?.[0]??`en`,y=h&&h.length>0?[...h]:[],b=(y.includes(v)?y:[v,...y]).map(e=>({code:e,label:e})),x=await oe(r,l,i),S=x?.data,{items:w,dropped:T}=R(S!==void 0&&`tree`in S?S.tree:s.tree);T>0&&i.warn({menuId:l,handle:n,dropped:T},`menu editor-state: stored tree contained items that could not be read — the embedded editor shows the rest`);let E=await q(r,z(w)),D=Object.fromEntries(E),O=[...r.entities.values()].filter(e=>C(e)!==void 0&&t.checkPermission(e.name,`view`)).map(e=>({name:e.name,label:e.admin?.labelSingular??e.admin?.label??e.name})),k=t.checkPermission(`menu`,`publish`);return X({menu:{id:l,handle:n,title:d,maxDepth:p,status:m,tree:w,entityTypes:c(S!==void 0&&`entityTypes`in S?S.entityTypes:s.entityTypes)},summaries:D,locales:b,defaultLocale:v,droppedItemCount:T,entityTypes:O,canPublish:k,...x!==void 0&&{draft:x}})};async function oe(e,t,n){try{let{ContentClient:n}=await import(`@murumets-ee/content/client`),r=await new n({admin:e.getClient(o),entity:o}).getDraft(t,`_`);return r?{data:r.data,createdBy:r.createdBy,createdByName:r.createdByName,updatedAt:r.updatedAt instanceof Date?r.updatedAt.toISOString():String(r.updatedAt)}:void 0}catch(e){n.warn({err:e,menuId:t},`menu editor-state: draft state unavailable — continuing without`);return}}const $=h({prefix:`menus`,path:`editor-state`,method:`GET`,permission:`menu:view`,defaultRoles:[`admin`],description:`Read a menu's full tree + editor metadata by handle, for the blocks editor's in-place Tier 3 menu surface.`,tokens:`accept`,handler:ae}),se=8,ce=p.object({handles:p.array(p.string().min(1).max(128)).min(1).max(8)}),le=h({prefix:`menus`,path:`resolved`,method:`GET`,permission:`blocks:read-editor-state`,defaultRoles:[`admin`,`editor`],description:`Read the published, resolved items of the menus an editing canvas names, by handle.`,tokens:`accept`,handler:async(e,t)=>{let n=ce.safeParse({handles:[...new Set(new URL(e.url).searchParams.getAll(`handle`))]});if(!n.success)return Z(`query param 'handle' must be given 1 to 8 times, each 1 to 128 characters`,400);let{handles:r}=n.data,i=_();if(i===void 0)return Z(`Internal error`,500);let a=i.logger.child({route:`menus/resolved`}),{buildMenuResolveDeps:o}=await import(`./menu-resolve-context-2s6VJs_m.mjs`),s=o(i),c=t.locale??t.defaultLocale??s.defaultLocale,l=await Promise.all(r.map(async e=>{try{let t=await F(e,{locale:c},s);return[e,t===null?null:t.items]}catch(t){a.warn({err:t,handle:e,locale:c},`menu failed to resolve for the canvas; it is left out of the answer`);return}}));return X({menus:Object.fromEntries(l.filter(e=>e!==void 0))})}});function ue(){return m([ie,$,le])}export{i as ANCHOR_PATTERN,s as MAX_ANCHOR_LENGTH,l as MAX_MENU_DEPTH,t as MAX_MENU_TREE_NODES,se as MAX_RESOLVED_HANDLES,a as buildMenuItemSchema,d as buildMenuTreeSchema,n as measureMenuTree,ue as menusRoutes,q as resolveMenuItemSummaries,r as validateTreeDepth};
 //# sourceMappingURL=admin.mjs.map

package/dist/admin.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"admin.mjs","names":["MAX_ENTITY_NAME_LENGTH","roots","prefixIssues","isPlainObject","record"],"sources":["../src/menu-item-schema.ts","../src/menu-entity-types.ts","../src/behaviors/menu-entity-types-validation.ts","../src/behaviors/menu-tree-validation.ts","../src/entity.ts","../src/internal/columns.ts","../src/menu-tree-normalize.ts","../src/admin/anchors.ts","../src/admin/summaries.ts","../src/admin/routes.ts"],"sourcesContent":["/**\n * `MenuItem` — the menu tree node — and its recursive Zod validation\n * (plan/routing phase 08 §3).\n *\n * A menu's `tree` column is ordered nested JSONB (D008), so the ONLY thing\n * standing between an admin PATCH and the database is this schema: it is the\n * boundary validation required by CLAUDE.md's C5. It enforces\n *\n * - the `kind`-conditional shape (`link` items carry a `LinkValue`, `header`\n *   items carry a label map and no link),\n * - locale keys drawn from the app's configured locale set,\n * - `LinkValue`s that mirror `@murumets-ee/blocks`' union exactly, with `url`\n *   kinds protocol-gated through the SAME `sanitizeHref` allowlist the link\n *   picker uses (no `javascript:` / `data:` / protocol-relative smuggling),\n * - hard structural bounds on tree size + nesting, checked BEFORE the\n *   recursive parse so a hostile payload can't turn validation itself into a\n *   stack-overflow / CPU amplification vector.\n *\n * This module is deliberately **pure**: no `@murumets-ee/core`, no content\n * plugin lookup, no DB. The allowed-locale set is passed IN, so the schema can\n * be built server-side (the `menuTreeValidation()` behavior) or client-side\n * (PR10's editor, with locales handed down from the server) from the same code.\n * Cross-field depth validation against the entity's sibling `maxDepth` column\n * lives in {@link validateTreeDepth}, which the behavior calls separately.\n */\n\nimport { sanitizeHref } from '@murumets-ee/blocks/links'\nimport { z } from 'zod'\n\n/**\n * Absolute nesting cap for any menu, independent of a menu's own `maxDepth`\n * (phase 07 §2.7 — \"depth is capped per menu (default 3, max 6)\"). Also the\n * bound that keeps the recursive parse from being a DoS vector.\n */\nexport const MAX_MENU_DEPTH = 6\n\n/** `maxDepth`'s default — a 3-level menu (phase 08 §2). */\nexport const DEFAULT_MENU_DEPTH = 3\n\n/**\n * Upper bound on the number of nodes in one menu tree. Navigation menus are\n * hand-curated: a few dozen items is a big one. The cap exists so a single\n * PATCH can't hand the validator (and `extractRefs`' ref walk, and every\n * subsequent render) an unbounded amount of work — CLAUDE.md's\n * \"no unbounded fan-out\" rule applied to a single request payload.\n */\nexport const MAX_MENU_TREE_NODES = 500\n\n/**\n * Max stored length of a `url`-kind link. Pinned to `entity`'s\n * `MAX_EXTERNAL_URL_LENGTH` (the `external_link_usage.url_raw` column width)\n * at COMPILE time via `satisfies` + a type-only import — so a longer URL is\n * rejected at the boundary instead of being silently dropped from the\n * reference graph. Same drift-proofing trick as content's\n * `DEFAULT_LOCALE_SENTINEL`; `import type` has zero runtime cost, so the pure\n * schema module keeps its (client-safe) dependency-free shape.\n */\nexport const MAX_MENU_URL_LENGTH =\n  2048 satisfies typeof import('@murumets-ee/entity/refs')['MAX_EXTERNAL_URL_LENGTH']\n\n/** Max length of an item's stable id (a UUID today; generated client-side). */\nconst MAX_ITEM_ID_LENGTH = 64\n\n/** Max length of a per-locale label string. */\nconst MAX_LABEL_LENGTH = 200\n\n/**\n * Max length of an entity-link fragment/anchor.\n *\n * Exported because this module is the SINGLE OWNER of the anchor bounds: the\n * write-side schema below, the read-side anchor walk\n * (`admin/anchors.ts`) and the editor's manual-entry fallback\n * (`@murumets-ee/menus-ui`'s anchor picker, via the client-safe `./schema`\n * subpath) all validate against exactly these two constants. Two of those three\n * used to carry their own copy; a drift between them would let the picker offer\n * — or the editor accept — a value the write boundary then rejects.\n */\nexport const MAX_ANCHOR_LENGTH = 128\n\n/**\n * Max length of an entity NAME inside an entity link (`page`, `article`, …).\n *\n * Exported for the same single-owner reason as {@link MAX_ANCHOR_LENGTH}: the\n * per-menu `entityTypes` whitelist (`./menu-entity-types.ts`) stores values of\n * exactly this kind, and a second copy of the bound could drift into a\n * whitelist entry the link schema then refuses.\n */\nexport const MAX_ENTITY_NAME_LENGTH = 64\n\n/**\n * Anchors are slugified by the block editor (phase 08 §5) and rendered into an\n * `href` as `#<anchor>`; restricting them to slug characters keeps that\n * interpolation inert.\n *\n * Exported for the same single-owner reason as {@link MAX_ANCHOR_LENGTH}.\n */\nexport const ANCHOR_PATTERN = /^[A-Za-z0-9_-]+$/\n\n/**\n * A menu item's link target — the item-type union phase 07 §2.2 and phase 08 §3\n * define: `entity` (+ optional anchor) | `url` | `email`.\n *\n * **A NARROWED SUBSET of `@murumets-ee/blocks`' `LinkValue`, deliberately.**\n * Blocks additionally carries a `media` kind; menus does NOT, because no phase\n * gives a menu a media-href seam to resolve one with (phase 11 §2 specifies\n * `href` as \"canonical path from `toolkit_paths`; external URLs verbatim;\n * header items null\" and nothing else). Accepting a `media` link would let it\n * validate, persist, and register an `entity_refs` row — arming delete\n * protection for that file — while the renderer had no way to emit it: the item\n * would silently never appear. Rejecting it at the write boundary turns that\n * dead weight into a real 400. Widening later is additive (an arm here plus a\n * `resolveMediaHref` dep on `MenuResolveDeps`) and needs no shape change.\n *\n * Every `MenuLinkValue` IS a valid blocks `LinkValue` (the subset direction, and\n * the one `resolveLinkHref` needs) — pinned at compile time by an assignment in\n * `menu-item-schema.test.ts`, so a drift in blocks' union is a build error\n * rather than a silent divergence.\n *\n * The `anchor?: string | undefined` is forced by the combination of Zod and this\n * repo's `exactOptionalPropertyTypes`: `.optional()` always widens to\n * `T | undefined`, which is NOT assignable to blocks' `anchor?: string` under\n * that flag.\n */\nexport type MenuLinkValue =\n  | { kind: 'entity'; entity: string; id: string; anchor?: string | undefined }\n  | { kind: 'url'; url: string }\n  | { kind: 'email'; email: string }\n\n/**\n * A menu tree node (phase 08 §3 / D009).\n *\n * `label: null` means \"use the LIVE title of the linked entity, per locale\";\n * a map is an explicit per-locale override. `enabled` is per-locale visibility\n * in BOTH directions — absent/`true` shows the item, `false` hides it in that\n * locale — so one tree serves every locale (no `menu_translations` table).\n *\n * Declared as a `type`, NOT an `interface`, on purpose: only type aliases get\n * TypeScript's implicit index signature, and without it `MenuItem[]` is not\n * assignable to the `Record<string, unknown>[]` arm of `AdminClient.create/\n * update`'s json-field value type — every caller storing a typed tree would\n * need a cast.\n */\nexport type MenuItem = {\n  /** Stable id — DND identity + anchor for audit diffs. */\n  id: string\n  /** `header` = a text-only dropdown parent with no link of its own. */\n  kind: 'link' | 'header'\n  /**\n   * Present iff `kind === 'link'`.\n   *\n   * The explicit `| undefined` is required by the repo's\n   * `exactOptionalPropertyTypes` — Zod's `.optional()` emits\n   * `LinkValue | undefined`, and without it the schema wouldn't typecheck\n   * against this interface.\n   */\n  link?: MenuLinkValue | undefined\n  /** `null` = live entity title per locale; a map = explicit override. */\n  label: Record<string, string> | null\n  /** Per-locale visibility. Absent/`true` = visible; `false` = hidden. */\n  enabled?: Record<string, boolean> | undefined\n  newTab?: boolean | undefined\n  children: MenuItem[]\n}\n\n/**\n * One menu item's target, as the editor needs to render its row\n * (`@murumets-ee/menus/admin`'s `resolveMenuItemSummaries`).\n *\n * Declared here — not in `admin/summaries.ts` — for the same reason\n * {@link BlockAnchor} is: it is a pure data shape with no server dependency,\n * so the client-safe `./schema` subpath can re-export it without pulling the\n * server-only resolver along. `import type` is erased at compile time either\n * way, but a single canonical home (this leaf module) is simpler to reason\n * about than \"which of two server-only files owns the type\".\n */\nexport interface MenuItemSummary {\n  /**\n   * The target row's live title, or `null` when the entity declares no\n   * display-able field. Unlike the public render path — which DROPS such an\n   * item rather than show a raw uuid as navigation — the admin editor still\n   * reports the target as present, just unlabelled.\n   */\n  title: string | null\n  /** `false` = the target row is gone (deleted) → a BROKEN item. */\n  exists: boolean\n  /** `null` when the entity isn't publishable — no draft/published distinction applies. */\n  published: boolean | null\n}\n\n/**\n * One addressable block anchor on a document (`@murumets-ee/menus/admin`'s\n * `collectBlockAnchors` / the anchors endpoint). See {@link MenuItemSummary}'s\n * doc for why this pure shape lives here rather than in `admin/anchors.ts`.\n */\nexport interface BlockAnchor {\n  /** The stable id rendered as the block element's `id` attribute. */\n  anchor: string\n  /** Display text — `anchorLabel` when usable, else the anchor value itself. */\n  label: string\n}\n\n/** Options for {@link buildMenuItemSchema} / {@link buildMenuTreeSchema}. */\nexport interface MenuSchemaOptions {\n  /**\n   * Locale codes accepted as keys in `label` / `enabled` maps. Anything else\n   * is a validation error — a typo'd locale would produce a label no renderer\n   * ever reads (the same failure mode content's `validateLocale` guards).\n   */\n  allowedLocales: readonly string[]\n}\n\n/**\n * {@link MenuLinkValue} as Zod. Blocks models its own `LinkValue` as a plain TS\n * type + structural guards (zod-free by design), so this is the first Zod\n * encoding of it — narrowed to the three kinds a menu item may carry.\n *\n * There is deliberately NO `media` arm (see {@link MenuLinkValue}): a media\n * link has no href seam at render time, so accepting one would store a\n * permanently invisible item. `z.discriminatedUnion` rejects it with an\n * `Invalid discriminator value. Expected 'entity' | 'url' | 'email'` issue —\n * which names the allowed set without echoing the caller's own value back.\n *\n * `url` kinds run through `sanitizeHref`, the single source of truth for the\n * href protocol allowlist (`http:`/`https:`/`mailto:`/`tel:` + relative\n * paths); it returns `''` for anything it rejects, including\n * protocol-relative `//evil.com` and obfuscated `java\\nscript:`.\n */\nexport const LinkValueSchema = z.discriminatedUnion('kind', [\n  z.object({\n    kind: z.literal('entity'),\n    entity: z.string().min(1).max(MAX_ENTITY_NAME_LENGTH),\n    id: z.string().uuid(),\n    anchor: z.string().min(1).max(MAX_ANCHOR_LENGTH).regex(ANCHOR_PATTERN).optional(),\n  }),\n  z.object({\n    kind: z.literal('url'),\n    // Transform-then-refine, NOT refine-alone: `sanitizeHref` trims, so\n    // validating its output while storing the raw input would let a value\n    // that PASSED validation differ from the value that gets STORED (leading\n    // /trailing whitespace). Storing the sanitizer's own return value keeps\n    // stored == validated. The arrow wrapper is required — `sanitizeHref`'s\n    // second parameter is the protocol allowlist, and passing Zod's ctx into\n    // it would silently replace the allowlist.\n    url: z\n      .string()\n      .min(1)\n      .max(MAX_MENU_URL_LENGTH)\n      .transform((value) => sanitizeHref(value))\n      .refine((value) => value !== '', {\n        message:\n          'link url uses a disallowed protocol (allowed: http, https, mailto, tel, or a relative path)',\n      }),\n  }),\n  z.object({\n    kind: z.literal('email'),\n    email: z.string().email().max(254),\n  }),\n])\n\n/**\n * A `Record<locale, T>` whose keys must all be configured locale codes.\n *\n * The key check is PIPED INTO the record parse rather than refined on top of\n * it, so it runs against the RAW value BEFORE any per-value parsing. That\n * ordering is the whole point: with `z.record(...).superRefine(...)`, zod\n * parses all N values first, so a 1,000,000-key map of wrong-typed values\n * emits 1,000,000 `invalid_type` issues before a width check on top could ever\n * fire (verified empirically against zod 3.25). Piping caps BOTH shapes —\n * unknown keys and bad values — at a single issue.\n */\nfunction localeMap<T extends z.ZodTypeAny>(\n  valueSchema: T,\n  allowedLocales: readonly string[],\n): z.ZodType<Record<string, z.infer<T>>, z.ZodTypeDef, unknown> {\n  const allowed = new Set(allowedLocales)\n  return z\n    .unknown()\n    .superRefine((value, ctx) => {\n      // Not a plain object — let the record parse below emit the single\n      // \"expected object\" issue rather than duplicating its message here.\n      if (value === null || typeof value !== 'object' || Array.isArray(value)) return\n\n      const keys = Object.keys(value)\n      // Width bound, checked FIRST. A legitimate map holds at most one entry\n      // per configured locale, so a wider map is malformed by construction and\n      // gets ONE issue for the whole map. Without this, a single node carrying\n      // e.g. 1,000,000 keys sails past the tree pre-scan (which bounds node\n      // COUNT and DEPTH, never map WIDTH) and turns validation itself into the\n      // amplification vector it exists to prevent: a multi-hundred-MB issue\n      // array plus an oversized audit-log write, from one request.\n      // CLAUDE.md's \"no unbounded fan-out\" applied to a single payload.\n      if (keys.length > allowed.size) {\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          message: `too many locale keys — configured locales are: ${[...allowed].join(', ')}`,\n        })\n        return\n      }\n\n      // Past the width bound this loop is bounded by the CONFIGURED locale\n      // count, never by the payload.\n      for (const key of keys) {\n        if (!allowed.has(key)) {\n          ctx.addIssue({\n            code: z.ZodIssueCode.custom,\n            path: [key],\n            // Names the allowed set (server-side data), never echoes the\n            // caller-supplied key into the message — see the api-handler's\n            // \"refine()/custom messages must not echo user input\" contract.\n            message: `unknown locale key — configured locales are: ${[...allowed].join(', ')}`,\n          })\n        }\n      }\n    })\n    .pipe(z.record(z.string(), valueSchema))\n}\n\n/**\n * The recursive per-node schema. Input is `unknown` (this parses untrusted\n * JSONB), output is a fully-narrowed {@link MenuItem}. Unknown properties are\n * STRIPPED by Zod's default object behavior, so writing the parse result back\n * onto the payload also sanitizes it — nothing a caller invents gets stored.\n */\nexport function buildMenuItemSchema(\n  options: MenuSchemaOptions,\n): z.ZodType<MenuItem, z.ZodTypeDef, unknown> {\n  const labelMap = localeMap(z.string().max(MAX_LABEL_LENGTH), options.allowedLocales)\n  const enabledMap = localeMap(z.boolean(), options.allowedLocales)\n\n  const schema: z.ZodType<MenuItem, z.ZodTypeDef, unknown> = z.lazy(() =>\n    z\n      .object({\n        id: z.string().min(1).max(MAX_ITEM_ID_LENGTH),\n        kind: z.enum(['link', 'header']),\n        link: LinkValueSchema.optional(),\n        label: labelMap.nullable().default(null),\n        enabled: enabledMap.optional(),\n        newTab: z.boolean().optional(),\n        children: z.array(schema).default([]),\n      })\n      .superRefine((node, ctx) => {\n        if (node.kind === 'link') {\n          if (node.link === undefined) {\n            ctx.addIssue({\n              code: z.ZodIssueCode.custom,\n              path: ['link'],\n              message: 'a link item requires a link target',\n            })\n          }\n          return\n        }\n        // header\n        if (node.link !== undefined) {\n          ctx.addIssue({\n            code: z.ZodIssueCode.custom,\n            path: ['link'],\n            message: 'a header item must not carry a link target',\n          })\n        }\n        // A header has no entity to borrow a live title from, so its label\n        // map is required (phase 08 §3) — otherwise it renders as nothing.\n        if (node.label === null || Object.keys(node.label).length === 0) {\n          ctx.addIssue({\n            code: z.ZodIssueCode.custom,\n            path: ['label'],\n            message: 'a header item requires a label for at least one locale',\n          })\n        }\n      }),\n  )\n\n  return schema\n}\n\n/** The whole tree — an array of {@link buildMenuItemSchema} nodes. */\nexport function buildMenuTreeSchema(\n  options: MenuSchemaOptions,\n): z.ZodType<MenuItem[], z.ZodTypeDef, unknown> {\n  return z.array(buildMenuItemSchema(options))\n}\n\n/** Result of {@link measureMenuTree}. */\nexport interface MenuTreeMeasurement {\n  /** Deepest nesting level; `0` for an empty tree, `1` for flat items. */\n  depth: number\n  /** Total node count across every level. */\n  nodeCount: number\n}\n\n/**\n * Measure a (possibly untrusted) tree's depth + node count **iteratively**, so\n * measuring can never blow the stack the way a recursive walk over a hostile\n * payload would. Stops early once either hard bound is exceeded and reports\n * the over-limit value — the caller turns that into a validation error.\n *\n * Accepts `unknown` on purpose: this runs BEFORE the Zod parse (bounding the\n * work that parse will do), so it can't assume a well-formed shape.\n */\nexport function measureMenuTree(tree: unknown): MenuTreeMeasurement {\n  if (!Array.isArray(tree)) return { depth: 0, nodeCount: 0 }\n\n  let maxDepth = 0\n  let nodeCount = 0\n  // `Array.isArray` narrows an `unknown` to `any[]`; re-binding through a\n  // `readonly unknown[]` annotation keeps every element typed as `unknown`\n  // instead of silently leaking `any` into the walk.\n  const roots: readonly unknown[] = tree\n  const stack: Array<{ node: unknown; depth: number }> = roots.map((node) => ({ node, depth: 1 }))\n\n  while (stack.length > 0) {\n    const current = stack.pop()\n    if (current === undefined) break\n    const { node, depth } = current\n    if (node === null || typeof node !== 'object' || Array.isArray(node)) continue\n\n    nodeCount++\n    if (depth > maxDepth) maxDepth = depth\n    // Early abort: past either bound the exact totals no longer matter, only\n    // that they're over — and continuing would be the amplification we're\n    // guarding against.\n    if (nodeCount > MAX_MENU_TREE_NODES || maxDepth > MAX_MENU_DEPTH) {\n      return { depth: maxDepth, nodeCount }\n    }\n\n    const children = (node as { children?: unknown }).children\n    if (Array.isArray(children)) {\n      const items: readonly unknown[] = children\n      for (const child of items) stack.push({ node: child, depth: depth + 1 })\n    }\n  }\n\n  return { depth: maxDepth, nodeCount }\n}\n\n/**\n * Cross-field check: does `tree` nest no deeper than the menu's own\n * `maxDepth`? Lives outside the node schema because a per-node Zod refinement\n * has no visibility of the sibling `maxDepth` COLUMN — the behavior calls this\n * after the recursive parse.\n */\nexport function validateTreeDepth(tree: unknown, maxDepth: number): boolean {\n  return measureMenuTree(tree).depth <= maxDepth\n}\n","/**\n * The per-menu `entityTypes` whitelist — \"which content types may be linked\n * from this menu\" (plan/routing phase 07 §2.8, 09 §3, 10 §4).\n *\n * Drupal's per-content-type menu offering, minus the config-entity ceremony: a\n * `page` doesn't declare \"I belong in menus\", each MENU declares which types it\n * accepts. Two surfaces consume it — the menu editor's \"Add link\" picker (which\n * content types its Content tab offers) and the Meta panel's Menus section\n * (which menus an entity's edit screen offers to join).\n *\n * ## Semantics — `null` is \"everything\", and it is the ONLY unrestricted shape\n *\n * `null` (or an absent column) = the menu accepts every entity type. That is the\n * default, and it is what every menu row written before this column existed\n * reads back as, so the whitelist is backward-compatible by construction.\n *\n * An EMPTY array means the same thing, and {@link MenuEntityTypesSchema}\n * normalises it to `null` on the way in — the editor's \"nothing selected\" state\n * naturally produces `[]`, and letting both spellings persist would mean every\n * reader had to remember to check for two. Readers still tolerate a stored `[]`\n * (a hand-edited row, an older dump) via {@link menuAcceptsEntityType}.\n *\n * A menu that accepts NOTHING is deliberately unrepresentable: it could only\n * ever be a mistake, and \"empty selection\" is far more likely to mean \"I haven't\n * narrowed this yet\" than \"refuse everything\".\n *\n * ## Not a security boundary\n *\n * This is an authoring affordance. It decides what a picker OFFERS; it does not\n * decide what a caller may write — `menu:update` on the entity PATCH does, and\n * `menuTreeValidation()` re-checks the tree's shape regardless of the whitelist.\n * So the read path fails OPEN (a malformed column means \"no restriction\"): a\n * junk value must not hide every menu from the admin who needs to fix it. The\n * WRITE path fails closed, as every boundary does.\n *\n * @module\n */\n\nimport { z } from 'zod'\nimport { MAX_ENTITY_NAME_LENGTH } from './menu-item-schema.js'\n\n/**\n * Upper bound on how many entity types one menu's whitelist may name.\n *\n * A real app registers a few dozen entities, so this is a malformed-payload\n * guard rather than a product limit — it keeps a hostile PATCH from parking an\n * unbounded array in the column (and, through it, in every editor's RSC\n * payload).\n *\n * **Not** `MAX_MENU_ENTITY_TYPES` (`./get-menu.ts`, 16). That one bounds RENDER\n * fan-out — how many distinct types one menu render may issue batched lookups\n * for — and applies to the types actually present in the stored tree. This one\n * bounds the stored AUTHORING whitelist, which costs no I/O at all.\n */\nexport const MAX_MENU_ENTITY_TYPE_WHITELIST = 64\n\n/** One entity name in the whitelist — same bound `link.entity` carries. */\nconst EntityTypeName = z.string().min(1).max(MAX_ENTITY_NAME_LENGTH)\n\n/**\n * The write-boundary schema for `menu.entityTypes`.\n *\n * Strict where {@link normalizeMenuEntityTypes} is tolerant: a junk entry is a\n * 400, not a silent drop, because silently discarding half an admin's selection\n * and reporting success is worse than refusing the write. Duplicates ARE folded\n * (an idempotent selection is not an error), and `[]` becomes `null` so the\n * column only ever holds one representation of \"unrestricted\".\n */\nexport const MenuEntityTypesSchema: z.ZodType<string[] | null, z.ZodTypeDef, unknown> = z\n  .array(EntityTypeName)\n  // DELIBERATE ORDER — `.max()` runs on the RAW array, BEFORE the dedup in the\n  // transform below, so 65 copies of `'page'` is a 400 even though it would\n  // store one entry. The bound is on the PAYLOAD, not on the result: deduping\n  // first would mean accepting an unbounded array to prove it was small.\n  .max(MAX_MENU_ENTITY_TYPE_WHITELIST)\n  .nullable()\n  .transform((value) => {\n    if (value === null) return null\n    const deduped = [...new Set(value)]\n    return deduped.length === 0 ? null : deduped\n  })\n\n/**\n * Narrow a raw `entityTypes` column value (untrusted shape) to a usable\n * whitelist, or `null` for \"no restriction\".\n *\n * The read-side counterpart of {@link MenuEntityTypesSchema}, and tolerant for\n * the same reason `normalizeMenuTree` is: rows written before this column\n * existed, hand edits and restored dumps all reach readers, and a render must\n * degrade rather than throw. Anything unusable — a non-array, a non-string\n * entry, a whitelist that reduces to nothing — reads as `null`.\n */\nexport function normalizeMenuEntityTypes(value: unknown): string[] | null {\n  if (!Array.isArray(value)) return null\n  // `Array.isArray` narrows `unknown` to `any[]`; re-binding through a\n  // `readonly unknown[]` annotation keeps every element typed as `unknown`.\n  const raw: readonly unknown[] = value\n\n  const out: string[] = []\n  const seen = new Set<string>()\n  for (const entry of raw) {\n    if (typeof entry !== 'string' || entry.length === 0) continue\n    if (entry.length > MAX_ENTITY_NAME_LENGTH) continue\n    if (seen.has(entry)) continue\n    seen.add(entry)\n    out.push(entry)\n    if (out.length === MAX_MENU_ENTITY_TYPE_WHITELIST) break\n  }\n  return out.length === 0 ? null : out\n}\n\n/**\n * Does this menu accept links to `entityType`?\n *\n * Takes the RAW column value so callers holding a `field.json()`-typed row can\n * ask directly, without narrowing first. Exact string match — entity names are\n * lowercase identifiers, and a case-insensitive or prefix match would silently\n * widen a whitelist the admin wrote precisely.\n *\n * Fails OPEN (see the module header): absent, empty and malformed all mean \"no\n * restriction\".\n */\nexport function menuAcceptsEntityType(value: unknown, entityType: string): boolean {\n  const whitelist = normalizeMenuEntityTypes(value)\n  return whitelist === null || whitelist.includes(entityType)\n}\n","/**\n * `menuEntityTypesValidation()` — boundary validation for the\n * `menu.entityTypes` JSONB column (plan/routing phase 07 §2.8, F056).\n *\n * `field.json()`'s own validation is the deliberately permissive JSON union, so\n * without this hook an admin PATCH could park any shape — including an unbounded\n * array — in the column, and every reader (editor picker, Meta panel, every RSC\n * payload that carries the row) would pay for it. CLAUDE.md's \"validate at the\n * boundary\" applied to the one column `menuTreeValidation()` doesn't cover.\n *\n * **Why a second behavior rather than a branch inside `menuTreeValidation()`.**\n * The two share nothing: the tree check is CROSS-FIELD (it reads the sibling\n * `maxDepth` column through `loadCurrent`) and CROSS-MODULE (locale keys against\n * the content plugin's registry, hence its injectable resolver option); this one\n * is self-contained and needs no context at all. Folding it in would put an\n * option-less concern behind `MenuTreeValidationOptions` and make a behavior\n * named \"tree validation\" own a non-tree column.\n *\n * Errors are `ZodError`s so the admin API maps them to **400 with structured\n * issues** rather than a 500 — same contract `menuTreeValidation()` relies on.\n * Issues are pathed at `entityTypes` so the client can point at the field.\n */\n\nimport type { Behavior, BulkUpdateInfo } from '@murumets-ee/entity'\nimport { z } from 'zod'\nimport { MenuEntityTypesSchema } from '../menu-entity-types.js'\n\n/**\n * `AdminClient.updateMany` runs NO per-row hooks, so `beforeUpdate` above never\n * fires on that path — a bulk statement could otherwise park an unbounded or\n * malformed array in the column and every reader would pay for it, which is the\n * exact hole this behavior exists to close. `assertBulkUpdate` is the sanctioned\n * cover for that gap (same mechanism `hierarchical()` uses to stop a partial\n * bulk tree write).\n *\n * This REJECTS rather than validates: `updateMany` sets one value across every\n * matched row, and \"every menu accepts exactly these types\" is not a coherent\n * intent — a whitelist is per-menu by definition. There is no legitimate bulk\n * caller to serve, so refusing is both safer and more honest than silently\n * validating a shape nobody should be writing this way.\n */\nfunction assertNoBulkEntityTypesWrite(info: BulkUpdateInfo): void {\n  if (!info.keys.includes('entityTypes')) return\n  throw new z.ZodError([\n    {\n      code: 'custom',\n      path: ['entityTypes'],\n      message:\n        `bulk update on '${info.entityName}' cannot write 'entityTypes': updateMany runs no ` +\n        'per-row hooks, so the whitelist would bypass its schema check. A whitelist is ' +\n        'per-menu — update each row individually, or write a migration for a one-off backfill.',\n    },\n  ])\n}\n\n/** Prefix every issue path with `entityTypes` so the client can locate it. */\nfunction prefixIssues(error: z.ZodError): z.ZodError {\n  return new z.ZodError(\n    error.issues.map((issue) => ({ ...issue, path: ['entityTypes', ...issue.path] })),\n  )\n}\n\n/**\n * Validate + normalize `data.entityTypes` in place, returning the payload with\n * the PARSED value (so `[]` is persisted as `null` and duplicates are folded —\n * see `../menu-entity-types.ts` for why there is exactly one unrestricted\n * shape).\n *\n * A payload without the key is a partial update that doesn't touch the column;\n * it passes through untouched rather than being defaulted, which would let a\n * `{ tree }`-only PATCH silently clear an authored whitelist.\n */\nfunction validateEntityTypes(data: Record<string, unknown>): Record<string, unknown> {\n  if (!('entityTypes' in data)) return data\n\n  const parsed = MenuEntityTypesSchema.safeParse(data.entityTypes)\n  if (!parsed.success) throw prefixIssues(parsed.error)\n  return { ...data, entityTypes: parsed.data }\n}\n\n/**\n * Recursive-free Zod validation of `menu.entityTypes` on every create/update.\n *\n * Contributes NO fields, so the field-map type param is the EMPTY map\n * `Record<never, never>` — NOT `Record<string, never>`, which would merge into\n * the entity's field map and collapse every field to `never`.\n */\nexport function menuEntityTypesValidation(): Behavior<\n  Record<never, never>,\n  'menuEntityTypesValidation'\n> {\n  return {\n    name: 'menuEntityTypesValidation',\n    hooks: {\n      beforeCreate: async (data) => validateEntityTypes(data),\n      beforeUpdate: async (_id, data) => validateEntityTypes(data),\n    },\n    assertBulkUpdate: assertNoBulkEntityTypesWrite,\n  }\n}\n","/**\n * `menuTreeValidation()` — boundary validation for the `menu.tree` JSONB column\n * (plan/routing phase 08 §3, F040 pt.2).\n *\n * Why a behavior and not field-local validation: two of the four rules are\n * CROSS-FIELD or CROSS-MODULE. The tree's nesting depth is checked against the\n * sibling `maxDepth` COLUMN, and the locale keys are checked against the app's\n * configured content locales — neither is visible to `field.json()`'s\n * (deliberately permissive) JSON union. `BehaviorContext` gives a hook both:\n * the update payload and, via `loadCurrent`, the pre-update row.\n *\n * Errors are raised as `ZodError`s on purpose: the admin API handler maps\n * `ZodError` to **400 with structured issues** (a plain `Error` would surface\n * as a 500), so an editor saving a malformed tree gets a per-node message\n * pointing at the offending item instead of \"Internal server error\".\n */\n\nimport { getContentConfig } from '@murumets-ee/content/plugin'\nimport type { Behavior, BehaviorContext } from '@murumets-ee/entity'\nimport { z } from 'zod'\nimport {\n  buildMenuTreeSchema,\n  DEFAULT_MENU_DEPTH,\n  MAX_MENU_DEPTH,\n  MAX_MENU_TREE_NODES,\n  measureMenuTree,\n} from '../menu-item-schema.js'\n\n/** Options for {@link menuTreeValidation}. */\nexport interface MenuTreeValidationOptions {\n  /**\n   * Resolve the locale codes accepted as `label` / `enabled` keys.\n   *\n   * Defaults to the `content()` plugin's configured locales, read LAZILY (per\n   * write, never at module scope) so the behavior can be constructed before\n   * the app boots. Injectable so the behavior is unit-testable without a\n   * booted content plugin.\n   */\n  resolveAllowedLocales?: () => readonly string[]\n}\n\n/** One-issue `ZodError` at `tree`(`.path`) — the 400-mapped failure shape. */\nfunction treeError(message: string, path: Array<string | number> = []): z.ZodError {\n  return new z.ZodError([{ code: z.ZodIssueCode.custom, path: ['tree', ...path], message }])\n}\n\n/** Prefix every issue path with `tree` so the client can locate the node. */\nfunction prefixIssues(error: z.ZodError): z.ZodError {\n  return new z.ZodError(error.issues.map((issue) => ({ ...issue, path: ['tree', ...issue.path] })))\n}\n\n/** A `maxDepth` value from an (unvalidated, pre-field-validation) payload. */\nfunction readMaxDepth(value: unknown): number | undefined {\n  if (typeof value !== 'number' || !Number.isInteger(value)) return undefined\n  if (value < 1 || value > MAX_MENU_DEPTH) return undefined\n  return value\n}\n\n/**\n * The effective `maxDepth` for this write.\n *\n * Hooks run BEFORE field validation, so a payload's `maxDepth` may be absent\n * or junk; junk falls through to the persisted/default value and is rejected a\n * moment later by the field's own `min`/`max`. On a partial update that\n * touches only `tree`, the persisted value comes from `loadCurrent()` (the\n * eagerly-loaded pre-update snapshot).\n */\nasync function resolveMaxDepth(\n  data: Record<string, unknown>,\n  ctx: BehaviorContext | undefined,\n  isUpdate: boolean,\n): Promise<number> {\n  const fromPayload = readMaxDepth(data.maxDepth)\n  if (fromPayload !== undefined) return fromPayload\n  if (!isUpdate) return DEFAULT_MENU_DEPTH\n\n  if (!ctx?.loadCurrent) {\n    // Fail loud rather than silently skipping the cross-field check — an\n    // unvalidated depth is a correctness hole. AdminClient always wires\n    // `loadCurrent` on the update codepath, so this only trips on a\n    // mis-wired / direct hook invocation. (Same posture as `pathParent`.)\n    throw new Error(\n      'menu: BehaviorContext.loadCurrent is unavailable — cannot validate the tree ' +\n        \"against the menu's maxDepth. Writes must go through AdminClient.update.\",\n    )\n  }\n  const current = await ctx.loadCurrent()\n  // A vanished/unreadable row can't supply its own bound, so fall back to the\n  // DEFAULT (3) — the same value a create would get — not the absolute cap\n  // (6). Falling back to the ceiling would make an edge case the single most\n  // PERMISSIVE path in the behavior; the safe fallback is the floor. The\n  // absolute cap still applies separately, and the update itself fails\n  // downstream when the row is genuinely gone.\n  return readMaxDepth(current?.maxDepth) ?? DEFAULT_MENU_DEPTH\n}\n\n/**\n * The REVERSE cross-field check: an update that narrows `maxDepth` without\n * touching `tree`.\n *\n * `{\"maxDepth\": 1}` on a menu whose stored tree is 5 levels deep used to skip\n * validation entirely (the payload has no `tree`, so there was nothing to\n * measure) — the write succeeded and the row then PERMANENTLY violated\n * \"tree depth <= maxDepth\" until someone happened to edit the tree again.\n * Both directions of the invariant have to be enforced, so when `maxDepth`\n * moves we measure the PERSISTED tree against the new bound.\n */\nasync function validateStoredTreeAgainstNewMaxDepth(\n  data: Record<string, unknown>,\n  ctx: BehaviorContext | undefined,\n): Promise<void> {\n  // Absent (or junk — the field's own min/max rejects that a moment later)\n  // means this write doesn't move the bound, so there's nothing to re-check.\n  const maxDepth = readMaxDepth(data.maxDepth)\n  if (maxDepth === undefined) return\n\n  if (!ctx?.loadCurrent) {\n    // Same fail-loud posture as `resolveMaxDepth` — silently skipping the\n    // check is precisely the hole this function closes.\n    throw new Error(\n      'menu: BehaviorContext.loadCurrent is unavailable — cannot validate the stored tree ' +\n        'against the new maxDepth. Writes must go through AdminClient.update.',\n    )\n  }\n\n  const current = await ctx.loadCurrent()\n  // Measured iteratively and on a value already bounded at write time, so this\n  // is cheap even for the largest legal tree.\n  const { depth } = measureMenuTree(current?.tree)\n  if (depth > maxDepth) {\n    throw treeError(\n      `the stored menu tree is nested ${depth} levels deep, deeper than this menu's ` +\n        `new maxDepth (${maxDepth}) — flatten the tree first`,\n    )\n  }\n}\n\n/**\n * Validate + normalize `data.tree` in place. Returns the payload with `tree`\n * replaced by the PARSED value, so unknown properties a caller invented are\n * stripped before they reach the column.\n */\nasync function validateTree(\n  data: Record<string, unknown>,\n  ctx: BehaviorContext | undefined,\n  isUpdate: boolean,\n  resolveAllowedLocales: () => readonly string[],\n): Promise<Record<string, unknown>> {\n  const tree = data.tree\n  if (tree === undefined) {\n    // No tree in the payload — but a `maxDepth`-only update still has to be\n    // checked against the tree already in the column.\n    if (isUpdate) await validateStoredTreeAgainstNewMaxDepth(data, ctx)\n    return data\n  }\n  if (tree === null || !Array.isArray(tree)) {\n    throw treeError('menu tree must be an array of menu items')\n  }\n\n  // Structural bounds FIRST — this walk is iterative, so it holds even for a\n  // payload crafted to blow the recursive parse's stack.\n  const { depth, nodeCount } = measureMenuTree(tree)\n  if (nodeCount > MAX_MENU_TREE_NODES) {\n    throw treeError(`menu tree has too many items (max ${MAX_MENU_TREE_NODES})`)\n  }\n  if (depth > MAX_MENU_DEPTH) {\n    throw treeError(`menu tree is nested too deeply (absolute max ${MAX_MENU_DEPTH} levels)`)\n  }\n\n  const parsed = buildMenuTreeSchema({ allowedLocales: resolveAllowedLocales() }).safeParse(tree)\n  if (!parsed.success) throw prefixIssues(parsed.error)\n\n  const maxDepth = await resolveMaxDepth(data, ctx, isUpdate)\n  if (depth > maxDepth) {\n    throw treeError(`menu tree is nested deeper than this menu's maxDepth (${maxDepth})`)\n  }\n\n  return { ...data, tree: parsed.data }\n}\n\n/**\n * Recursive Zod validation of `menu.tree` on every create/update.\n *\n * Contributes NO fields, so the field-map type param is the EMPTY map\n * `Record<never, never>` — NOT `Record<string, never>`, which would merge into\n * the entity's field map and collapse every field to `never` (a break that\n * only surfaces through the built `.d.mts`).\n */\nexport function menuTreeValidation(\n  options?: MenuTreeValidationOptions,\n): Behavior<Record<never, never>, 'menuTreeValidation'> {\n  const resolveAllowedLocales =\n    options?.resolveAllowedLocales ?? (() => getContentConfig().locales.map((l) => l.code))\n\n  return {\n    name: 'menuTreeValidation',\n    hooks: {\n      beforeCreate: async (data, ctx) => validateTree(data, ctx, false, resolveAllowedLocales),\n      beforeUpdate: async (_id, data, ctx) => validateTree(data, ctx, true, resolveAllowedLocales),\n    },\n  }\n}\n","/**\n * The `menu` entity (plan/routing phase 08 §2, D008/D009).\n *\n * A menu is a normal entity whose item tree is ONE ordered nested JSONB column\n * — the family WordPress migrated to and Statamic uses, and the same storage\n * philosophy as our blocks layouts. Whole-tree edits save atomically in one\n * PATCH, and `publishable()` gives draft-then-publish menu editing for free.\n *\n * Locale variance lives INSIDE the tree (per-item `label` / `enabled` maps),\n * so there is deliberately no `translatable` field and no `menu_translations`\n * table — one structure serves every locale (D009).\n */\n\nimport { auditable, defineEntity, field, publishable } from '@murumets-ee/entity'\nimport { menuEntityTypesValidation } from './behaviors/menu-entity-types-validation.js'\nimport { menuTreeValidation } from './behaviors/menu-tree-validation.js'\nimport { DEFAULT_MENU_DEPTH, MAX_MENU_DEPTH } from './menu-item-schema.js'\n\nexport const Menu = defineEntity({\n  name: 'menu',\n  // Menus belong to one site (multisite D002); the `handle` unique is per site,\n  // so every site can have its own `main` and `footer`.\n  site: 'bound',\n  admin: {\n    label: 'Menus',\n    icon: 'menu',\n  },\n  fields: {\n    // Fetch key — 'main', 'footer' (phase 07 §2.8). `from: 'title'` is the\n    // admin form's client-side auto-fill source (SlugField watches it); the\n    // value itself is author-chosen and stable, so `sluggable()` (which would\n    // REGENERATE the handle when the title changes) is deliberately not used.\n    // `field.slug()` already sets `unique` + `indexed` — no need to repeat them.\n    handle: field.slug({ from: 'title' }),\n    title: field.text({ required: true }),\n    // 1..6 — the renderer clamps too (phase 07 §2.7).\n    maxDepth: field.number({\n      default: DEFAULT_MENU_DEPTH,\n      min: 1,\n      max: MAX_MENU_DEPTH,\n      integer: true,\n    }),\n    // MenuItem[] — shape validated by `menuTreeValidation()`; `refScan` makes\n    // every LinkValue in the tree register in `entity_refs` /\n    // `external_link_usage` on save, so a menu item pointing at a page shows\n    // up in delete-protection warnings and the broken-links dashboard\n    // (phase 08 §4) with no menus-side ref code at all.\n    tree: field.json({ refScan: true, default: [] }),\n    // Which content types may be linked FROM this menu (phase 07 §2.8) — the\n    // menu editor's picker and the Meta panel's Menus section both read it.\n    // `null` = accepts every type, which is what every row written before this\n    // column existed reads back as, so the whitelist is backward-compatible by\n    // construction. Shape validated by `menuEntityTypesValidation()`; semantics\n    // and the read-side predicate live in `./menu-entity-types.ts`.\n    //\n    // No `refScan`: the value holds entity NAMES, not `LinkValue`s — there is\n    // no row to reference, so a scan would find nothing.\n    entityTypes: field.json({ default: null }),\n  },\n  behaviors: [auditable(), publishable(), menuTreeValidation(), menuEntityTypesValidation()],\n  scope: 'global',\n  // Advisory metadata (the firewall is deny-by-default + operator grants).\n  // Menus are site-wide navigation: a bad edit is visible on EVERY page, and\n  // the tree is a structural artifact rather than content — so writes are\n  // admin-only, while `view` is public because the frontend reads menus\n  // unauthenticated through the content API.\n  access: {\n    view: 'public',\n    create: 'group.admin',\n    update: 'group.admin',\n    delete: 'group.admin',\n  },\n})\n","/**\n * Typed column access for a dynamically-generated entity table.\n *\n * `AdminClient.getTable()` / `QueryClient.getTable()` both return\n * `PgTableWithColumns<any>` (Drizzle cannot type columns that are generated\n * from a runtime entity definition), so reading a column off one directly\n * yields `any` and silently erodes this package's type coverage. Narrowing\n * through this helper pins the ONE column being filtered on — the same idiom\n * `@murumets-ee/content`'s `buildEnumerateDeps` uses.\n *\n * Internal to `@murumets-ee/menus`; not part of any public entry.\n */\n\nimport type { PgColumn, PgTableWithColumns } from 'drizzle-orm/pg-core'\n\n/** Read one named column off a runtime-generated entity table, typed. */\nexport function column<K extends string>(\n  // biome-ignore lint/suspicious/noExplicitAny: Drizzle cannot type dynamically-generated column schemas — `PgTableWithColumns<any>` is `getTable()`'s own declared return type (CLAUDE.md's sanctioned case).\n  table: PgTableWithColumns<any>,\n  name: K,\n): PgColumn {\n  return (table as unknown as Record<K, PgColumn>)[name]\n}\n","/**\n * Read-side narrowing for a stored `menu.tree` column, plus the entity-ref\n * collection the editor page needs for `resolveMenuItemSummaries()`.\n *\n * **Why this exists.** `field.json()` types its column as `JsonValue`, so the\n * row `fetchEntityById(Menu, id)` returns hands us an untyped blob. Casting it\n * straight to `MenuItem[]` would need an `as unknown as` (CLAUDE.md: don't) and\n * would also be a lie — the column is only *usually* well-formed. Rows written\n * before `menuTreeValidation()` existed, hand-edited rows, and rows restored\n * from an older dump can all violate the shape, and the editor is exactly the\n * tool you reach for when they do. So this walks the raw value ONCE and returns\n * a properly-typed tree.\n *\n * **Deliberately tolerant, and deliberately NOT `getMenu`.** `getMenu` is the\n * public render path: it also applies the per-locale `enabled` filter, the\n * publish gate and the per-menu `maxDepth` clamp, because a visitor must not\n * see a hidden or unpublished item. The editor is the opposite case — it must\n * show *everything* that is stored, including items hidden in the current\n * locale and items nested deeper than the menu's own `maxDepth` (that is the\n * state you opened the editor to fix). The only things dropped here are nodes\n * whose shape cannot be represented as a `MenuItem` at all.\n *\n * **Bounded** (CLAUDE.md \"no unbounded fan-out\"): at most\n * {@link MAX_MENU_TREE_NODES} nodes are materialised and recursion stops at\n * {@link MAX_MENU_DEPTH}, regardless of what the column contains — so a\n * hand-edited row can't turn a page render into unbounded work or a stack\n * overflow. Whatever is refused is COUNTED and returned, never silently\n * swallowed: the caller logs it, and the editor surfaces it before a save\n * would persist the removal.\n *\n * **Why it lives in `@murumets-ee/menus`.** It was a `@murumets-ee/menus-ui`\n * internal until PR12, when the Meta panel's Menus section (`admin-ui`) needed\n * the same narrowing to turn a `menu` row's `tree` column into a `MenuItem[]`.\n * `menus-ui` depends on `admin-ui`, so exporting it from there would close an\n * `admin-ui → menus-ui → admin-ui` import cycle — same reasoning (and same\n * move) as `./menu-tree-ops.ts`.\n *\n * It pulls `LinkValueSchema` — and therefore zod — and nothing else, so it is\n * client-safe and rides the `./schema` subpath alongside the tree operations.\n *\n * @module\n */\n\nimport {\n  LinkValueSchema,\n  MAX_MENU_DEPTH,\n  MAX_MENU_TREE_NODES,\n  type MenuItem,\n  type MenuLinkValue,\n} from './menu-item-schema.js'\n\n/** One entity target a menu item points at — the `resolveMenuItemSummaries` input shape. */\nexport interface MenuEntityRef {\n  entity: string\n  id: string\n}\n\n/** Result of {@link normalizeMenuTree}. */\nexport interface NormalizedMenuTree {\n  /** The stored tree, narrowed to `MenuItem[]`. */\n  items: MenuItem[]\n  /**\n   * How many stored nodes were REFUSED — malformed shape, or past one of the\n   * hard bounds. An entire refused subtree counts as ONE (we stop at the\n   * refusal point rather than descending into it to count more).\n   *\n   * Non-zero means a whole-tree save would persist those removals, so the\n   * editor must warn before writing.\n   */\n  dropped: number\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value)\n}\n\n/**\n * Keep only the entries whose value passes `predicate`. Locale KEYS are not\n * checked against the app's configured locale set on purpose: the set can\n * change after a tree is written, and dropping a label for a locale that was\n * just disabled would destroy authored text on the next save. An out-of-set key\n * is instead rejected loudly by `menuTreeValidation()` when the editor saves.\n */\nfunction filterMap<T>(\n  value: unknown,\n  predicate: (candidate: unknown) => candidate is T,\n): Record<string, T> | undefined {\n  if (!isPlainObject(value)) return undefined\n  const out: Record<string, T> = {}\n  for (const [key, entry] of Object.entries(value)) {\n    if (predicate(entry)) out[key] = entry\n  }\n  return out\n}\n\nconst isString = (value: unknown): value is string => typeof value === 'string'\nconst isBoolean = (value: unknown): value is boolean => typeof value === 'boolean'\n\n/**\n * Narrow a raw `menu.tree` JSONB value to `MenuItem[]`.\n *\n * @param value the raw column value (untrusted shape).\n */\nexport function normalizeMenuTree(value: unknown): NormalizedMenuTree {\n  let budget = MAX_MENU_TREE_NODES\n  let dropped = 0\n\n  function walk(raw: unknown, depth: number): MenuItem[] {\n    if (!Array.isArray(raw)) return []\n    // `Array.isArray` narrows `unknown` to `any[]`; re-binding through a\n    // `readonly unknown[]` annotation keeps every element typed as `unknown`.\n    const rawNodes: readonly unknown[] = raw\n    if (depth > MAX_MENU_DEPTH) {\n      // Past the absolute cap the whole level goes, counted once per node so\n      // the editor's warning is proportional to what it lost.\n      dropped += rawNodes.length\n      return []\n    }\n\n    const out: MenuItem[] = []\n    for (const node of rawNodes) {\n      if (!isPlainObject(node)) {\n        dropped++\n        continue\n      }\n\n      const id = node.id\n      const kind = node.kind\n      if (typeof id !== 'string' || id.length === 0) {\n        dropped++\n        continue\n      }\n      if (kind !== 'link' && kind !== 'header') {\n        dropped++\n        continue\n      }\n\n      let link: MenuLinkValue | undefined\n      if (kind === 'link') {\n        // Re-validate the stored target through the SAME schema the write path\n        // uses — notably the `sanitizeHref` protocol allowlist, so a row that\n        // predates (or bypassed) that gate can't hand the editor a\n        // `javascript:` href to render.\n        const parsed = LinkValueSchema.safeParse(node.link)\n        if (!parsed.success) {\n          dropped++\n          continue\n        }\n        link = parsed.data\n      } else if (node.link !== undefined) {\n        // A header carrying a link target is a shape violation the type can't\n        // represent — drop it rather than render a half-defined node.\n        dropped++\n        continue\n      }\n\n      if (budget <= 0) {\n        dropped++\n        continue\n      }\n      budget--\n\n      // `filterMap` returns `{}` (not `undefined`) when the stored map WAS an\n      // object but every entry failed the predicate (e.g. `{ en: 42 }`, a\n      // non-string junk value) — `?? null`/`undefined` below wouldn't catch\n      // that, since `{}` is truthy. An all-junk map must collapse the same\n      // way a genuinely absent one does: for `label`, `{}` surviving into a\n      // save would fail the write-side schema's \"a header needs at least one\n      // locale key\" check with a server error instead of this module's own\n      // documented tolerant behaviour; for `enabled`, `{}` is a harmless but\n      // needless stored key (absent already means \"visible everywhere\").\n      const rawLabel = filterMap(node.label, isString)\n      const label =\n        rawLabel !== undefined && Object.keys(rawLabel).length > 0 ? rawLabel : undefined\n      const rawEnabled = filterMap(node.enabled, isBoolean)\n      const enabled =\n        rawEnabled !== undefined && Object.keys(rawEnabled).length > 0 ? rawEnabled : undefined\n      out.push({\n        id,\n        kind,\n        link,\n        // `null` = \"use the live entity title per locale\" (the storage default).\n        label: label ?? null,\n        enabled,\n        newTab: typeof node.newTab === 'boolean' ? node.newTab : undefined,\n        children: walk(node.children, depth + 1),\n      })\n    }\n    return out\n  }\n\n  return { items: walk(value, 1), dropped }\n}\n\n/**\n * Every distinct entity target in a (already-normalised, therefore bounded)\n * tree, in document order.\n *\n * Deduplicated: two menu items pointing at the same page produce ONE\n * `resolveMenuItemSummaries` ref, so the batched read never scales with item\n * count. The output feeds `resolveMenuItemSummaries(app, refs)`, whose result\n * map is keyed the same `${entity}:${id}` way.\n */\nexport function collectMenuEntityRefs(items: readonly MenuItem[]): MenuEntityRef[] {\n  const seen = new Set<string>()\n  const refs: MenuEntityRef[] = []\n\n  function walk(nodes: readonly MenuItem[]): void {\n    for (const node of nodes) {\n      const link = node.link\n      if (link?.kind === 'entity') {\n        const key = `${link.entity}:${link.id}`\n        if (!seen.has(key)) {\n          seen.add(key)\n          refs.push({ entity: link.entity, id: link.id })\n        }\n      }\n      walk(node.children)\n    }\n  }\n\n  walk(items)\n  return refs\n}\n","/**\n * Block-anchor collection — the pure half of the anchors endpoint\n * (plan/routing phase 08 §5 / 09 §7, SD027).\n *\n * **Leaf module.** No `@murumets-ee/core`, no DB, no `@murumets-ee/blocks`\n * import: it walks a raw `field.blockTree()` JSONB value structurally, the same\n * way `get-menu.ts` walks a raw menu tree. That keeps the walk unit-testable\n * without a database and keeps this package's dependency direction unchanged\n * (blocks is UPSTREAM of menus, so nothing here reaches back into it).\n *\n * The anchor charset + length bound come from `../menu-item-schema.ts`, this\n * package's single owner of them — an intra-package import of a deliberately\n * pure module, NOT a new dependency direction. They used to be mirrored here;\n * a drift between the READ side (what the picker offers) and the WRITE side\n * (what `LinkValueSchema` accepts) would let the endpoint list anchors the menu\n * schema then rejects. Routing PR10 Task 3b converged them.\n *\n * **Bounded by construction** (CLAUDE.md \"no unbounded fan-out\"). The value\n * being walked is admin-authored, not a public payload — but it is still\n * untrusted-SHAPE JSONB (a hand-edited row, a restored dump, a future editor\n * bug), and this runs on an interactive picker's request path. So the walk is\n * ITERATIVE (never recursive — a deep tree must not blow the stack), carries a\n * hard visited-node budget, and hard-caps the returned list. Both bounds report\n * truncation to the caller so it can log; nothing is ever silently dropped.\n */\n\nimport { ANCHOR_PATTERN, type BlockAnchor, MAX_ANCHOR_LENGTH } from '../menu-item-schema.js'\n\n/**\n * Max length of a picker label. Mirrors `menu-item-schema.ts`'s\n * `MAX_LABEL_LENGTH`. `anchorLabel` is a free-text block field with no\n * declared `maxLength`, so a pathological value falls back to the anchor\n * itself rather than being truncated into something the editor never wrote.\n */\nexport const MAX_ANCHOR_LABEL_LENGTH = 200\n\n/**\n * Visited-node budget for one layout walk.\n *\n * Deliberately larger than `MAX_MENU_TREE_NODES` (500): a page layout is a\n * richer document than a hand-curated navigation menu. Past this the walk\n * stops and reports `truncated` — the bound that keeps a corrupted or hostile\n * layout from turning an interactive picker request into unbounded work.\n */\nexport const MAX_LAYOUT_NODES = 1000\n\n/**\n * Max anchors returned in one response. A picker listing more than this is not\n * a usable UI, and the cap bounds the response body independently of the node\n * budget.\n */\nexport const MAX_ANCHOR_RESULTS = 200\n\n/**\n * 🔴 THERE IS NO BLOCK-TYPE LIST HERE ANY MORE, and its removal is the fix\n * rather than a simplification.\n *\n * This was `new Set(['section', 'text'])`. The `editor` plan's PR05 merges\n * `section` into `container` (D002), and this list is the one place in the repo\n * where that rename fails SILENTLY: `readAnchor` would return `undefined` for\n * every renamed block, so every section anchor on every site would vanish from\n * the menu link picker with no error, no log line and no failing test. F027\n * audited five hardcoded block-name lists and found the frightening one (rent's\n * contract renderer, which THROWS) is safe — it names `richtext`/`text`/\n * `divider`/`spacer` and the rename never reaches it — while this one, which\n * looks harmless, is the dangerous one precisely because it is quiet.\n *\n * \"Import the constant\" is not available: this module deliberately imports\n * nothing (`blocks` is UPSTREAM of `menus`, so the dependency runs the other\n * way), and adding `'container'` beside `'section'` would leave the same trap\n * armed for the next rename.\n *\n * So the type gate is GONE and the data answers the question instead: a block\n * is anchorable if it carries a slug-shaped `anchor` prop. That is what the\n * list was a proxy for — `anchorFields` is spread into exactly the blocks that\n * are addressable, so the field's PRESENCE is the declaration and the name was\n * only ever a second, driftable copy of it.\n *\n * The widening is bounded on every axis that matters, and by guards that\n * already existed rather than by new ones: {@link MAX_LAYOUT_NODES} caps the\n * walk, {@link MAX_ANCHOR_RESULTS} caps the response, `ANCHOR_PATTERN` +\n * {@link MAX_ANCHOR_LENGTH} reject anything that is not a slug, and duplicates\n * are dropped. A block type that happens to carry an unrelated `anchor` prop\n * would now be offered — no such block exists in any vocabulary in this repo,\n * and being offered an extra jump target is a far smaller failure than a\n * picker that silently lists nothing.\n */\n\n/** {@link collectBlockAnchors}' result, including what it had to drop. */\nexport interface CollectAnchorsResult {\n  anchors: BlockAnchor[]\n  /** `true` when the node budget or the result cap cut the walk short. */\n  truncated: boolean\n  /** Nodes actually visited — for the truncation log line. */\n  visited: number\n}\n\n/** Structural minimum of a pino/toolkit logger (declared, not imported). */\ninterface AnchorWalkLogger {\n  warn(obj: object, msg: string): void\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value)\n}\n\n/**\n * Read a usable anchor off a raw block node's `props`, or `undefined`.\n *\n * Returns `undefined` for every failure mode (missing / non-string / empty /\n * over-long / non-slug value) — the picker simply doesn't offer it.\n */\nfunction readAnchor(node: Record<string, unknown>): BlockAnchor | undefined {\n  const props = node.props\n  if (!isPlainObject(props)) return undefined\n\n  const anchor = props.anchor\n  if (typeof anchor !== 'string') return undefined\n  if (anchor.length === 0 || anchor.length > MAX_ANCHOR_LENGTH) return undefined\n  if (!ANCHOR_PATTERN.test(anchor)) return undefined\n\n  const rawLabel = props.anchorLabel\n  const label =\n    typeof rawLabel === 'string' &&\n    rawLabel.length > 0 &&\n    rawLabel.length <= MAX_ANCHOR_LABEL_LENGTH\n      ? rawLabel\n      : anchor\n\n  return { anchor, label }\n}\n\n/**\n * Walk a raw `field.blockTree()` value and collect every addressable anchor, in\n * document order.\n *\n * Duplicate anchors are RETURNED AS-IS — cross-block uniqueness is deliberately\n * not enforced in v1 (plan/routing F044 point 6); the endpoint lists whatever\n * exists so a colliding anchor is visible to the editor rather than silently\n * collapsed.\n *\n * @param tree Raw JSONB value. Any non-array input yields an empty result.\n * @param logger Optional — receives one line per bound that fired.\n */\nexport function collectBlockAnchors(\n  tree: unknown,\n  logger?: AnchorWalkLogger,\n): CollectAnchorsResult {\n  const anchors: BlockAnchor[] = []\n  if (!Array.isArray(tree)) return { anchors, truncated: false, visited: 0 }\n\n  // `Array.isArray` narrows `unknown` to `any[]`; re-binding through a\n  // `readonly unknown[]` annotation keeps every element typed as `unknown`\n  // instead of leaking `any` into the walk.\n  const roots: readonly unknown[] = tree\n\n  let visited = 0\n  let truncated = false\n\n  // Explicit stack, NOT recursion — a 50k-deep layout must not blow the\n  // stack. Pushed in reverse so `pop()` yields document order. Bounded the\n  // SAME way the children-push path below is: cap how many root entries get\n  // copied onto the stack, rather than `[...roots].reverse()`ing the WHOLE\n  // array unconditionally before the budget check ever runs — a\n  // pathologically large root-level array (a restored dump, a hand-edited\n  // row) would otherwise force a full O(N) copy+reverse on the request\n  // thread regardless of `MAX_LAYOUT_NODES`, defeating the \"bounded by\n  // construction\" guarantee this module's header documents.\n  if (roots.length > MAX_LAYOUT_NODES) truncated = true\n  const stack: unknown[] = []\n  for (let i = Math.min(roots.length, MAX_LAYOUT_NODES) - 1; i >= 0; i--) stack.push(roots[i])\n\n  while (stack.length > 0) {\n    if (visited >= MAX_LAYOUT_NODES || anchors.length >= MAX_ANCHOR_RESULTS) {\n      truncated = true\n      break\n    }\n    const node = stack.pop()\n    // Count every stack pop against the budget, not just plain-object nodes —\n    // a non-object entry still costs a loop iteration, and the budget exists\n    // to bound WORK, not \"real\" nodes. Counting only objects let a `children`\n    // array full of non-object junk (or a malformed dump) iterate past the cap\n    // entirely, defeating the bound this comment block claims exists.\n    visited++\n    if (!isPlainObject(node)) continue\n\n    const found = readAnchor(node)\n    if (found !== undefined) anchors.push(found)\n\n    const children = node.children\n    if (Array.isArray(children)) {\n      const items: readonly unknown[] = children\n      // Push at most as many children as remain in the budget — pushing a\n      // node's ENTIRE children array regardless of size (the old behaviour)\n      // let one node's oversized array blow past the budget in a single step,\n      // before the loop ever got to re-check it. Any children left unpushed\n      // are exactly as truncated as a node the budget cut off outright.\n      const room = Math.max(MAX_LAYOUT_NODES - visited, 0)\n      if (items.length > room) truncated = true\n      for (let i = Math.min(items.length, room) - 1; i >= 0; i--) stack.push(items[i])\n    }\n  }\n\n  if (truncated) {\n    logger?.warn(\n      {\n        visited,\n        collected: anchors.length,\n        nodeBudget: MAX_LAYOUT_NODES,\n        resultCap: MAX_ANCHOR_RESULTS,\n      },\n      'anchor collection stopped at a hard bound — the returned list is incomplete',\n    )\n  }\n\n  return { anchors, truncated, visited }\n}\n","/**\n * `resolveMenuItemSummaries()` — live title + broken/unpublished status for\n * every entity target a stored menu tree points at (plan/routing phase 09 §3:\n * item rows show \"target summary … broken/unpublished badge\").\n *\n * **Deliberately NOT `getMenu`'s machinery.** `getMenu` resolves menus for\n * ANONYMOUS PUBLIC requests, so it elevates to a system REACH context — one\n * that withholds `view_unpublished`, which is what makes its reads\n * publish-filtered (D017 made that filter conditional on the permission; it is\n * no longer unconditional for any principal). The admin editor is the opposite\n * case:\n *\n *  - it MUST surface a DRAFT target's title (an editor may be building\n *    navigation for content that isn't published yet), which rules out\n *    `QueryClient` — that client filters to `status = 'published'` for any\n *    principal without `view_unpublished` (D017), so every draft-linked item\n *    would look broken for exactly the roles that most need the editor to\n *    work. `AdminClient` has no publish filter at all, which is the right\n *    tool here;\n *  - it MUST respect the REAL signed-in admin's own grants and scope — no\n *    elevation. If that admin cannot view an entity type, the editor correctly\n *    shows no title for it. Least privilege, not convenience.\n *\n * So this goes through `app.getClient(entity)` — the framework-managed,\n * request-bound `AdminClient` — batched by entity type exactly like\n * `@murumets-ee/admin-ui`'s `resolveRowTitles`, but with richer per-row output.\n *\n * **No unbounded fan-out** (CLAUDE.md). Backend work is bounded by the number\n * of distinct ENTITY TYPES, never by item count: one `findMany` per type group.\n * The ref count is capped at {@link MAX_MENU_TREE_NODES} (the same bound the\n * stored tree the caller walked already carries) and the group count at\n * {@link MAX_MENU_ENTITY_TYPES}. Anything dropped is logged — never silently\n * truncated.\n *\n * Called ONCE, server-side, by the menu editor page (RSC → props; no\n * `useEffect` fetching, per CLAUDE.md). Items added client-side via the link\n * picker already carry their title from the picker, so they need no round-trip.\n */\n\nimport type { ToolkitApp } from '@murumets-ee/core'\nimport type { Entity } from '@murumets-ee/entity'\nimport { getEntityTitleField } from '@murumets-ee/entity'\nimport { inArray } from 'drizzle-orm'\nimport { MAX_MENU_ENTITY_TYPES } from '../get-menu.js'\nimport { column } from '../internal/columns.js'\nimport { MAX_MENU_TREE_NODES, type MenuItemSummary } from '../menu-item-schema.js'\n\n/** Key shape of {@link resolveMenuItemSummaries}' result map. */\nfunction summaryKey(entity: string, id: string): string {\n  return `${entity}:${id}`\n}\n\nconst BROKEN: MenuItemSummary = { title: null, exists: false, published: null }\n\n/**\n * Group refs by entity type, deduping ids and stopping at the hard ref bound.\n *\n * Returns the bounded groups plus what was dropped, so the caller logs once\n * rather than per drop.\n */\nfunction groupRefs(refs: ReadonlyArray<{ entity: string; id: string }>): {\n  groups: Map<string, Set<string>>\n  droppedRefs: number\n  droppedGroups: number\n} {\n  const groups = new Map<string, Set<string>>()\n  let distinct = 0\n  let droppedRefs = 0\n\n  for (const ref of refs) {\n    if (typeof ref.entity !== 'string' || typeof ref.id !== 'string') continue\n    if (ref.entity.length === 0 || ref.id.length === 0) continue\n\n    const bucket = groups.get(ref.entity)\n    if (bucket?.has(ref.id)) continue // already counted — duplicates are free\n    if (distinct >= MAX_MENU_TREE_NODES) {\n      droppedRefs++\n      continue\n    }\n    distinct++\n    if (bucket) bucket.add(ref.id)\n    else groups.set(ref.entity, new Set([ref.id]))\n  }\n\n  const droppedGroups = Math.max(0, groups.size - MAX_MENU_ENTITY_TYPES)\n  return { groups, droppedRefs, droppedGroups }\n}\n\n/**\n * Batch-resolve the live title + existence + publish state of every\n * `{ entity, id }` target, keyed `` `${entity}:${id}` `` (the same key shape\n * `resolveRowTitles` uses).\n *\n * **A MISSING map entry means \"not resolvable here\", NOT \"broken.\"** It happens\n * when the entity type isn't registered in this app, when the caller holds no\n * `view` grant on it, when that group's read failed, or (for a `team`/`user`-\n * scoped entity only) when the row belongs to a different scope than this\n * request's — a scope filter excludes it the same way a delete would, and\n * this function cannot tell the two apart. Callers should render such items\n * as indeterminate — only an explicit `exists: false` (reported ONLY for a\n * `global`-scoped entity, where no scope filter can ever apply) means the\n * target was really deleted.\n *\n * Best-effort per group: one group's failure never takes down the others (and\n * therefore never takes down the editor page).\n */\nexport async function resolveMenuItemSummaries(\n  app: ToolkitApp,\n  refs: ReadonlyArray<{ entity: string; id: string }>,\n): Promise<Map<string, MenuItemSummary>> {\n  const summaries = new Map<string, MenuItemSummary>()\n  if (refs.length === 0) return summaries\n\n  const logger = app.logger.child({ resolve: 'menu-item-summaries' })\n  const { groups, droppedRefs, droppedGroups } = groupRefs(refs)\n\n  if (droppedRefs > 0) {\n    logger.warn(\n      { dropped: droppedRefs, cap: MAX_MENU_TREE_NODES },\n      'menu item summaries dropped targets over the ref budget — some rows will show no status',\n    )\n  }\n  if (droppedGroups > 0) {\n    logger.warn(\n      { dropped: droppedGroups, cap: MAX_MENU_ENTITY_TYPES },\n      'menu item summaries dropped entity-type groups over the fan-out cap',\n    )\n  }\n\n  // Groups are independent and their count is already hard-capped, so this is a\n  // BOUNDED concurrent fan-out (≤ MAX_MENU_ENTITY_TYPES), not an unbounded\n  // `Promise.all` over caller-controlled input.\n  await Promise.all(\n    [...groups.entries()]\n      .slice(0, MAX_MENU_ENTITY_TYPES)\n      .map(([entityName, idSet]) => resolveGroup(app, logger, entityName, idSet, summaries)),\n  )\n\n  return summaries\n}\n\nasync function resolveGroup(\n  app: ToolkitApp,\n  logger: ToolkitApp['logger'],\n  entityName: string,\n  idSet: ReadonlySet<string>,\n  out: Map<string, MenuItemSummary>,\n): Promise<void> {\n  // Unregistered type — leave NO entry (see the \"missing entry\" contract):\n  // claiming `exists: false` would flag every item as broken just because a\n  // plugin isn't loaded in this process.\n  const entity: Entity | undefined = app.entities.get(entityName)\n  if (entity === undefined) return\n\n  const titleField = getEntityTitleField(entity)\n  // `getEntityTitleField` degrades to `'id'` when nothing is display-able. The\n  // row still EXISTS; it just has no title to show.\n  const hasTitle = titleField !== 'id'\n  const isPublishable = entity.behaviors?.some((b) => b.name === 'publishable') ?? false\n  const ids = [...idSet]\n\n  try {\n    const client = app.getClient(entity)\n    // `AdminClient`, so rows come back regardless of publish state — the whole\n    // point (see the module header). Bounded by `ids.length`, itself bounded by\n    // `MAX_MENU_TREE_NODES`.\n    const rows = await client.findMany({\n      where: inArray(column(client.getTable(), 'id'), ids),\n      limit: ids.length,\n    })\n\n    const seen = new Set<string>()\n    for (const row of rows) {\n      const record: Record<string, unknown> = row\n      const id = record.id\n      if (typeof id !== 'string') continue\n      const rawTitle = hasTitle ? record[titleField] : undefined\n      seen.add(id)\n      out.set(summaryKey(entityName, id), {\n        title: typeof rawTitle === 'string' && rawTitle.length > 0 ? rawTitle : null,\n        exists: true,\n        published: isPublishable ? record.status === 'published' : null,\n      })\n    }\n\n    // An id asked for and not returned is USUALLY gone — but for a `team`/\n    // `user`-scoped entity it can also mean \"belongs to a different scope than\n    // this request's\", which `findMany` filters out silently (same\n    // `strictScope: false` fail-open every admin read path shares — see\n    // `packages/core/src/client-factories.ts`). Claiming `exists: false` there\n    // would tell an admin to delete a perfectly live row just because it's\n    // outside their current scope — the exact false alarm the \"missing entry\n    // is indeterminate\" contract exists to prevent. Only a `global`-scoped\n    // entity (no scope filter can ever apply) gets the real broken signal;\n    // anything else is left unresolved (indeterminate) instead.\n    const canTrustAbsence = (entity.scope ?? 'global') === 'global'\n    if (canTrustAbsence) {\n      for (const id of ids) {\n        if (!seen.has(id)) out.set(summaryKey(entityName, id), BROKEN)\n      }\n    }\n  } catch (error) {\n    // Best-effort, per group: a denied entity, a pre-migration table or a\n    // transient read failure must degrade THIS group's badges, not blank the\n    // whole editor page. Logged (never a silent swallow) and left with no\n    // entries, which callers read as indeterminate rather than broken.\n    logger.warn(\n      { entity: entityName, count: ids.length, error: String(error) },\n      'menu item summaries could not be resolved for this entity type',\n    )\n  }\n}\n","/**\n * Admin API routes for `@murumets-ee/menus`.\n *\n * **URL surface served by this module:**\n *\n *   - GET /api/admin/menus/anchors?entity=&id=  — addressable block anchors on\n *     one published document, for the menu editor's anchor picker\n *     (plan/routing phase 08 §5 / 09 §4 + §7).\n *   - GET /api/admin/menus/editor-state?handle=  — a menu's full tree + editor\n *     metadata (summaries, locales, entityTypes, canPublish) by handle. Feeds\n *     `@murumets-ee/menus-ui`'s Tier 3 in-place menu editor surface\n *     (`MenuBlock.customEditorSurface`, `plan/blocks/08-adaptive-ui.md`\n *     §\"Tier 3\") the same props shape the standalone `/admin/menu/[id]` page\n *     builds server-side — see `./editor-state.ts`'s module header for the\n *     v1 scope trade-off (no draft/lock parity).\n *\n * Menu CRUD itself is plain entity CRUD (the `menu` entity is served by\n * admin-ui's generic entity family), so it deliberately has no route here —\n * the embedded editor's Save/Publish buttons PATCH straight through that\n * existing entity-CRUD route, same as the standalone page.\n *\n * ## Security posture\n *\n * The anchors endpoint reads ANOTHER entity's content, so it is gated TWICE:\n *\n * 1. The declarative `menu:view` gate the framework wrapper enforces before\n *    the handler runs — \"may this caller work with menus at all?\".\n * 2. An in-handler `ctx.checkPermission(<target entity>, 'view')` — \"may this\n *    caller see THAT entity's content?\". The static gate can't express this:\n *    the target entity is a request parameter (the exact \"multi-entity routes\n *    ... per-entity permission checks\" case `AdminRouteHandler`'s contract\n *    documents), and without it any menu editor could read the layout of an\n *    entity type they hold no grant on.\n *\n * **Every negative outcome INSIDE the handler answers `200 []`, never 403/404**\n * — no permission on the target entity, unknown entity, entity with no block\n * tree, missing / unpublished / deleted row. One uniform response means the\n * endpoint discloses nothing about which entity types exist, which are\n * block-backed, or which ids are real. (Gate 1 above still answers a real\n * `403` for a caller who lacks `menu:view` itself — that gate protects the\n * endpoint as a whole, not a specific target, so there is no oracle risk in\n * it answering truthfully.) A malformed REQUEST (missing/short/over-long\n * `entity`, non-uuid `id`) still 400s — that is a fact about the caller's own\n * request, not about our data.\n *\n * Reads go through a `QueryClient` bound to the REAL caller's identity and\n * scope — deliberately NOT the elevated `SYSTEM_CONTEXT` that\n * `menu-resolve-context.ts` uses for public rendering. `QueryClient` excludes\n * trashed rows and publish-filters, which is exactly phase 08 §5's \"walking\n * its published layout\": a draft page exposes no anchors, and the picker's\n * manual-string entry is the documented fallback for that case (07 §2.6).\n *\n * Since D017 (plan/api PR04) that publish filter is CONDITIONAL on the\n * caller's `view_unpublished` grant, so this route withholds that one action\n * from the checker it hands the client. The reason is a PRODUCT contract, not\n * a permission one: an anchor picker exists to build navigation that WORKS,\n * and an anchor that only exists in an unpublished layout is a link that 404s\n * (or jumps nowhere) for every visitor. \"Published layout\" is the definition\n * of the endpoint, so it must not vary by who is asking. Nothing is concealed\n * from a privileged caller here — an editor who may read the draft can read it\n * through the normal entity API; they just don't get to pick anchors out of it.\n */\n\nimport {\n  type AdminRoute,\n  type AdminRouteHandler,\n  combineAdminRoutes,\n  defineAdminRoute,\n  getContext,\n  getCurrentApp,\n  getCurrentScope,\n  siteSecurityFields,\n} from '@murumets-ee/core'\nimport type { Entity, SecurityContext } from '@murumets-ee/entity'\nimport {\n  getBlockTreeFieldName,\n  getSearchableConfig,\n  VIEW_UNPUBLISHED_ACTION,\n} from '@murumets-ee/entity'\nimport { QueryClient } from '@murumets-ee/entity/query'\nimport { eq } from 'drizzle-orm'\nimport { Menu } from '../entity.js'\nimport { column } from '../internal/columns.js'\nimport { normalizeMenuEntityTypes } from '../menu-entity-types.js'\nimport { DEFAULT_MENU_DEPTH, MAX_MENU_DEPTH } from '../menu-item-schema.js'\nimport { collectMenuEntityRefs, normalizeMenuTree } from '../menu-tree-normalize.js'\nimport { collectBlockAnchors } from './anchors.js'\nimport type { MenuEditorStateResponse } from './editor-state.js'\nimport { resolveMenuItemSummaries } from './summaries.js'\n\n// ---------------------------------------------------------------------------\n// Request validation\n// ---------------------------------------------------------------------------\n\n/** Canonical UUID shape for the `id` query param. */\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\n/**\n * Longest `entity` param accepted, rejected before any lookup. Mirrors\n * `menu-item-schema.ts`'s `MAX_ENTITY_NAME_LENGTH` — the same bound the write\n * path already applies to an entity name inside a stored link.\n */\nconst MAX_ENTITY_NAME_LENGTH = 64\n\n/**\n * Role stand-in when the authenticated user carries none.\n *\n * `SecurityContext.user.groups` MUST be non-empty: `resolveAuthContext` reads\n * `groups[0]` and throws `ForbiddenError` on an empty array BEFORE it ever\n * consults the checker. The VALUE is inert here — the checker below ignores\n * its `role` argument and delegates to `ctx.checkPermission`, which the API\n * handler already bound to the caller's real role — so the least-privileged\n * built-in role is the honest placeholder.\n */\nconst FALLBACK_ROLE = 'viewer'\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nfunction jsonResponse(data: unknown, status = 200): Response {\n  return new Response(JSON.stringify(data), {\n    status,\n    headers: { 'Content-Type': 'application/json' },\n  })\n}\n\nfunction jsonError(message: string, status: number): Response {\n  return jsonResponse({ error: message }, status)\n}\n\n/** The one uniform \"nothing to offer\" answer — see the module header. */\nfunction noAnchors(): Response {\n  return jsonResponse([])\n}\n\n/**\n * Name of the entity's `field.blockTree()` slot, or `null` when it has none.\n *\n * This WAS a deliberately local linear scan, justified on the grounds that\n * neither `@murumets-ee/blocks`' `resolveBlockTreeField` nor admin-ui's\n * `getBlocksFieldName` was reachable from this package — blocks' lives behind\n * its server entry, and admin-ui is a UI package `menus` must not depend on.\n * The reasoning was right and the conclusion was one step short: the answer\n * belongs in the LEAF all three already depend on. It now lives in\n * `@murumets-ee/entity` (`block-tree-fields.ts`), so this is a `null`-shaped\n * adaptor rather than a sixth copy of the loop.\n */\nfunction findBlockTreeField(entity: Entity): string | null {\n  return getBlockTreeFieldName(entity) ?? null\n}\n\n// ---------------------------------------------------------------------------\n// GET /api/admin/menus/anchors\n// ---------------------------------------------------------------------------\n\nconst handleAnchors: AdminRouteHandler = async (req, ctx) => {\n  const params = new URL(req.url).searchParams\n  const entityName = params.get('entity')\n  const id = params.get('id')\n\n  // Boundary validation. These 400s describe the CALLER'S request, so they\n  // disclose nothing about our data.\n  if (entityName === null || entityName.length === 0) {\n    return jsonError(\"query param 'entity' is required\", 400)\n  }\n  if (entityName.length > MAX_ENTITY_NAME_LENGTH) {\n    return jsonError(\"query param 'entity' is too long\", 400)\n  }\n  if (id === null || !UUID_RE.test(id)) {\n    return jsonError(\"query param 'id' must be a uuid\", 400)\n  }\n\n  const app = getCurrentApp()\n  if (app === undefined) {\n    // Handlers always run inside `runWithContextAsync`; no app means the\n    // request never got a context, which is an internal wiring fault.\n    return jsonError('Internal error', 500)\n  }\n  const logger = app.logger.child({ route: 'menus/anchors', entity: entityName })\n\n  // Gate 2 — the per-target-entity check (see the module header). Answers with\n  // the same empty list as every other negative outcome.\n  if (!ctx.checkPermission(entityName, 'view')) {\n    logger.debug(\n      { userId: ctx.user.id, role: ctx.user.role },\n      'anchors lookup returned empty — caller holds no view grant on the target entity',\n    )\n    return noAnchors()\n  }\n\n  const entity = app.entities.get(entityName)\n  if (entity === undefined) return noAnchors()\n\n  const blockTreeField = findBlockTreeField(entity)\n  // Not a block-tree-backed content type, so nothing on it is addressable.\n  if (blockTreeField === null) return noAnchors()\n\n  // Bound to the REAL caller — same identity, role and data scope the rest of\n  // this request runs under. `scope` matters: without it a `team`/`user`-scoped\n  // entity would skip its isolation filter on this read path.\n  const scope = getCurrentScope()\n  const client = new QueryClient({\n    entity,\n    db: app.db.readOnly,\n    logger,\n    contextResolver: (): SecurityContext => ({\n      user: { id: ctx.user.id, groups: [ctx.user.role ?? FALLBACK_ROLE] },\n      // Delegates to the caller's real grants for everything EXCEPT\n      // `view_unpublished` (D017), which this endpoint pins closed regardless\n      // of role — see the file header for why \"published layout\" is part of\n      // the endpoint's definition rather than a visibility decision.\n      checker: (_role, resource, action) =>\n        action !== VIEW_UNPUBLISHED_ACTION && ctx.checkPermission(resource, action),\n      ...(scope !== undefined && { scope }),\n      ...siteSecurityFields(undefined, app),\n    }),\n  })\n\n  // `locale` drives BOTH the per-locale publish filter and the translation\n  // merge, so a translatable block tree resolves to the layout the admin is\n  // actually editing. The client publish-filters (see the checker above), so a\n  // draft / trashed / deleted row simply isn't found.\n  const row = await client.findById(id, {\n    ...(ctx.locale !== undefined && { locale: ctx.locale }),\n    ...(ctx.defaultLocale !== undefined && { defaultLocale: ctx.defaultLocale }),\n  })\n  if (row === null) return noAnchors()\n\n  const record: Record<string, unknown> = row\n  const { anchors } = collectBlockAnchors(record[blockTreeField], logger)\n  return jsonResponse(anchors)\n}\n\nconst anchorsRoute = defineAdminRoute({\n  prefix: 'menus',\n  path: 'anchors',\n  method: 'GET',\n  // Building a menu is the umbrella capability; the per-target-entity `view`\n  // check inside the handler is the least-privilege half.\n  permission: 'menu:view',\n  // Mirrors the `menu` entity's own admin-only write posture (`entity.ts`):\n  // only admins build menus today. `registerPermission` UNIONS default roles\n  // across registrations, so this can only add, never narrow.\n  defaultRoles: ['admin'],\n  description:\n    \"List a published document's addressable block anchors for the menu editor's anchor picker.\",\n  handler: handleAnchors,\n})\n\n// ---------------------------------------------------------------------------\n// GET /api/admin/menus/editor-state — the Tier 3 block-editor surface's read\n// ---------------------------------------------------------------------------\n\n/** Longest `handle` accepted — mirrors `get-menu.ts`'s own local bound. */\nconst MAX_HANDLE_LENGTH = 128\n\nconst handleEditorState: AdminRouteHandler = async (req, ctx) => {\n  const handle = new URL(req.url).searchParams.get('handle')\n  if (handle === null || handle.length === 0) {\n    return jsonError(\"query param 'handle' is required\", 400)\n  }\n  if (handle.length > MAX_HANDLE_LENGTH) {\n    return jsonError(\"query param 'handle' is too long\", 400)\n  }\n\n  const app = getCurrentApp()\n  if (app === undefined) return jsonError('Internal error', 500)\n  const logger = app.logger.child({ route: 'menus/editor-state' })\n\n  // Bound to the REAL caller (same `app.getClient` framework accessor\n  // `resolveMenuItemSummaries` uses below) — no elevation. A caller who\n  // cannot view menus never reaches this handler at all (the route's static\n  // `permission: 'menu:view'` gate below), so this is the ordinary\n  // request-scoped client, not `createSystemAdminClient`.\n  const client = app.getClient(Menu)\n  const rows = await client.findMany({\n    where: eq(column(client.getTable(), 'handle'), handle),\n    limit: 1,\n  })\n  const row = rows[0] as Record<string, unknown> | undefined\n  if (row === undefined) return jsonError('Menu not found', 404)\n\n  const id = row.id as string\n  const title = typeof row.title === 'string' ? row.title : ''\n  const storedMaxDepth = row.maxDepth\n  const maxDepth =\n    typeof storedMaxDepth === 'number' && Number.isInteger(storedMaxDepth) && storedMaxDepth >= 1\n      ? Math.min(storedMaxDepth, MAX_MENU_DEPTH)\n      : DEFAULT_MENU_DEPTH\n  const status: 'draft' | 'published' = row.status === 'published' ? 'published' : 'draft'\n\n  // Codes only (no display labels) — see `RequestContext.availableLocales`.\n  // Falling back to the code itself as the label is the same idiom\n  // `generic-block-editor.tsx` uses when no richer locale registry is wired.\n  const localeCodes = getContext()?.availableLocales\n  const defaultLocale = ctx.defaultLocale ?? localeCodes?.[0] ?? 'en'\n  // `MenuTreeEditorProps.defaultLocale` is contractually \"always present in\n  // `locales`\", but the two come from DIFFERENT sources — `defaultLocale` from\n  // `ctx.defaultLocale`, the list from the request's enabled `availableLocales`\n  // — so they can disagree (a default locale that was later disabled, or a\n  // context that carries one but not the other). When they do, prepend it:\n  // otherwise the editor's preview switcher omits the very locale the tree is\n  // authored in, and \"preview as default\" becomes unreachable.\n  const enabled = localeCodes && localeCodes.length > 0 ? [...localeCodes] : []\n  const codes = enabled.includes(defaultLocale) ? enabled : [defaultLocale, ...enabled]\n  const locales = codes.map((code) => ({ code, label: code }))\n\n  const draft = await loadPendingDraft(app, id, logger)\n  const draftData = draft?.data\n\n  // Seed from the pending DRAFT when there is one, else the live row — the\n  // same precedence `MenuEditorPage` applies, and the same `EntityForm`\n  // applies generally. Without it the editor would show the LIVE tree under a\n  // banner saying \"you are editing a pending draft\", and a Save would silently\n  // republish the pre-draft structure.\n  const treeSource = draftData !== undefined && 'tree' in draftData ? draftData.tree : row.tree\n\n  // The SAME tolerant per-node narrowing the standalone `/admin/menu/[id]`\n  // page uses (`../menu-tree-normalize.ts` — one implementation, deliberately).\n  //\n  // NOT a strict whole-tree `buildMenuTreeSchema().safeParse`: that whitelists\n  // locale KEYS against the app's currently-ENABLED locales, so disabling a\n  // locale after items were authored for it failed the entire parse and\n  // collapsed the tree to `[]` — a subsequent save from this surface would\n  // then persist that wipe, while the standalone page (already tolerant) kept\n  // every valid node from the same row. Two editing paths to the same data\n  // must not disagree on malformed input.\n  //\n  // Whatever IS unreadable is counted, not swallowed: `droppedItemCount`\n  // rides the response, and `<MenuTreeEditor>` refuses to save past it\n  // without an explicit confirm.\n  const { items: tree, dropped: droppedItemCount } = normalizeMenuTree(treeSource)\n  if (droppedItemCount > 0) {\n    logger.warn(\n      { menuId: id, handle, dropped: droppedItemCount },\n      'menu editor-state: stored tree contained items that could not be read — the embedded editor shows the rest',\n    )\n  }\n\n  const summaryMap = await resolveMenuItemSummaries(app, collectMenuEntityRefs(tree))\n  const summaries = Object.fromEntries(summaryMap)\n\n  // Same derivation `MenuEditorPage.resolveLinkEntityTypes` uses, minus the\n  // admin-ui label helper (this package must not depend on `admin-ui` — see\n  // the module header on `../plugin.ts`'s sibling `menus-ui` for why the\n  // dependency runs the other way). `labelSingular` is the closest built-in\n  // equivalent to a type-picker's \"one item of this type\" label.\n  const entityTypes = [...app.entities.values()]\n    .filter(\n      (entity) =>\n        getSearchableConfig(entity) !== undefined && ctx.checkPermission(entity.name, 'view'),\n    )\n    .map((entity) => ({\n      name: entity.name,\n      label: entity.admin?.labelSingular ?? entity.admin?.label ?? entity.name,\n    }))\n\n  const canPublish = ctx.checkPermission('menu', 'publish')\n\n  // Same draft-then-live precedence as the tree above (routing PR12 added the\n  // per-menu whitelist): a pending draft that narrowed which content types the\n  // menu accepts must be what the editor shows, or a Save would silently\n  // republish the pre-draft selection.\n  const acceptedEntityTypes = normalizeMenuEntityTypes(\n    draftData !== undefined && 'entityTypes' in draftData ? draftData.entityTypes : row.entityTypes,\n  )\n\n  const body: MenuEditorStateResponse = {\n    menu: { id, handle, title, maxDepth, status, tree, entityTypes: acceptedEntityTypes },\n    summaries,\n    locales,\n    defaultLocale,\n    droppedItemCount,\n    entityTypes,\n    canPublish,\n    ...(draft !== undefined && { draft }),\n  }\n  return jsonResponse(body)\n}\n\n/**\n * A menu's draft + lock are keyed by the DEFAULT snapshot key, never the\n * admin's current content locale: one tree serves every locale (D009), so a\n * per-locale draft would let two locales hold divergent copies of the same\n * structure. `'_'` is the api-handler's own default-snapshot key.\n * `MenuEditorPage` uses the same constant for the same reason.\n */\nconst MENU_SNAPSHOT_LOCALE = '_'\n\n/**\n * The pending draft for this menu, or `undefined`.\n *\n * Read through the REQUEST'S own `AdminClient` (`app.getClient`), so the\n * entity firewall applies exactly as it does everywhere else — no elevation.\n *\n * Failure degrades to \"no draft\" rather than failing the request, matching\n * `MenuEditorPage.loadMenuEditState`: a partially-down draft subsystem should\n * not take the editing surface down with it, and every write is re-authorized\n * server-side regardless of what this returns.\n *\n * ⚠️ **`ContentClient` is imported LAZILY, and must stay that way.**\n * `@murumets-ee/content/client` is `server-only`-tagged, and this module is on\n * the `lumi.config.ts` load path: `menus-ui`'s `menus()` plugin factory\n * statically imports `menusRoutes` from this entry, and the CLI / worker load\n * that config through jiti, which does NOT apply the `react-server` export\n * condition — so a MODULE-SCOPE import of it throws the instant `lumi migrate`\n * (or any other command) loads the config, taking every CLI command down with\n * it. A static import here did exactly that; `pnpm verify:plugin-loads` is the\n * gate that catches it (`packages/menus/dist/admin.mjs` failed to load).\n *\n * The dynamic import defers the module to CALL time, which only ever happens\n * inside a real admin-API request — i.e. inside RSC, where `server-only`\n * resolves to its empty stub. Exactly the same lazy-thunk technique, and the\n * same reasoning, as the page factories in `menus-ui`'s `plugin.ts`.\n */\nasync function loadPendingDraft(\n  app: NonNullable<ReturnType<typeof getCurrentApp>>,\n  menuId: string,\n  logger: { warn(obj: object, msg: string): void },\n): Promise<MenuEditorStateResponse['draft']> {\n  try {\n    const { ContentClient } = await import('@murumets-ee/content/client')\n    const contentClient = new ContentClient({ admin: app.getClient(Menu), entity: Menu })\n    const entry = await contentClient.getDraft(menuId, MENU_SNAPSHOT_LOCALE)\n    if (!entry) return undefined\n    return {\n      data: entry.data,\n      createdBy: entry.createdBy,\n      createdByName: entry.createdByName,\n      // The response is JSON, so normalise `Date | string` to a string here\n      // rather than letting `JSON.stringify` do it implicitly — the declared\n      // response type then matches what actually crosses the wire.\n      updatedAt:\n        entry.updatedAt instanceof Date ? entry.updatedAt.toISOString() : String(entry.updatedAt),\n    }\n  } catch (err) {\n    logger.warn({ err, menuId }, 'menu editor-state: draft state unavailable — continuing without')\n    return undefined\n  }\n}\n\nconst editorStateRoute = defineAdminRoute({\n  prefix: 'menus',\n  path: 'editor-state',\n  method: 'GET',\n  // Same gate the standalone `/admin/menu/[id]` page uses (`menus-ui/plugin.ts`\n  // — `requires: 'menu:view'`). Mutations still go through the entity's own\n  // `menu:update` / `menu:publish` gates on the generic entity CRUD routes —\n  // this endpoint is read-only.\n  permission: 'menu:view',\n  defaultRoles: ['admin'],\n  description:\n    \"Read a menu's full tree + editor metadata by handle, for the blocks editor's in-place Tier 3 menu surface.\",\n  handler: handleEditorState,\n})\n\n/**\n * Every admin route this package contributes, in the `AdminRoute[]` shape\n * `createAdminApiHandler` consumes.\n *\n * Wired declaratively via the plugin's `server.routes` slot — see\n * `@murumets-ee/menus-ui`.\n *\n * @example\n * ```ts\n * import { menusRoutes } from '@murumets-ee/menus/admin'\n *\n * definePlugin({ name: '…', server: { routes: menusRoutes() } })\n * ```\n */\nexport function menusRoutes(): AdminRoute[] {\n  return combineAdminRoutes([anchorsRoute, editorStateRoute])\n}\n"],"mappings":"2lBAkCA,MAAa,EAAiB,EAYjB,EAAsB,IA+BtB,EAAoB,IAmBpB,EAAiB,mBAmIjB,EAAkB,EAAE,mBAAmB,OAAQ,CAC1D,EAAE,OAAO,CACP,KAAM,EAAE,QAAQ,QAAQ,EACxB,OAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,EAA0B,EACpD,GAAI,EAAE,OAAO,CAAC,CAAC,KAAK,EACpB,OAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,GAAqB,CAAC,CAAC,MAAM,CAAc,CAAC,CAAC,SAAS,CAClF,CAAC,EACD,EAAE,OAAO,CACP,KAAM,EAAE,QAAQ,KAAK,EAQrB,IAAK,EACF,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,IAAmB,CAAC,CACxB,UAAW,GAAU,EAAa,CAAK,CAAC,CAAC,CACzC,OAAQ,GAAU,IAAU,GAAI,CAC/B,QACE,6FACJ,CAAC,CACL,CAAC,EACD,EAAE,OAAO,CACP,KAAM,EAAE,QAAQ,OAAO,EACvB,MAAO,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,CACnC,CAAC,CACH,CAAC,EAaD,SAAS,EACP,EACA,EAC8D,CAC9D,IAAM,EAAU,IAAI,IAAI,CAAc,EACtC,OAAO,EACJ,QAAQ,CAAC,CACT,aAAa,EAAO,IAAQ,CAG3B,GAAsB,OAAO,GAAU,WAAnC,GAA+C,MAAM,QAAQ,CAAK,EAAG,OAEzE,IAAM,EAAO,OAAO,KAAK,CAAK,EAS9B,GAAI,EAAK,OAAS,EAAQ,KAAM,CAC9B,EAAI,SAAS,CACX,KAAM,EAAE,aAAa,OACrB,QAAS,kDAAkD,CAAC,GAAG,CAAO,CAAC,CAAC,KAAK,IAAI,GACnF,CAAC,EACD,MACF,CAIA,IAAK,IAAM,KAAO,EACX,EAAQ,IAAI,CAAG,GAClB,EAAI,SAAS,CACX,KAAM,EAAE,aAAa,OACrB,KAAM,CAAC,CAAG,EAIV,QAAS,gDAAgD,CAAC,GAAG,CAAO,CAAC,CAAC,KAAK,IAAI,GACjF,CAAC,CAGP,CAAC,CAAC,CACD,KAAK,EAAE,OAAO,EAAE,OAAO,EAAG,CAAW,CAAC,CAC3C,CAQA,SAAgB,EACd,EAC4C,CAC5C,IAAM,EAAW,EAAU,EAAE,OAAO,CAAC,CAAC,IAAI,GAAgB,EAAG,EAAQ,cAAc,EAC7E,EAAa,EAAU,EAAE,QAAQ,EAAG,EAAQ,cAAc,EAE1D,EAAqD,EAAE,SAC3D,EACG,OAAO,CACN,GAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAkB,EAC5C,KAAM,EAAE,KAAK,CAAC,OAAQ,QAAQ,CAAC,EAC/B,KAAM,EAAgB,SAAS,EAC/B,MAAO,EAAS,SAAS,CAAC,CAAC,QAAQ,IAAI,EACvC,QAAS,EAAW,SAAS,EAC7B,OAAQ,EAAE,QAAQ,CAAC,CAAC,SAAS,EAC7B,SAAU,EAAE,MAAM,CAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CACtC,CAAC,CAAC,CACD,aAAa,EAAM,IAAQ,CAC1B,GAAI,EAAK,OAAS,OAAQ,CACpB,EAAK,OAAS,IAAA,IAChB,EAAI,SAAS,CACX,KAAM,EAAE,aAAa,OACrB,KAAM,CAAC,MAAM,EACb,QAAS,oCACX,CAAC,EAEH,MACF,CAEI,EAAK,OAAS,IAAA,IAChB,EAAI,SAAS,CACX,KAAM,EAAE,aAAa,OACrB,KAAM,CAAC,MAAM,EACb,QAAS,4CACX,CAAC,GAIC,EAAK,QAAU,MAAQ,OAAO,KAAK,EAAK,KAAK,CAAC,CAAC,SAAW,IAC5D,EAAI,SAAS,CACX,KAAM,EAAE,aAAa,OACrB,KAAM,CAAC,OAAO,EACd,QAAS,wDACX,CAAC,CAEL,CAAC,CACL,EAEA,OAAO,CACT,CAGA,SAAgB,EACd,EAC8C,CAC9C,OAAO,EAAE,MAAM,EAAoB,CAAO,CAAC,CAC7C,CAmBA,SAAgB,EAAgB,EAAoC,CAClE,GAAI,CAAC,MAAM,QAAQ,CAAI,EAAG,MAAO,CAAE,MAAO,EAAG,UAAW,CAAE,EAE1D,IAAI,EAAW,EACX,EAAY,EAKV,EAAiDC,EAAM,IAAK,IAAU,CAAE,OAAM,MAAO,CAAE,EAAE,EAE/F,KAAO,EAAM,OAAS,GAAG,CACvB,IAAM,EAAU,EAAM,IAAI,EAC1B,GAAI,IAAY,IAAA,GAAW,MAC3B,GAAM,CAAE,OAAM,SAAU,EACxB,GAAqB,OAAO,GAAS,WAAjC,GAA6C,MAAM,QAAQ,CAAI,EAAG,SAOtE,GALA,IACI,EAAQ,IAAU,EAAW,GAI7B,EAAA,KAAmC,EAAA,EACrC,MAAO,CAAE,MAAO,EAAU,WAAU,EAGtC,IAAM,EAAY,EAAgC,SAClD,GAAI,MAAM,QAAQ,CAAQ,EAAG,CAC3B,IAAM,EAA4B,EAClC,IAAK,IAAM,KAAS,EAAO,EAAM,KAAK,CAAE,KAAM,EAAO,MAAO,EAAQ,CAAE,CAAC,CACzE,CACF,CAEA,MAAO,CAAE,MAAO,EAAU,WAAU,CACtC,CAQA,SAAgB,GAAkB,EAAe,EAA2B,CAC1E,OAAO,EAAgB,CAAI,CAAC,CAAC,OAAS,CACxC,CCjYA,MAAM,EAAiB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,EAA0B,EAWtD,GAA2E,EACrF,MAAM,CAAc,CAAC,CAKrB,IAAA,EAAkC,CAAC,CACnC,SAAS,CAAC,CACV,UAAW,GAAU,CACpB,GAAI,IAAU,KAAM,OAAO,KAC3B,IAAM,EAAU,CAAC,GAAG,IAAI,IAAI,CAAK,CAAC,EAClC,OAAO,EAAQ,SAAW,EAAI,KAAO,CACvC,CAAC,EAYH,SAAgB,GAAyB,EAAiC,CACxE,GAAI,CAAC,MAAM,QAAQ,CAAK,EAAG,OAAO,KAGlC,IAAM,EAA0B,EAE1B,EAAgB,CAAC,EACjB,EAAO,IAAI,IACjB,IAAK,IAAM,KAAS,EACd,YAAO,GAAU,UAAY,EAAM,SAAW,IAC9C,IAAM,OAAA,KACN,GAAK,IAAI,CAAK,IAClB,EAAK,IAAI,CAAK,EACd,EAAI,KAAK,CAAK,EACV,EAAI,SAAA,IAA2C,MAErD,OAAO,EAAI,SAAW,EAAI,KAAO,CACnC,CCpEA,SAAS,EAA6B,EAA4B,CAC3D,KAAK,KAAK,SAAS,aAAa,EACrC,MAAM,IAAI,EAAE,SAAS,CACnB,CACE,KAAM,SACN,KAAM,CAAC,aAAa,EACpB,QACE,mBAAmB,EAAK,WAAW,qNAGvC,CACF,CAAC,CACH,CAGA,SAASC,GAAa,EAA+B,CACnD,OAAO,IAAI,EAAE,SACX,EAAM,OAAO,IAAK,IAAW,CAAE,GAAG,EAAO,KAAM,CAAC,cAAe,GAAG,EAAM,IAAI,CAAE,EAAE,CAClF,CACF,CAYA,SAAS,EAAoB,EAAwD,CACnF,GAAI,EAAE,gBAAiB,GAAO,OAAO,EAErC,IAAM,EAAS,GAAsB,UAAU,EAAK,WAAW,EAC/D,GAAI,CAAC,EAAO,QAAS,MAAMA,GAAa,EAAO,KAAK,EACpD,MAAO,CAAE,GAAG,EAAM,YAAa,EAAO,IAAK,CAC7C,CASA,SAAgB,GAGd,CACA,MAAO,CACL,KAAM,4BACN,MAAO,CACL,aAAc,KAAO,IAAS,EAAoB,CAAI,EACtD,aAAc,MAAO,EAAK,IAAS,EAAoB,CAAI,CAC7D,EACA,iBAAkB,CACpB,CACF,CCzDA,SAAS,EAAU,EAAiB,EAA+B,CAAC,EAAe,CACjF,OAAO,IAAI,EAAE,SAAS,CAAC,CAAE,KAAM,EAAE,aAAa,OAAQ,KAAM,CAAC,OAAQ,GAAG,CAAI,EAAG,SAAQ,CAAC,CAAC,CAC3F,CAGA,SAAS,EAAa,EAA+B,CACnD,OAAO,IAAI,EAAE,SAAS,EAAM,OAAO,IAAK,IAAW,CAAE,GAAG,EAAO,KAAM,CAAC,OAAQ,GAAG,EAAM,IAAI,CAAE,EAAE,CAAC,CAClG,CAGA,SAAS,EAAa,EAAoC,CACpD,YAAO,GAAU,UAAY,CAAC,OAAO,UAAU,CAAK,IACpD,IAAQ,GAAK,EAAA,GACjB,OAAO,CACT,CAWA,eAAe,EACb,EACA,EACA,EACiB,CACjB,IAAM,EAAc,EAAa,EAAK,QAAQ,EAC9C,GAAI,IAAgB,IAAA,GAAW,OAAO,EACtC,GAAI,CAAC,EAAU,MAAA,GAEf,GAAI,CAAC,GAAK,YAKR,MAAU,MACR,qJAEF,EASF,OAAO,GAAa,MAPE,EAAI,YAAY,EAAA,EAOT,QAAQ,GAAA,CACvC,CAaA,eAAe,EACb,EACA,EACe,CAGf,IAAM,EAAW,EAAa,EAAK,QAAQ,EAC3C,GAAI,IAAa,IAAA,GAAW,OAE5B,GAAI,CAAC,GAAK,YAGR,MAAU,MACR,yJAEF,EAMF,GAAM,CAAE,SAAU,GAAgB,MAHZ,EAAI,YAAY,EAAA,EAGK,IAAI,EAC/C,GAAI,EAAQ,EACV,MAAM,EACJ,kCAAkC,EAAM,sDACrB,EAAS,2BAC9B,CAEJ,CAOA,eAAe,EACb,EACA,EACA,EACA,EACkC,CAClC,IAAM,EAAO,EAAK,KAClB,GAAI,IAAS,IAAA,GAIX,OADI,GAAU,MAAM,EAAqC,EAAM,CAAG,EAC3D,EAET,GAAI,IAAS,MAAQ,CAAC,MAAM,QAAQ,CAAI,EACtC,MAAM,EAAU,0CAA0C,EAK5D,GAAM,CAAE,QAAO,aAAc,EAAgB,CAAI,EACjD,GAAI,EAAA,IACF,MAAM,EAAU,wCAA2D,EAE7E,GAAI,EAAA,EACF,MAAM,EAAU,wDAAwE,EAG1F,IAAM,EAAS,EAAoB,CAAE,eAAgB,EAAsB,CAAE,CAAC,CAAC,CAAC,UAAU,CAAI,EAC9F,GAAI,CAAC,EAAO,QAAS,MAAM,EAAa,EAAO,KAAK,EAEpD,IAAM,EAAW,MAAM,EAAgB,EAAM,EAAK,CAAQ,EAC1D,GAAI,EAAQ,EACV,MAAM,EAAU,yDAAyD,EAAS,EAAE,EAGtF,MAAO,CAAE,GAAG,EAAM,KAAM,EAAO,IAAK,CACtC,CAUA,SAAgB,GACd,EACsD,CACtD,IAAM,EACJ,GAAS,4BAAgC,EAAiB,CAAC,CAAC,QAAQ,IAAK,GAAM,EAAE,IAAI,GAEvF,MAAO,CACL,KAAM,qBACN,MAAO,CACL,aAAc,MAAO,EAAM,IAAQ,EAAa,EAAM,EAAK,GAAO,CAAqB,EACvF,aAAc,MAAO,EAAK,EAAM,IAAQ,EAAa,EAAM,EAAK,GAAM,CAAqB,CAC7F,CACF,CACF,CCvLA,MAAa,EAAO,EAAa,CAC/B,KAAM,OAGN,KAAM,QACN,MAAO,CACL,MAAO,QACP,KAAM,MACR,EACA,OAAQ,CAMN,OAAQ,EAAM,KAAK,CAAE,KAAM,OAAQ,CAAC,EACpC,MAAO,EAAM,KAAK,CAAE,SAAU,EAAK,CAAC,EAEpC,SAAU,EAAM,OAAO,CACrB,QAAA,EACA,IAAK,EACL,IAAA,EACA,QAAS,EACX,CAAC,EAMD,KAAM,EAAM,KAAK,CAAE,QAAS,GAAM,QAAS,CAAC,CAAE,CAAC,EAU/C,YAAa,EAAM,KAAK,CAAE,QAAS,IAAK,CAAC,CAC3C,EACA,UAAW,CAAC,EAAU,EAAG,EAAY,EAAG,GAAmB,EAAG,EAA0B,CAAC,EACzF,MAAO,SAMP,OAAQ,CACN,KAAM,SACN,OAAQ,cACR,OAAQ,cACR,OAAQ,aACV,CACF,CAAC,ECxDD,SAAgB,EAEd,EACA,EACU,CACV,OAAQ,EAAyC,EACnD,CCkDA,SAASC,EAAc,EAAkD,CACvE,OAAyB,OAAO,GAAU,YAAnC,GAA+C,CAAC,MAAM,QAAQ,CAAK,CAC5E,CASA,SAAS,EACP,EACA,EAC+B,CAC/B,GAAI,CAACA,EAAc,CAAK,EAAG,OAC3B,IAAM,EAAyB,CAAC,EAChC,IAAK,GAAM,CAAC,EAAK,KAAU,OAAO,QAAQ,CAAK,EACzC,EAAU,CAAK,IAAG,EAAI,GAAO,GAEnC,OAAO,CACT,CAEA,MAAM,EAAY,GAAoC,OAAO,GAAU,SACjE,EAAa,GAAqC,OAAO,GAAU,UAOzE,SAAgB,EAAkB,EAAoC,CACpE,IAAI,EAAA,IACA,EAAU,EAEd,SAAS,EAAK,EAAc,EAA2B,CACrD,GAAI,CAAC,MAAM,QAAQ,CAAG,EAAG,MAAO,CAAC,EAGjC,IAAM,EAA+B,EACrC,GAAI,EAAA,EAIF,MADA,IAAW,EAAS,OACb,CAAC,EAGV,IAAM,EAAkB,CAAC,EACzB,IAAK,IAAM,KAAQ,EAAU,CAC3B,GAAI,CAACA,EAAc,CAAI,EAAG,CACxB,IACA,QACF,CAEA,IAAM,EAAK,EAAK,GACV,EAAO,EAAK,KAClB,GAAI,OAAO,GAAO,UAAY,EAAG,SAAW,EAAG,CAC7C,IACA,QACF,CACA,GAAI,IAAS,QAAU,IAAS,SAAU,CACxC,IACA,QACF,CAEA,IAAI,EACJ,GAAI,IAAS,OAAQ,CAKnB,IAAM,EAAS,EAAgB,UAAU,EAAK,IAAI,EAClD,GAAI,CAAC,EAAO,QAAS,CACnB,IACA,QACF,CACA,EAAO,EAAO,IAChB,MAAO,GAAI,EAAK,OAAS,IAAA,GAAW,CAGlC,IACA,QACF,CAEA,GAAI,GAAU,EAAG,CACf,IACA,QACF,CACA,IAWA,IAAM,EAAW,EAAU,EAAK,MAAO,CAAQ,EACzC,EACJ,IAAa,IAAA,IAAa,OAAO,KAAK,CAAQ,CAAC,CAAC,OAAS,EAAI,EAAW,IAAA,GACpE,EAAa,EAAU,EAAK,QAAS,CAAS,EAC9C,EACJ,IAAe,IAAA,IAAa,OAAO,KAAK,CAAU,CAAC,CAAC,OAAS,EAAI,EAAa,IAAA,GAChF,EAAI,KAAK,CACP,KACA,OACA,OAEA,MAAO,GAAS,KAChB,UACA,OAAQ,OAAO,EAAK,QAAW,UAAY,EAAK,OAAS,IAAA,GACzD,SAAU,EAAK,EAAK,SAAU,EAAQ,CAAC,CACzC,CAAC,CACH,CACA,OAAO,CACT,CAEA,MAAO,CAAE,MAAO,EAAK,EAAO,CAAC,EAAG,SAAQ,CAC1C,CAWA,SAAgB,EAAsB,EAA6C,CACjF,IAAM,EAAO,IAAI,IACX,EAAwB,CAAC,EAE/B,SAAS,EAAK,EAAkC,CAC9C,IAAK,IAAM,KAAQ,EAAO,CACxB,IAAM,EAAO,EAAK,KAClB,GAAI,GAAM,OAAS,SAAU,CAC3B,IAAM,EAAM,GAAG,EAAK,OAAO,GAAG,EAAK,KAC9B,EAAK,IAAI,CAAG,IACf,EAAK,IAAI,CAAG,EACZ,EAAK,KAAK,CAAE,OAAQ,EAAK,OAAQ,GAAI,EAAK,EAAG,CAAC,EAElD,CACA,EAAK,EAAK,QAAQ,CACpB,CACF,CAGA,OADA,EAAK,CAAK,EACH,CACT,CCnLA,MAAa,EAAmB,IA0DhC,SAAS,EAAc,EAAkD,CACvE,OAAyB,OAAO,GAAU,YAAnC,GAA+C,CAAC,MAAM,QAAQ,CAAK,CAC5E,CAQA,SAAS,GAAW,EAAwD,CAC1E,IAAM,EAAQ,EAAK,MACnB,GAAI,CAAC,EAAc,CAAK,EAAG,OAE3B,IAAM,EAAS,EAAM,OAGrB,GAFI,OAAO,GAAW,UAClB,EAAO,SAAW,GAAK,EAAO,OAAA,KAC9B,CAAC,EAAe,KAAK,CAAM,EAAG,OAElC,IAAM,EAAW,EAAM,YAQvB,MAAO,CAAE,SAAQ,MANf,OAAO,GAAa,UACpB,EAAS,OAAS,GAClB,EAAS,QAAA,IACL,EACA,CAEiB,CACzB,CAcA,SAAgB,GACd,EACA,EACsB,CACtB,IAAM,EAAyB,CAAC,EAChC,GAAI,CAAC,MAAM,QAAQ,CAAI,EAAG,MAAO,CAAE,UAAS,UAAW,GAAO,QAAS,CAAE,EAKzE,IAAM,EAA4B,EAE9B,EAAU,EACV,EAAY,GAWZ,EAAM,OAAA,MAA2B,EAAY,IACjD,IAAM,EAAmB,CAAC,EAC1B,IAAK,IAAI,EAAI,KAAK,IAAI,EAAM,OAAQ,CAAgB,EAAI,EAAG,GAAK,EAAG,IAAK,EAAM,KAAK,EAAM,EAAE,EAE3F,KAAO,EAAM,OAAS,GAAG,CACvB,GAAI,GAAA,KAA+B,EAAQ,QAAA,IAA8B,CACvE,EAAY,GACZ,KACF,CACA,IAAM,EAAO,EAAM,IAAI,EAOvB,GADA,IACI,CAAC,EAAc,CAAI,EAAG,SAE1B,IAAM,EAAQ,GAAW,CAAI,EACzB,IAAU,IAAA,IAAW,EAAQ,KAAK,CAAK,EAE3C,IAAM,EAAW,EAAK,SACtB,GAAI,MAAM,QAAQ,CAAQ,EAAG,CAC3B,IAAM,EAA4B,EAM5B,EAAO,KAAK,IAAI,EAAmB,EAAS,CAAC,EAC/C,EAAM,OAAS,IAAM,EAAY,IACrC,IAAK,IAAI,EAAI,KAAK,IAAI,EAAM,OAAQ,CAAI,EAAI,EAAG,GAAK,EAAG,IAAK,EAAM,KAAK,EAAM,EAAE,CACjF,CACF,CAcA,OAZI,GACF,GAAQ,KACN,CACE,UACA,UAAW,EAAQ,OACnB,WAAY,EACZ,UAAA,GACF,EACA,6EACF,EAGK,CAAE,UAAS,YAAW,SAAQ,CACvC,CCxKA,SAAS,EAAW,EAAgB,EAAoB,CACtD,MAAO,GAAG,EAAO,GAAG,GACtB,CAEA,MAAM,GAA0B,CAAE,MAAO,KAAM,OAAQ,GAAO,UAAW,IAAK,EAQ9E,SAAS,GAAU,EAIjB,CACA,IAAM,EAAS,IAAI,IACf,EAAW,EACX,EAAc,EAElB,IAAK,IAAM,KAAO,EAAM,CAEtB,GADI,OAAO,EAAI,QAAW,UAAY,OAAO,EAAI,IAAO,UACpD,EAAI,OAAO,SAAW,GAAK,EAAI,GAAG,SAAW,EAAG,SAEpD,IAAM,EAAS,EAAO,IAAI,EAAI,MAAM,EAChC,OAAQ,IAAI,EAAI,EAAE,EACtB,IAAI,GAAA,IAAiC,CACnC,IACA,QACF,CACA,IACI,EAAQ,EAAO,IAAI,EAAI,EAAE,EACxB,EAAO,IAAI,EAAI,OAAQ,IAAI,IAAI,CAAC,EAAI,EAAE,CAAC,CAAC,CAH7C,CAIF,CAEA,IAAM,EAAgB,KAAK,IAAI,EAAG,EAAO,KAAA,EAA4B,EACrE,MAAO,CAAE,SAAQ,cAAa,eAAc,CAC9C,CAoBA,eAAsB,EACpB,EACA,EACuC,CACvC,IAAM,EAAY,IAAI,IACtB,GAAI,EAAK,SAAW,EAAG,OAAO,EAE9B,IAAM,EAAS,EAAI,OAAO,MAAM,CAAE,QAAS,qBAAsB,CAAC,EAC5D,CAAE,SAAQ,cAAa,iBAAkB,GAAU,CAAI,EAwB7D,OAtBI,EAAc,GAChB,EAAO,KACL,CAAE,QAAS,EAAa,IAAA,GAAyB,EACjD,yFACF,EAEE,EAAgB,GAClB,EAAO,KACL,CAAE,QAAS,EAAe,IAAA,EAA2B,EACrD,qEACF,EAMF,MAAM,QAAQ,IACZ,CAAC,GAAG,EAAO,QAAQ,CAAC,CAAC,CAClB,MAAM,EAAA,EAAwB,CAAC,CAC/B,KAAK,CAAC,EAAY,KAAW,GAAa,EAAK,EAAQ,EAAY,EAAO,CAAS,CAAC,CACzF,EAEO,CACT,CAEA,eAAe,GACb,EACA,EACA,EACA,EACA,EACe,CAIf,IAAM,EAA6B,EAAI,SAAS,IAAI,CAAU,EAC9D,GAAI,IAAW,IAAA,GAAW,OAE1B,IAAM,EAAa,EAAoB,CAAM,EAGvC,EAAW,IAAe,KAC1B,EAAgB,EAAO,WAAW,KAAM,GAAM,EAAE,OAAS,aAAa,GAAK,GAC3E,EAAM,CAAC,GAAG,CAAK,EAErB,GAAI,CACF,IAAM,EAAS,EAAI,UAAU,CAAM,EAI7B,EAAO,MAAM,EAAO,SAAS,CACjC,MAAO,EAAQ,EAAO,EAAO,SAAS,EAAG,IAAI,EAAG,CAAG,EACnD,MAAO,EAAI,MACb,CAAC,EAEK,EAAO,IAAI,IACjB,IAAK,IAAM,KAAO,EAAM,CACtB,IAAM,EAAkC,EAClC,EAAK,EAAO,GAClB,GAAI,OAAO,GAAO,SAAU,SAC5B,IAAM,EAAW,EAAW,EAAO,GAAc,IAAA,GACjD,EAAK,IAAI,CAAE,EACX,EAAI,IAAI,EAAW,EAAY,CAAE,EAAG,CAClC,MAAO,OAAO,GAAa,UAAY,EAAS,OAAS,EAAI,EAAW,KACxE,OAAQ,GACR,UAAW,EAAgB,EAAO,SAAW,YAAc,IAC7D,CAAC,CACH,CAaA,IADyB,EAAO,OAAS,YAAc,aAEhD,IAAM,KAAM,EACV,EAAK,IAAI,CAAE,GAAG,EAAI,IAAI,EAAW,EAAY,CAAE,EAAG,EAAM,CAGnE,OAAS,EAAO,CAKd,EAAO,KACL,CAAE,OAAQ,EAAY,MAAO,EAAI,OAAQ,MAAO,OAAO,CAAK,CAAE,EAC9D,gEACF,CACF,CACF,CCpHA,MAAM,GAAU,kEAyBhB,SAAS,EAAa,EAAe,EAAS,IAAe,CAC3D,OAAO,IAAI,SAAS,KAAK,UAAU,CAAI,EAAG,CACxC,SACA,QAAS,CAAE,eAAgB,kBAAmB,CAChD,CAAC,CACH,CAEA,SAAS,EAAU,EAAiB,EAA0B,CAC5D,OAAO,EAAa,CAAE,MAAO,CAAQ,EAAG,CAAM,CAChD,CAGA,SAAS,GAAsB,CAC7B,OAAO,EAAa,CAAC,CAAC,CACxB,CAcA,SAAS,GAAmB,EAA+B,CACzD,OAAO,EAAsB,CAAM,GAAK,IAC1C,CAoFA,MAAM,GAAe,EAAiB,CACpC,OAAQ,QACR,KAAM,UACN,OAAQ,MAGR,WAAY,YAIZ,aAAc,CAAC,OAAO,EACtB,YACE,6FACF,QAAS,MA3FqC,EAAK,IAAQ,CAC3D,IAAM,EAAS,IAAI,IAAI,EAAI,GAAG,CAAC,CAAC,aAC1B,EAAa,EAAO,IAAI,QAAQ,EAChC,EAAK,EAAO,IAAI,IAAI,EAI1B,GAAI,IAAe,MAAQ,EAAW,SAAW,EAC/C,OAAO,EAAU,mCAAoC,GAAG,EAE1D,GAAI,EAAW,OAAS,GACtB,OAAO,EAAU,mCAAoC,GAAG,EAE1D,GAAI,IAAO,MAAQ,CAAC,GAAQ,KAAK,CAAE,EACjC,OAAO,EAAU,kCAAmC,GAAG,EAGzD,IAAM,EAAM,EAAc,EAC1B,GAAI,IAAQ,IAAA,GAGV,OAAO,EAAU,iBAAkB,GAAG,EAExC,IAAM,EAAS,EAAI,OAAO,MAAM,CAAE,MAAO,gBAAiB,OAAQ,CAAW,CAAC,EAI9E,GAAI,CAAC,EAAI,gBAAgB,EAAY,MAAM,EAKzC,OAJA,EAAO,MACL,CAAE,OAAQ,EAAI,KAAK,GAAI,KAAM,EAAI,KAAK,IAAK,EAC3C,iFACF,EACO,EAAU,EAGnB,IAAM,EAAS,EAAI,SAAS,IAAI,CAAU,EAC1C,GAAI,IAAW,IAAA,GAAW,OAAO,EAAU,EAE3C,IAAM,EAAiB,GAAmB,CAAM,EAEhD,GAAI,IAAmB,KAAM,OAAO,EAAU,EAK9C,IAAM,EAAQ,EAAgB,EAsBxB,EAAM,MAAM,IArBC,EAAY,CAC7B,SACA,GAAI,EAAI,GAAG,SACX,SACA,qBAAyC,CACvC,KAAM,CAAE,GAAI,EAAI,KAAK,GAAI,OAAQ,CAAC,EAAI,KAAK,MAAQ,QAAa,CAAE,EAKlE,SAAU,EAAO,EAAU,IACzB,IAAW,GAA2B,EAAI,gBAAgB,EAAU,CAAM,EAC5E,GAAI,IAAU,IAAA,IAAa,CAAE,OAAM,EACnC,GAAG,EAAmB,IAAA,GAAW,CAAG,CACtC,EACF,CAMuB,CAAC,CAAC,SAAS,EAAI,CACpC,GAAI,EAAI,SAAW,IAAA,IAAa,CAAE,OAAQ,EAAI,MAAO,EACrD,GAAI,EAAI,gBAAkB,IAAA,IAAa,CAAE,cAAe,EAAI,aAAc,CAC5E,CAAC,EACD,GAAI,IAAQ,KAAM,OAAO,EAAU,EAGnC,GAAM,CAAE,WAAY,GAAoBC,EAAO,GAAiB,CAAM,EACtE,OAAO,EAAa,CAAO,CAC7B,CAgBA,CAAC,EASK,GAAuC,MAAO,EAAK,IAAQ,CAC/D,IAAM,EAAS,IAAI,IAAI,EAAI,GAAG,CAAC,CAAC,aAAa,IAAI,QAAQ,EACzD,GAAI,IAAW,MAAQ,EAAO,SAAW,EACvC,OAAO,EAAU,mCAAoC,GAAG,EAE1D,GAAI,EAAO,OAAS,IAClB,OAAO,EAAU,mCAAoC,GAAG,EAG1D,IAAM,EAAM,EAAc,EAC1B,GAAI,IAAQ,IAAA,GAAW,OAAO,EAAU,iBAAkB,GAAG,EAC7D,IAAM,EAAS,EAAI,OAAO,MAAM,CAAE,MAAO,oBAAqB,CAAC,EAOzD,EAAS,EAAI,UAAU,CAAI,EAK3B,GAAM,MAJO,EAAO,SAAS,CACjC,MAAO,EAAG,EAAO,EAAO,SAAS,EAAG,QAAQ,EAAG,CAAM,EACrD,MAAO,CACT,CAAC,EAAA,CACgB,GACjB,GAAI,IAAQ,IAAA,GAAW,OAAO,EAAU,iBAAkB,GAAG,EAE7D,IAAM,EAAK,EAAI,GACT,EAAQ,OAAO,EAAI,OAAU,SAAW,EAAI,MAAQ,GACpD,EAAiB,EAAI,SACrB,EACJ,OAAO,GAAmB,UAAY,OAAO,UAAU,CAAc,GAAK,GAAkB,EACxF,KAAK,IAAI,EAAA,CAA8B,EAAA,EAEvC,EAAgC,EAAI,SAAW,YAAc,YAAc,QAK3E,EAAc,EAAW,CAAC,EAAE,iBAC5B,EAAgB,EAAI,eAAiB,IAAc,IAAM,KAQzD,EAAU,GAAe,EAAY,OAAS,EAAI,CAAC,GAAG,CAAW,EAAI,CAAC,EAEtE,GADQ,EAAQ,SAAS,CAAa,EAAI,EAAU,CAAC,EAAe,GAAG,CAAO,EAAA,CAC9D,IAAK,IAAU,CAAE,OAAM,MAAO,CAAK,EAAE,EAErD,EAAQ,MAAM,GAAiB,EAAK,EAAI,CAAM,EAC9C,EAAY,GAAO,KAuBnB,CAAE,MAAO,EAAM,QAAS,GAAqB,EAhBhC,IAAc,IAAA,IAAa,SAAU,EAAY,EAAU,KAAO,EAAI,IAgBV,EAC3E,EAAmB,GACrB,EAAO,KACL,CAAE,OAAQ,EAAI,SAAQ,QAAS,CAAiB,EAChD,4GACF,EAGF,IAAM,EAAa,MAAM,EAAyB,EAAK,EAAsB,CAAI,CAAC,EAC5E,EAAY,OAAO,YAAY,CAAU,EAOzC,EAAc,CAAC,GAAG,EAAI,SAAS,OAAO,CAAC,CAAC,CAC3C,OACE,GACC,EAAoB,CAAM,IAAM,IAAA,IAAa,EAAI,gBAAgB,EAAO,KAAM,MAAM,CACxF,CAAC,CACA,IAAK,IAAY,CAChB,KAAM,EAAO,KACb,MAAO,EAAO,OAAO,eAAiB,EAAO,OAAO,OAAS,EAAO,IACtE,EAAE,EAEE,EAAa,EAAI,gBAAgB,OAAQ,SAAS,EAoBxD,OAAO,EAAa,CATlB,KAAM,CAAE,KAAI,SAAQ,QAAO,WAAU,SAAQ,OAAM,YALzB,GAC1B,IAAc,IAAA,IAAa,gBAAiB,EAAY,EAAU,YAAc,EAAI,WAIF,CAAE,EACpF,YACA,UACA,gBACA,mBACA,cACA,aACA,GAAI,IAAU,IAAA,IAAa,CAAE,OAAM,CAEd,CAAC,CAC1B,EAqCA,eAAe,GACb,EACA,EACA,EAC2C,CAC3C,GAAI,CACF,GAAM,CAAE,iBAAkB,MAAM,OAAO,+BAEjC,EAAQ,MAAM,IADM,EAAc,CAAE,MAAO,EAAI,UAAU,CAAI,EAAG,OAAQ,CAAK,CACnD,CAAC,CAAC,SAAS,EAAQ,GAAoB,EAEvE,OADK,EACE,CACL,KAAM,EAAM,KACZ,UAAW,EAAM,UACjB,cAAe,EAAM,cAIrB,UACE,EAAM,qBAAqB,KAAO,EAAM,UAAU,YAAY,EAAI,OAAO,EAAM,SAAS,CAC5F,EAVY,MAWd,OAAS,EAAK,CACZ,EAAO,KAAK,CAAE,MAAK,QAAO,EAAG,iEAAiE,EAC9F,MACF,CACF,CAEA,MAAM,GAAmB,EAAiB,CACxC,OAAQ,QACR,KAAM,eACN,OAAQ,MAKR,WAAY,YACZ,aAAc,CAAC,OAAO,EACtB,YACE,6GACF,QAAS,EACX,CAAC,EAgBD,SAAgB,IAA4B,CAC1C,OAAO,EAAmB,CAAC,GAAc,EAAgB,CAAC,CAC5D"}
+{"version":3,"file":"admin.mjs","names":["MAX_HANDLE_LENGTH","isPlainObject","isPlainObject","record"],"sources":["../src/get-menu.ts","../src/menu-tree-normalize.ts","../src/admin/anchors.ts","../src/admin/summaries.ts","../src/admin/routes.ts"],"sourcesContent":["/**\n * `getMenu()` — turn a stored menu tree into a render-ready structure for one\n * locale (plan/routing phase 11 §2), plus the pure `markActiveTrail()` helper\n * (phase 11 §3).\n *\n * **Leaf module.** Every cross-package capability (the menu row read, the\n * `toolkit_paths` forward index, the publish gate, live entity titles) arrives\n * through the injected {@link MenuResolveDeps}; nothing here imports\n * `@murumets-ee/core` or `@murumets-ee/content`. Concrete deps are built from a\n * live app in `./menu-resolve-context.ts` — the same leaf/seam split\n * `@murumets-ee/content`'s `paths/enumerate.ts` ↔ `paths/resolve-context.ts`\n * uses, and the reason the deps' function types are declared structurally here\n * rather than imported (assignability is still checked, at the seam).\n *\n * **Security.** The resolved output feeds PUBLIC page navigation, so it must\n * never surface an unpublished or deleted document:\n *  - the menu itself is read through a publish-filtered client (an unpublished\n *    menu resolves to `null` — nothing renders),\n *  - every entity-linked item must have BOTH a canonical path in\n *    `toolkit_paths` for the requested locale AND survive the batched publish\n *    gate; missing either → the item (and its subtree) is dropped,\n *  - `url` / `email` targets are re-gated through the same `sanitizeHref`\n *    protocol allowlist the write path uses, so a value that reached the column\n *    by some route other than the entity API (a direct DB edit, a restored\n *    dump) still cannot become a `javascript:` href,\n *  - every filtering decision fails CLOSED — anything unresolvable is dropped,\n *    never rendered with a placeholder.\n *\n * **No unbounded fan-out** (CLAUDE.md). Backend work is bounded by the number\n * of distinct ENTITY TYPES in the tree, never by the number of items: the walk\n * collects ids grouped by type, then issues at most THREE batched calls per\n * group (forward index → publish gate → titles). The group count is itself hard-\n * capped ({@link MAX_MENU_ENTITY_TYPES}) and the walk carries a node budget\n * ({@link MAX_MENU_TREE_NODES}), so one render costs a fixed, small number of\n * round-trips no matter what the stored tree looks like.\n *\n * **Read-time validation is per-node, not whole-tree.** The write path already\n * runs `buildMenuTreeSchema()` (`menuTreeValidation()`), and this module\n * deliberately does NOT re-run it: that schema whitelists locale KEYS against\n * the app's configured locales, so re-parsing at read time would fail the WHOLE\n * menu — site navigation gone — the moment an operator removes a locale from\n * config after a menu was saved. The locale whitelist is a write-time authoring\n * check with no read-time security value. What DOES matter at read time (node\n * shape, the `LinkValue` protocol gate) is re-checked per node here, and a\n * malformed node is dropped on its own without taking the menu down with it.\n */\n\nimport { resolveLinkHref } from '@murumets-ee/blocks/links'\nimport {\n  DEFAULT_MENU_DEPTH,\n  LinkValueSchema,\n  MAX_MENU_DEPTH,\n  MAX_MENU_TREE_NODES,\n  type MenuLinkValue,\n} from './menu-item-schema.js'\n\n// ---------------------------------------------------------------------------\n// Bounds\n// ---------------------------------------------------------------------------\n\n/**\n * Hard cap on the number of DISTINCT entity types one menu may fan out over.\n *\n * The batched pipeline costs three DB round-trips per type group, so this — not\n * the item count — is what bounds a render's backend work. A navigation menu\n * pointing at more than a handful of routable types is malformed by\n * construction; types past the cap are dropped (their items disappear) and\n * logged, never silently truncated.\n */\nexport const MAX_MENU_ENTITY_TYPES = 16\n\n/**\n * Longest `handle` accepted — rejected before any DB work. A defensive cap, not\n * a mirror of the entity's `handle` column (`varchar(255)`): a handle is a\n * hand-authored navigation key, so anything approaching this length is\n * malformed by construction.\n */\nconst MAX_HANDLE_LENGTH = 128\n\n// ---------------------------------------------------------------------------\n// Public shape (phase 11 §2)\n// ---------------------------------------------------------------------------\n\n/** One render-ready menu item (phase 11 §2 — exact shape). */\nexport interface ResolvedMenuItem {\n  /** The stored item's stable id (DND identity; also a stable React key). */\n  id: string\n  kind: 'link' | 'header'\n  /** Resolved label: the per-locale override, else the live entity title. */\n  label: string\n  /**\n   * Locale-relative canonical path from `toolkit_paths` (+ `#anchor` when set),\n   * external `url` / `email` targets verbatim (protocol-gated), `null` for\n   * `header` items.\n   */\n  href: string | null\n  newTab: boolean\n  /** Exact `currentPath` match on the path part (any `#anchor` ignored). */\n  isActive: boolean\n  /** An ancestor BY TREE of the active item — never a path-prefix guess. */\n  inActiveTrail: boolean\n  children: ResolvedMenuItem[]\n}\n\n/**\n * A resolved menu.\n *\n * Phase 11 §2 names `ResolvedMenuItem` and uses `ResolvedMenu` as `getMenu`'s\n * return type without spelling its fields out; this is the minimal wrapper that\n * satisfies it — the requested `handle` (so a caller holding several resolved\n * menus can tell them apart, and so `markActiveTrail` can round-trip a menu\n * without losing its identity) plus the item forest. Deliberately carries no\n * `maxDepth` / `title`: the depth clamp is already APPLIED in `items`, and a\n * menu's admin-facing title is not a rendering concern.\n */\nexport interface ResolvedMenu {\n  handle: string\n  items: ResolvedMenuItem[]\n}\n\n/** Options for {@link getMenu} (phase 11 §2). */\nexport interface GetMenuOptions {\n  /** The locale to resolve labels, visibility and canonical paths for. */\n  locale: string\n  /**\n   * The page being rendered, for active-trail marking. SSG frontends usually\n   * OMIT this (one build-time fetch) and call {@link markActiveTrail} per page.\n   */\n  currentPath?: string | undefined\n}\n\n// ---------------------------------------------------------------------------\n// Injected dependencies\n// ---------------------------------------------------------------------------\n\n/** The projected `menu` row {@link getMenu} reads. */\nexport interface MenuRow {\n  /**\n   * The menu's own depth cap. Absent / out of range falls back to the entity\n   * default — the clamp is renderer-enforced independently of the editor\n   * (phase 07 §2.7), so a bad stored value can never widen it.\n   */\n  maxDepth?: number | null | undefined\n  /** Raw `menu.tree` JSONB. Untrusted shape — validated per node during the walk. */\n  tree: unknown\n}\n\n/**\n * Structural minimum of a pino/toolkit logger. Declared here (rather than\n * imported) so this module stays import-free; `app.logger.child(...)` satisfies\n * it structurally.\n */\nexport interface MenuResolveLogger {\n  warn(obj: object, msg: string): void\n}\n\n/**\n * Everything {@link getMenu} needs from the outside world.\n *\n * Function-shaped (not reader-shaped) on purpose: the concrete implementations\n * live in `./menu-resolve-context.ts`, where assignability against\n * `@murumets-ee/content`'s real `getCanonicalPaths` / `PublishFilter` is\n * type-checked at the seam — so this module needs no `@murumets-ee/content`\n * import and drift is still a build error.\n */\nexport interface MenuResolveDeps {\n  /**\n   * Fetch the PUBLISHED menu row by handle, or `null`.\n   *\n   * The publish filter is the implementation's responsibility (the app-side\n   * factory reads through a publish-filtering `QueryClient`) — a draft menu\n   * must never resolve, per phase 11 §2.\n   */\n  getMenuRow: (handle: string) => Promise<MenuRow | null>\n  /**\n   * Batched forward index read: which of `ids` have a canonical path in\n   * `locale`? Does NOT publish-filter — {@link MenuResolveDeps.filterPublished}\n   * is the required second step.\n   */\n  resolveCanonicalPaths: (\n    entityType: string,\n    ids: readonly string[],\n    locale: string,\n  ) => Promise<ReadonlyMap<string, string>>\n  /** Batched publish gate: which of `ids` are published in `locale`? */\n  filterPublished: (\n    entityType: string,\n    ids: readonly string[],\n    locale: string,\n  ) => Promise<ReadonlySet<string>>\n  /**\n   * Batched live-title read: `id → display title` for `locale`. Only called for\n   * the ids that actually need one (no per-locale label override), and never\n   * for `header` items (they have no linked entity to borrow a title from).\n   */\n  resolveTitles: (\n    entityType: string,\n    ids: readonly string[],\n    locale: string,\n  ) => Promise<ReadonlyMap<string, string>>\n  /**\n   * Fallback locale for label overrides — the app's configured content\n   * `defaultLocale`. A label present only in the default locale still renders\n   * (the same locale → default fallback `mergeTranslations` gives entity data),\n   * instead of silently dropping a partially-translated item.\n   */\n  defaultLocale: string\n  /** Optional — used to report DROPPED work (never silent truncation). */\n  logger?: MenuResolveLogger | undefined\n}\n\n// ---------------------------------------------------------------------------\n// Locale-map reads (defensive: these run against raw JSONB)\n// ---------------------------------------------------------------------------\n\n/**\n * Read one locale's string out of a raw `label` map, falling back to\n * `defaultLocale`. Own-property reads only, so a `__proto__` / `constructor`\n * key in stored JSON can't produce a value. Empty strings count as absent — an\n * item labelled `''` renders as an invisible link.\n */\nfunction readLocaleString(map: unknown, locale: string, defaultLocale: string): string | undefined {\n  if (map === null || typeof map !== 'object' || Array.isArray(map)) return undefined\n  const record: Record<string, unknown> = map as Record<string, unknown>\n  for (const key of locale === defaultLocale ? [locale] : [locale, defaultLocale]) {\n    if (!Object.hasOwn(record, key)) continue\n    const value = record[key]\n    if (typeof value === 'string' && value.length > 0) return value\n  }\n  return undefined\n}\n\n/**\n * Read one locale's visibility flag. NO default-locale fallback on purpose:\n * `enabled` is per-locale visibility in both directions (phase 08 §3), so\n * hiding an item in `en` must not hide it in `et`.\n */\nfunction readLocaleBoolean(map: unknown, locale: string): boolean | undefined {\n  if (map === null || typeof map !== 'object' || Array.isArray(map)) return undefined\n  const record: Record<string, unknown> = map as Record<string, unknown>\n  if (!Object.hasOwn(record, locale)) return undefined\n  const value = record[locale]\n  return typeof value === 'boolean' ? value : undefined\n}\n\n// ---------------------------------------------------------------------------\n// Pass 1 — structural narrowing + id collection (one walk)\n// ---------------------------------------------------------------------------\n\n/**\n * A node that survived structural validation. Data-driven filtering (publish\n * state, canonical path, label availability, empty-header pruning) happens in\n * pass 2, once the batched lookups have run.\n */\ninterface PreparedNode {\n  id: string\n  kind: 'link' | 'header'\n  link: MenuLinkValue | undefined\n  /** Raw label map — read per locale in pass 2. */\n  label: unknown\n  newTab: boolean\n  children: PreparedNode[]\n}\n\ninterface PreparedTree {\n  nodes: PreparedNode[]\n  /** entityType → every linked id (needs a path + publish check). */\n  idsByType: Map<string, Set<string>>\n  /** entityType → the subset with no usable label override (needs a live title). */\n  titleIdsByType: Map<string, Set<string>>\n  /** Nodes discarded because a hard bound was hit (reported, never silent). */\n  droppedForBudget: number\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value)\n}\n\n/**\n * Walk the raw tree ONCE: validate each node's shape, apply the two filters\n * that need no I/O (per-locale `enabled`, the `maxDepth` clamp), and collect\n * the entity ids the batched lookups will need — grouped by entity type, so\n * pass 2 issues one call per GROUP rather than one per item.\n *\n * Bounded by {@link MAX_MENU_TREE_NODES} visited nodes and {@link MAX_MENU_DEPTH}\n * levels regardless of what is stored, so a hand-edited row can't turn a page\n * render into unbounded work.\n */\nfunction prepareTree(\n  rawTree: unknown,\n  locale: string,\n  defaultLocale: string,\n  maxDepth: number,\n): PreparedTree {\n  const idsByType = new Map<string, Set<string>>()\n  const titleIdsByType = new Map<string, Set<string>>()\n  let budget = MAX_MENU_TREE_NODES\n  let droppedForBudget = 0\n\n  function collect(target: Map<string, Set<string>>, entityType: string, id: string): void {\n    const bucket = target.get(entityType)\n    if (bucket) bucket.add(id)\n    else target.set(entityType, new Set([id]))\n  }\n\n  function walk(value: unknown, depth: number): PreparedNode[] {\n    if (depth > maxDepth || !Array.isArray(value)) return []\n    // `Array.isArray` narrows `unknown` to `any[]`; re-binding keeps elements `unknown`.\n    const rawNodes: readonly unknown[] = value\n    const out: PreparedNode[] = []\n\n    for (const raw of rawNodes) {\n      if (budget <= 0) {\n        droppedForBudget++\n        continue\n      }\n      if (!isPlainObject(raw)) continue\n\n      const id = raw.id\n      const kind = raw.kind\n      if (typeof id !== 'string' || id.length === 0) continue\n      if (kind !== 'link' && kind !== 'header') continue\n      // Per-locale visibility drops the node AND its subtree — checked before\n      // recursing so a hidden branch costs nothing.\n      if (readLocaleBoolean(raw.enabled, locale) === false) continue\n\n      budget--\n\n      let link: MenuLinkValue | undefined\n      if (kind === 'link') {\n        // Re-validate the stored LinkValue — this is the `sanitizeHref`\n        // protocol gate, the one write-time check that genuinely matters again\n        // at read time (see the module header). A malformed link drops just\n        // this node.\n        const parsed = LinkValueSchema.safeParse(raw.link)\n        if (!parsed.success) continue\n        link = parsed.data\n      } else if (raw.link !== undefined) {\n        // A header carrying a link target is a shape violation — drop it\n        // rather than render a half-defined node.\n        continue\n      }\n\n      const children = walk(raw.children, depth + 1)\n\n      if (link?.kind === 'entity') {\n        collect(idsByType, link.entity, link.id)\n        // Only items WITHOUT a usable override need a live title, so the title\n        // read stays as small as possible — and header items, which have no\n        // linked entity, can never reach this branch at all.\n        if (readLocaleString(raw.label, locale, defaultLocale) === undefined) {\n          collect(titleIdsByType, link.entity, link.id)\n        }\n      }\n\n      out.push({ id, kind, link, label: raw.label, newTab: raw.newTab === true, children })\n    }\n\n    return out\n  }\n\n  const nodes = walk(rawTree, 1)\n  return { nodes, idsByType, titleIdsByType, droppedForBudget }\n}\n\n// ---------------------------------------------------------------------------\n// Pass 2 — batched lookups\n// ---------------------------------------------------------------------------\n\ninterface ResolvedLookups {\n  paths: Map<string, ReadonlyMap<string, string>>\n  published: Map<string, ReadonlySet<string>>\n  titles: Map<string, ReadonlyMap<string, string>>\n}\n\n/**\n * Run the batched lookups: for each entity-type GROUP, one forward-index read,\n * then one publish gate over the ids that had a path, then (only when some item\n * needs it) one title read. Exactly one call each, never per item, and\n * `MAX_MENU_ENTITY_TYPES` bounds the group count — so the number of round-trips\n * per render is fixed.\n *\n * Groups run CONCURRENTLY (bounded by the already-enforced `MAX_MENU_ENTITY_TYPES`\n * cap, never an unbounded `Promise.all`) — they're independent, and this sits on\n * a public SSR request path where the 3-step-per-group sequencing was otherwise\n * fully serial (up to 48 round-trips back to back for one render). Only the\n * THREE STEPS WITHIN one group stay ordered (path lookup → publish gate → title\n * read), since each depends on the previous step's output.\n *\n * How each dep handles an over-large id list is the DEP's business, and they\n * differ: `getCanonicalPaths` chunks internally, and so does the title reader in\n * `./menu-resolve-context.ts` (`TITLE_BATCH_SIZE`). `filterPublished` (content's\n * `buildEnumerateDeps`) does NOT — it issues a single `inArray` over whatever it\n * is handed. That is safe HERE because the id list is bounded tree-wide by\n * {@link MAX_MENU_TREE_NODES} (500) before it ever reaches this function, not\n * because the dep protects itself. A caller that lifts the node budget must\n * revisit that.\n */\nasync function runLookups(\n  prepared: PreparedTree,\n  locale: string,\n  deps: MenuResolveDeps,\n  handle: string,\n): Promise<ResolvedLookups> {\n  const paths = new Map<string, ReadonlyMap<string, string>>()\n  const published = new Map<string, ReadonlySet<string>>()\n  const titles = new Map<string, ReadonlyMap<string, string>>()\n\n  const groups = [...prepared.idsByType.entries()]\n  if (groups.length > MAX_MENU_ENTITY_TYPES) {\n    deps.logger?.warn(\n      { handle, locale, entityTypes: groups.length, cap: MAX_MENU_ENTITY_TYPES },\n      'menu resolution dropped entity-type groups over the fan-out cap',\n    )\n  }\n\n  await Promise.all(\n    groups.slice(0, MAX_MENU_ENTITY_TYPES).map(async ([entityType, idSet]) => {\n      const ids = [...idSet]\n      // (1) Forward index — which ids have a canonical path in this locale?\n      const pathMap = await deps.resolveCanonicalPaths(entityType, ids, locale)\n      paths.set(entityType, pathMap)\n      if (pathMap.size === 0) return\n\n      // (2) Publish gate — `resolveCanonicalPaths` does NOT filter by publish\n      //     state (`toolkit_paths` has no status column), so this is the\n      //     required no-unpublished-leak step. Batched, over only the ids that\n      //     had a path.\n      const candidates = [...pathMap.keys()]\n      const publishedIds = await deps.filterPublished(entityType, candidates, locale)\n      published.set(entityType, publishedIds)\n\n      // (3) Live titles — only for items with no usable override, and only for\n      //     ids that will actually survive pass 3 (had a path AND published) —\n      //     fetching a title for an id that's about to be dropped is wasted work.\n      const needTitles = prepared.titleIdsByType.get(entityType)\n      if (needTitles === undefined) return\n      const titleIds = candidates.filter((id) => needTitles.has(id) && publishedIds.has(id))\n      if (titleIds.length === 0) return\n      titles.set(entityType, await deps.resolveTitles(entityType, titleIds, locale))\n    }),\n  )\n\n  return { paths, published, titles }\n}\n\n// ---------------------------------------------------------------------------\n// Pass 3 — resolve + filter, bottom-up\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve prepared nodes into {@link ResolvedMenuItem}s, dropping everything\n * that can't render. Children resolve BEFORE their parent so empty-header\n * pruning sees the already-filtered child list (phase 11 §2: \"header item whose\n * surviving children are all dropped → dropped\").\n */\nfunction resolveNodes(\n  nodes: readonly PreparedNode[],\n  locale: string,\n  lookups: ResolvedLookups,\n  deps: MenuResolveDeps,\n): ResolvedMenuItem[] {\n  const out: ResolvedMenuItem[] = []\n\n  for (const node of nodes) {\n    const children = resolveNodes(node.children, locale, lookups, deps)\n    const override = readLocaleString(node.label, locale, deps.defaultLocale)\n\n    if (node.kind === 'header') {\n      // No empty dropdowns (phase 11 §2), and no label → nothing to click on.\n      if (children.length === 0) continue\n      if (override === undefined) continue\n      out.push({\n        id: node.id,\n        kind: 'header',\n        label: override,\n        href: null,\n        newTab: false,\n        isActive: false,\n        inActiveTrail: false,\n        children,\n      })\n      continue\n    }\n\n    const link = node.link\n    if (link === undefined) continue\n\n    let href: string | null\n    let label = override\n\n    if (link.kind === 'entity') {\n      const path = lookups.paths.get(link.entity)?.get(link.id)\n      // No canonical path at all → the target was deleted, never published in\n      // this locale, or its type isn't routable. Unpublished → same outcome.\n      if (path === undefined) continue\n      if (lookups.published.get(link.entity)?.has(link.id) !== true) continue\n      href = link.anchor === undefined ? path : `${path}#${link.anchor}`\n      label ??= lookups.titles.get(link.entity)?.get(link.id)\n    } else {\n      // `url` / `email` — the only remaining kinds, so there is no dead\n      // fallback branch to carry: `MenuLinkValue` has exactly three arms. A\n      // `media` link is rejected at the WRITE boundary by `LinkValueSchema`,\n      // which is also what drops one that reached the column by some other\n      // route (a direct edit, a restored dump) — `prepareTree`'s `safeParse`\n      // never lets it get this far.\n      //\n      // Verbatim external targets, protocol-gated once more by blocks'\n      // `resolveLinkHref` (`mailto:` composition included) — the single source\n      // of truth for what may become an `<a href>`. It returns `null` for\n      // anything it cannot turn into an href, and a `null` href is dropped just\n      // below — so widening `MenuLinkValue` later fails CLOSED here by default\n      // rather than emitting a half-resolved item.\n      href = resolveLinkHref(link)\n    }\n\n    // An item with no href or no resolvable label renders as either a dead\n    // anchor or an invisible one — drop it, matching every other filter here.\n    if (href === null || href.length === 0) continue\n    if (label === undefined || label.length === 0) continue\n\n    out.push({\n      id: node.id,\n      kind: 'link',\n      label,\n      href,\n      newTab: node.newTab,\n      isActive: false,\n      inActiveTrail: false,\n      children,\n    })\n  }\n\n  return out\n}\n\n// ---------------------------------------------------------------------------\n// Active trail (phase 11 §3)\n// ---------------------------------------------------------------------------\n\n/**\n * The comparable path part of an href or a current path: the `#fragment` is\n * dropped (an anchor item on the current page is still \"the current page\", per\n * phase 11 §2) and a trailing slash is normalized away, so `/about` and\n * `/about/` match. The root `/` keeps its slash.\n */\nfunction comparablePath(value: string): string {\n  const hash = value.indexOf('#')\n  const path = hash === -1 ? value : value.slice(0, hash)\n  return path.length > 1 && path.endsWith('/') ? path.slice(0, -1) : path\n}\n\ninterface MarkResult {\n  items: ResolvedMenuItem[]\n  containsActive: boolean\n}\n\nfunction markNodes(nodes: readonly ResolvedMenuItem[], target: string): MarkResult {\n  let containsActive = false\n  const items = nodes.map((node): ResolvedMenuItem => {\n    const marked = markNodes(node.children, target)\n    const isActive = node.href !== null && comparablePath(node.href) === target\n    // Ancestry is read off the TREE, never guessed from a path prefix — prefix\n    // guessing breaks across translated bases and across sibling paths that\n    // merely share a prefix (`/about` vs `/about-us`).\n    const inActiveTrail = marked.containsActive\n    if (isActive || inActiveTrail) containsActive = true\n    return { ...node, isActive, inActiveTrail, children: marked.items }\n  })\n  return { items, containsActive }\n}\n\n/**\n * Mark `isActive` / `inActiveTrail` on a resolved menu for one page.\n *\n * PURE — no I/O, and the input menu is not mutated (a new tree is returned), so\n * an SSG build can fetch a menu ONCE and mark it per page without the pages\n * contaminating each other. `getMenu` calls this internally when\n * `opts.currentPath` is given, so there is exactly one implementation of the\n * ancestry walk.\n *\n * `isActive` is an EXACT match on the path part; `inActiveTrail` marks strict\n * tree ancestors of an active item (an active item is not its own ancestor).\n */\nexport function markActiveTrail(menu: ResolvedMenu, currentPath: string): ResolvedMenu {\n  return { ...menu, items: markNodes(menu.items, comparablePath(currentPath)).items }\n}\n\n// ---------------------------------------------------------------------------\n// Entry point\n// ---------------------------------------------------------------------------\n\n/**\n * Resolve a stored menu into a render-ready tree for one locale (phase 11 §2).\n *\n * Returns `null` when the menu does not exist or is not published — a draft\n * menu renders nowhere public. A published menu whose every item was filtered\n * out returns an EMPTY item list, not `null`: \"the menu exists but has nothing\n * to show here\" is a different fact from \"there is no such menu\".\n *\n * Filtering order (phase 11 §2, not reorderable): menu unpublished → `null`;\n * `enabled[locale] === false` → dropped with its subtree; entity target deleted\n * or unpublished-in-locale → dropped; header with no surviving children →\n * dropped; depth clamped to the menu's own `maxDepth`.\n */\nexport async function getMenu(\n  handle: string,\n  opts: GetMenuOptions,\n  deps: MenuResolveDeps,\n): Promise<ResolvedMenu | null> {\n  if (handle.length === 0 || handle.length > MAX_HANDLE_LENGTH) return null\n\n  const row = await deps.getMenuRow(handle)\n  if (row === null) return null\n\n  // Renderer-enforced clamp — independent of the editor's own check (phase 07\n  // §2.7), and never wider than the absolute ceiling even if the column is not.\n  const stored = row.maxDepth\n  const maxDepth =\n    typeof stored === 'number' && Number.isInteger(stored) && stored >= 1\n      ? Math.min(stored, MAX_MENU_DEPTH)\n      : DEFAULT_MENU_DEPTH\n\n  const prepared = prepareTree(row.tree, opts.locale, deps.defaultLocale, maxDepth)\n  if (prepared.droppedForBudget > 0) {\n    deps.logger?.warn(\n      {\n        handle,\n        locale: opts.locale,\n        dropped: prepared.droppedForBudget,\n        cap: MAX_MENU_TREE_NODES,\n      },\n      'menu resolution dropped items over the node budget',\n    )\n  }\n\n  const lookups = await runLookups(prepared, opts.locale, deps, handle)\n  const menu: ResolvedMenu = {\n    handle,\n    items: resolveNodes(prepared.nodes, opts.locale, lookups, deps),\n  }\n\n  return opts.currentPath === undefined ? menu : markActiveTrail(menu, opts.currentPath)\n}\n","/**\n * Read-side narrowing for a stored `menu.tree` column, plus the entity-ref\n * collection the editor page needs for `resolveMenuItemSummaries()`.\n *\n * **Why this exists.** `field.json()` types its column as `JsonValue`, so the\n * row `fetchEntityById(Menu, id)` returns hands us an untyped blob. Casting it\n * straight to `MenuItem[]` would need an `as unknown as` (CLAUDE.md: don't) and\n * would also be a lie — the column is only *usually* well-formed. Rows written\n * before `menuTreeValidation()` existed, hand-edited rows, and rows restored\n * from an older dump can all violate the shape, and the editor is exactly the\n * tool you reach for when they do. So this walks the raw value ONCE and returns\n * a properly-typed tree.\n *\n * **Deliberately tolerant, and deliberately NOT `getMenu`.** `getMenu` is the\n * public render path: it also applies the per-locale `enabled` filter, the\n * publish gate and the per-menu `maxDepth` clamp, because a visitor must not\n * see a hidden or unpublished item. The editor is the opposite case — it must\n * show *everything* that is stored, including items hidden in the current\n * locale and items nested deeper than the menu's own `maxDepth` (that is the\n * state you opened the editor to fix). The only things dropped here are nodes\n * whose shape cannot be represented as a `MenuItem` at all.\n *\n * **Bounded** (CLAUDE.md \"no unbounded fan-out\"): at most\n * {@link MAX_MENU_TREE_NODES} nodes are materialised and recursion stops at\n * {@link MAX_MENU_DEPTH}, regardless of what the column contains — so a\n * hand-edited row can't turn a page render into unbounded work or a stack\n * overflow. Whatever is refused is COUNTED and returned, never silently\n * swallowed: the caller logs it, and the editor surfaces it before a save\n * would persist the removal.\n *\n * **Why it lives in `@murumets-ee/menus`.** It was a `@murumets-ee/menus-ui`\n * internal until PR12, when the Meta panel's Menus section (`admin-ui`) needed\n * the same narrowing to turn a `menu` row's `tree` column into a `MenuItem[]`.\n * `menus-ui` depends on `admin-ui`, so exporting it from there would close an\n * `admin-ui → menus-ui → admin-ui` import cycle — same reasoning (and same\n * move) as `./menu-tree-ops.ts`.\n *\n * It pulls `LinkValueSchema` — and therefore zod — and nothing else, so it is\n * client-safe and rides the `./schema` subpath alongside the tree operations.\n *\n * @module\n */\n\nimport {\n  LinkValueSchema,\n  MAX_MENU_DEPTH,\n  MAX_MENU_TREE_NODES,\n  type MenuItem,\n  type MenuLinkValue,\n} from './menu-item-schema.js'\n\n/** One entity target a menu item points at — the `resolveMenuItemSummaries` input shape. */\nexport interface MenuEntityRef {\n  entity: string\n  id: string\n}\n\n/** Result of {@link normalizeMenuTree}. */\nexport interface NormalizedMenuTree {\n  /** The stored tree, narrowed to `MenuItem[]`. */\n  items: MenuItem[]\n  /**\n   * How many stored nodes were REFUSED — malformed shape, or past one of the\n   * hard bounds. An entire refused subtree counts as ONE (we stop at the\n   * refusal point rather than descending into it to count more).\n   *\n   * Non-zero means a whole-tree save would persist those removals, so the\n   * editor must warn before writing.\n   */\n  dropped: number\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value)\n}\n\n/**\n * Keep only the entries whose value passes `predicate`. Locale KEYS are not\n * checked against the app's configured locale set on purpose: the set can\n * change after a tree is written, and dropping a label for a locale that was\n * just disabled would destroy authored text on the next save. An out-of-set key\n * is instead rejected loudly by `menuTreeValidation()` when the editor saves.\n */\nfunction filterMap<T>(\n  value: unknown,\n  predicate: (candidate: unknown) => candidate is T,\n): Record<string, T> | undefined {\n  if (!isPlainObject(value)) return undefined\n  const out: Record<string, T> = {}\n  for (const [key, entry] of Object.entries(value)) {\n    if (predicate(entry)) out[key] = entry\n  }\n  return out\n}\n\nconst isString = (value: unknown): value is string => typeof value === 'string'\nconst isBoolean = (value: unknown): value is boolean => typeof value === 'boolean'\n\n/**\n * Narrow a raw `menu.tree` JSONB value to `MenuItem[]`.\n *\n * @param value the raw column value (untrusted shape).\n */\nexport function normalizeMenuTree(value: unknown): NormalizedMenuTree {\n  let budget = MAX_MENU_TREE_NODES\n  let dropped = 0\n\n  function walk(raw: unknown, depth: number): MenuItem[] {\n    if (!Array.isArray(raw)) return []\n    // `Array.isArray` narrows `unknown` to `any[]`; re-binding through a\n    // `readonly unknown[]` annotation keeps every element typed as `unknown`.\n    const rawNodes: readonly unknown[] = raw\n    if (depth > MAX_MENU_DEPTH) {\n      // Past the absolute cap the whole level goes, counted once per node so\n      // the editor's warning is proportional to what it lost.\n      dropped += rawNodes.length\n      return []\n    }\n\n    const out: MenuItem[] = []\n    for (const node of rawNodes) {\n      if (!isPlainObject(node)) {\n        dropped++\n        continue\n      }\n\n      const id = node.id\n      const kind = node.kind\n      if (typeof id !== 'string' || id.length === 0) {\n        dropped++\n        continue\n      }\n      if (kind !== 'link' && kind !== 'header') {\n        dropped++\n        continue\n      }\n\n      let link: MenuLinkValue | undefined\n      if (kind === 'link') {\n        // Re-validate the stored target through the SAME schema the write path\n        // uses — notably the `sanitizeHref` protocol allowlist, so a row that\n        // predates (or bypassed) that gate can't hand the editor a\n        // `javascript:` href to render.\n        const parsed = LinkValueSchema.safeParse(node.link)\n        if (!parsed.success) {\n          dropped++\n          continue\n        }\n        link = parsed.data\n      } else if (node.link !== undefined) {\n        // A header carrying a link target is a shape violation the type can't\n        // represent — drop it rather than render a half-defined node.\n        dropped++\n        continue\n      }\n\n      if (budget <= 0) {\n        dropped++\n        continue\n      }\n      budget--\n\n      // `filterMap` returns `{}` (not `undefined`) when the stored map WAS an\n      // object but every entry failed the predicate (e.g. `{ en: 42 }`, a\n      // non-string junk value) — `?? null`/`undefined` below wouldn't catch\n      // that, since `{}` is truthy. An all-junk map must collapse the same\n      // way a genuinely absent one does: for `label`, `{}` surviving into a\n      // save would fail the write-side schema's \"a header needs at least one\n      // locale key\" check with a server error instead of this module's own\n      // documented tolerant behaviour; for `enabled`, `{}` is a harmless but\n      // needless stored key (absent already means \"visible everywhere\").\n      const rawLabel = filterMap(node.label, isString)\n      const label =\n        rawLabel !== undefined && Object.keys(rawLabel).length > 0 ? rawLabel : undefined\n      const rawEnabled = filterMap(node.enabled, isBoolean)\n      const enabled =\n        rawEnabled !== undefined && Object.keys(rawEnabled).length > 0 ? rawEnabled : undefined\n      out.push({\n        id,\n        kind,\n        link,\n        // `null` = \"use the live entity title per locale\" (the storage default).\n        label: label ?? null,\n        enabled,\n        newTab: typeof node.newTab === 'boolean' ? node.newTab : undefined,\n        children: walk(node.children, depth + 1),\n      })\n    }\n    return out\n  }\n\n  return { items: walk(value, 1), dropped }\n}\n\n/**\n * Every distinct entity target in a (already-normalised, therefore bounded)\n * tree, in document order.\n *\n * Deduplicated: two menu items pointing at the same page produce ONE\n * `resolveMenuItemSummaries` ref, so the batched read never scales with item\n * count. The output feeds `resolveMenuItemSummaries(app, refs)`, whose result\n * map is keyed the same `${entity}:${id}` way.\n */\nexport function collectMenuEntityRefs(items: readonly MenuItem[]): MenuEntityRef[] {\n  const seen = new Set<string>()\n  const refs: MenuEntityRef[] = []\n\n  function walk(nodes: readonly MenuItem[]): void {\n    for (const node of nodes) {\n      const link = node.link\n      if (link?.kind === 'entity') {\n        const key = `${link.entity}:${link.id}`\n        if (!seen.has(key)) {\n          seen.add(key)\n          refs.push({ entity: link.entity, id: link.id })\n        }\n      }\n      walk(node.children)\n    }\n  }\n\n  walk(items)\n  return refs\n}\n","/**\n * Block-anchor collection — the pure half of the anchors endpoint\n * (plan/routing phase 08 §5 / 09 §7, SD027).\n *\n * **Leaf module.** No `@murumets-ee/core`, no DB, no `@murumets-ee/blocks`\n * import: it walks a raw `field.blockTree()` JSONB value structurally, the same\n * way `get-menu.ts` walks a raw menu tree. That keeps the walk unit-testable\n * without a database and keeps this package's dependency direction unchanged\n * (blocks is UPSTREAM of menus, so nothing here reaches back into it).\n *\n * The anchor charset + length bound come from `../menu-item-schema.ts`, this\n * package's single owner of them — an intra-package import of a deliberately\n * pure module, NOT a new dependency direction. They used to be mirrored here;\n * a drift between the READ side (what the picker offers) and the WRITE side\n * (what `LinkValueSchema` accepts) would let the endpoint list anchors the menu\n * schema then rejects. Routing PR10 Task 3b converged them.\n *\n * **Bounded by construction** (CLAUDE.md \"no unbounded fan-out\"). The value\n * being walked is admin-authored, not a public payload — but it is still\n * untrusted-SHAPE JSONB (a hand-edited row, a restored dump, a future editor\n * bug), and this runs on an interactive picker's request path. So the walk is\n * ITERATIVE (never recursive — a deep tree must not blow the stack), carries a\n * hard visited-node budget, and hard-caps the returned list. Both bounds report\n * truncation to the caller so it can log; nothing is ever silently dropped.\n */\n\nimport { ANCHOR_PATTERN, type BlockAnchor, MAX_ANCHOR_LENGTH } from '../menu-item-schema.js'\n\n/**\n * Max length of a picker label. Mirrors `menu-item-schema.ts`'s\n * `MAX_LABEL_LENGTH`. `anchorLabel` is a free-text block field with no\n * declared `maxLength`, so a pathological value falls back to the anchor\n * itself rather than being truncated into something the editor never wrote.\n */\nexport const MAX_ANCHOR_LABEL_LENGTH = 200\n\n/**\n * Visited-node budget for one layout walk.\n *\n * Deliberately larger than `MAX_MENU_TREE_NODES` (500): a page layout is a\n * richer document than a hand-curated navigation menu. Past this the walk\n * stops and reports `truncated` — the bound that keeps a corrupted or hostile\n * layout from turning an interactive picker request into unbounded work.\n */\nexport const MAX_LAYOUT_NODES = 1000\n\n/**\n * Max anchors returned in one response. A picker listing more than this is not\n * a usable UI, and the cap bounds the response body independently of the node\n * budget.\n */\nexport const MAX_ANCHOR_RESULTS = 200\n\n/**\n * 🔴 THERE IS NO BLOCK-TYPE LIST HERE ANY MORE, and its removal is the fix\n * rather than a simplification.\n *\n * This was `new Set(['section', 'text'])`. The `editor` plan's PR05 merges\n * `section` into `container` (D002), and this list is the one place in the repo\n * where that rename fails SILENTLY: `readAnchor` would return `undefined` for\n * every renamed block, so every section anchor on every site would vanish from\n * the menu link picker with no error, no log line and no failing test. F027\n * audited five hardcoded block-name lists and found the frightening one (rent's\n * contract renderer, which THROWS) is safe — it names `richtext`/`text`/\n * `divider`/`spacer` and the rename never reaches it — while this one, which\n * looks harmless, is the dangerous one precisely because it is quiet.\n *\n * \"Import the constant\" is not available: this module deliberately imports\n * nothing (`blocks` is UPSTREAM of `menus`, so the dependency runs the other\n * way), and adding `'container'` beside `'section'` would leave the same trap\n * armed for the next rename.\n *\n * So the type gate is GONE and the data answers the question instead: a block\n * is anchorable if it carries a slug-shaped `anchor` prop. That is what the\n * list was a proxy for — `anchorFields` is spread into exactly the blocks that\n * are addressable, so the field's PRESENCE is the declaration and the name was\n * only ever a second, driftable copy of it.\n *\n * The widening is bounded on every axis that matters, and by guards that\n * already existed rather than by new ones: {@link MAX_LAYOUT_NODES} caps the\n * walk, {@link MAX_ANCHOR_RESULTS} caps the response, `ANCHOR_PATTERN` +\n * {@link MAX_ANCHOR_LENGTH} reject anything that is not a slug, and duplicates\n * are dropped. A block type that happens to carry an unrelated `anchor` prop\n * would now be offered — no such block exists in any vocabulary in this repo,\n * and being offered an extra jump target is a far smaller failure than a\n * picker that silently lists nothing.\n */\n\n/** {@link collectBlockAnchors}' result, including what it had to drop. */\nexport interface CollectAnchorsResult {\n  anchors: BlockAnchor[]\n  /** `true` when the node budget or the result cap cut the walk short. */\n  truncated: boolean\n  /** Nodes actually visited — for the truncation log line. */\n  visited: number\n}\n\n/** Structural minimum of a pino/toolkit logger (declared, not imported). */\ninterface AnchorWalkLogger {\n  warn(obj: object, msg: string): void\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value)\n}\n\n/**\n * Read a usable anchor off a raw block node's `props`, or `undefined`.\n *\n * Returns `undefined` for every failure mode (missing / non-string / empty /\n * over-long / non-slug value) — the picker simply doesn't offer it.\n */\nfunction readAnchor(node: Record<string, unknown>): BlockAnchor | undefined {\n  const props = node.props\n  if (!isPlainObject(props)) return undefined\n\n  const anchor = props.anchor\n  if (typeof anchor !== 'string') return undefined\n  if (anchor.length === 0 || anchor.length > MAX_ANCHOR_LENGTH) return undefined\n  if (!ANCHOR_PATTERN.test(anchor)) return undefined\n\n  const rawLabel = props.anchorLabel\n  const label =\n    typeof rawLabel === 'string' &&\n    rawLabel.length > 0 &&\n    rawLabel.length <= MAX_ANCHOR_LABEL_LENGTH\n      ? rawLabel\n      : anchor\n\n  return { anchor, label }\n}\n\n/**\n * Walk a raw `field.blockTree()` value and collect every addressable anchor, in\n * document order.\n *\n * Duplicate anchors are RETURNED AS-IS — cross-block uniqueness is deliberately\n * not enforced in v1 (plan/routing F044 point 6); the endpoint lists whatever\n * exists so a colliding anchor is visible to the editor rather than silently\n * collapsed.\n *\n * @param tree Raw JSONB value. Any non-array input yields an empty result.\n * @param logger Optional — receives one line per bound that fired.\n */\nexport function collectBlockAnchors(\n  tree: unknown,\n  logger?: AnchorWalkLogger,\n): CollectAnchorsResult {\n  const anchors: BlockAnchor[] = []\n  if (!Array.isArray(tree)) return { anchors, truncated: false, visited: 0 }\n\n  // `Array.isArray` narrows `unknown` to `any[]`; re-binding through a\n  // `readonly unknown[]` annotation keeps every element typed as `unknown`\n  // instead of leaking `any` into the walk.\n  const roots: readonly unknown[] = tree\n\n  let visited = 0\n  let truncated = false\n\n  // Explicit stack, NOT recursion — a 50k-deep layout must not blow the\n  // stack. Pushed in reverse so `pop()` yields document order. Bounded the\n  // SAME way the children-push path below is: cap how many root entries get\n  // copied onto the stack, rather than `[...roots].reverse()`ing the WHOLE\n  // array unconditionally before the budget check ever runs — a\n  // pathologically large root-level array (a restored dump, a hand-edited\n  // row) would otherwise force a full O(N) copy+reverse on the request\n  // thread regardless of `MAX_LAYOUT_NODES`, defeating the \"bounded by\n  // construction\" guarantee this module's header documents.\n  if (roots.length > MAX_LAYOUT_NODES) truncated = true\n  const stack: unknown[] = []\n  for (let i = Math.min(roots.length, MAX_LAYOUT_NODES) - 1; i >= 0; i--) stack.push(roots[i])\n\n  while (stack.length > 0) {\n    if (visited >= MAX_LAYOUT_NODES || anchors.length >= MAX_ANCHOR_RESULTS) {\n      truncated = true\n      break\n    }\n    const node = stack.pop()\n    // Count every stack pop against the budget, not just plain-object nodes —\n    // a non-object entry still costs a loop iteration, and the budget exists\n    // to bound WORK, not \"real\" nodes. Counting only objects let a `children`\n    // array full of non-object junk (or a malformed dump) iterate past the cap\n    // entirely, defeating the bound this comment block claims exists.\n    visited++\n    if (!isPlainObject(node)) continue\n\n    const found = readAnchor(node)\n    if (found !== undefined) anchors.push(found)\n\n    const children = node.children\n    if (Array.isArray(children)) {\n      const items: readonly unknown[] = children\n      // Push at most as many children as remain in the budget — pushing a\n      // node's ENTIRE children array regardless of size (the old behaviour)\n      // let one node's oversized array blow past the budget in a single step,\n      // before the loop ever got to re-check it. Any children left unpushed\n      // are exactly as truncated as a node the budget cut off outright.\n      const room = Math.max(MAX_LAYOUT_NODES - visited, 0)\n      if (items.length > room) truncated = true\n      for (let i = Math.min(items.length, room) - 1; i >= 0; i--) stack.push(items[i])\n    }\n  }\n\n  if (truncated) {\n    logger?.warn(\n      {\n        visited,\n        collected: anchors.length,\n        nodeBudget: MAX_LAYOUT_NODES,\n        resultCap: MAX_ANCHOR_RESULTS,\n      },\n      'anchor collection stopped at a hard bound — the returned list is incomplete',\n    )\n  }\n\n  return { anchors, truncated, visited }\n}\n","/**\n * `resolveMenuItemSummaries()` — live title + broken/unpublished status for\n * every entity target a stored menu tree points at (plan/routing phase 09 §3:\n * item rows show \"target summary … broken/unpublished badge\").\n *\n * **Deliberately NOT `getMenu`'s machinery.** `getMenu` resolves menus for\n * ANONYMOUS PUBLIC requests, so it elevates to a system REACH context — one\n * that withholds `view_unpublished`, which is what makes its reads\n * publish-filtered (D017 made that filter conditional on the permission; it is\n * no longer unconditional for any principal). The admin editor is the opposite\n * case:\n *\n *  - it MUST surface a DRAFT target's title (an editor may be building\n *    navigation for content that isn't published yet), which rules out\n *    `QueryClient` — that client filters to `status = 'published'` for any\n *    principal without `view_unpublished` (D017), so every draft-linked item\n *    would look broken for exactly the roles that most need the editor to\n *    work. `AdminClient` has no publish filter at all, which is the right\n *    tool here;\n *  - it MUST respect the REAL signed-in admin's own grants and scope — no\n *    elevation. If that admin cannot view an entity type, the editor correctly\n *    shows no title for it. Least privilege, not convenience.\n *\n * So this goes through `app.getClient(entity)` — the framework-managed,\n * request-bound `AdminClient` — batched by entity type exactly like\n * `@murumets-ee/admin-ui`'s `resolveRowTitles`, but with richer per-row output.\n *\n * **No unbounded fan-out** (CLAUDE.md). Backend work is bounded by the number\n * of distinct ENTITY TYPES, never by item count: one `findMany` per type group.\n * The ref count is capped at {@link MAX_MENU_TREE_NODES} (the same bound the\n * stored tree the caller walked already carries) and the group count at\n * {@link MAX_MENU_ENTITY_TYPES}. Anything dropped is logged — never silently\n * truncated.\n *\n * Called ONCE, server-side, by the menu editor page (RSC → props; no\n * `useEffect` fetching, per CLAUDE.md). Items added client-side via the link\n * picker already carry their title from the picker, so they need no round-trip.\n */\n\nimport type { ToolkitApp } from '@murumets-ee/core'\nimport type { Entity } from '@murumets-ee/entity'\nimport { getEntityTitleField } from '@murumets-ee/entity'\nimport { inArray } from 'drizzle-orm'\nimport { MAX_MENU_ENTITY_TYPES } from '../get-menu.js'\nimport { column } from '../internal/columns.js'\nimport { MAX_MENU_TREE_NODES, type MenuItemSummary } from '../menu-item-schema.js'\n\n/** Key shape of {@link resolveMenuItemSummaries}' result map. */\nfunction summaryKey(entity: string, id: string): string {\n  return `${entity}:${id}`\n}\n\nconst BROKEN: MenuItemSummary = { title: null, exists: false, published: null }\n\n/**\n * Group refs by entity type, deduping ids and stopping at the hard ref bound.\n *\n * Returns the bounded groups plus what was dropped, so the caller logs once\n * rather than per drop.\n */\nfunction groupRefs(refs: ReadonlyArray<{ entity: string; id: string }>): {\n  groups: Map<string, Set<string>>\n  droppedRefs: number\n  droppedGroups: number\n} {\n  const groups = new Map<string, Set<string>>()\n  let distinct = 0\n  let droppedRefs = 0\n\n  for (const ref of refs) {\n    if (typeof ref.entity !== 'string' || typeof ref.id !== 'string') continue\n    if (ref.entity.length === 0 || ref.id.length === 0) continue\n\n    const bucket = groups.get(ref.entity)\n    if (bucket?.has(ref.id)) continue // already counted — duplicates are free\n    if (distinct >= MAX_MENU_TREE_NODES) {\n      droppedRefs++\n      continue\n    }\n    distinct++\n    if (bucket) bucket.add(ref.id)\n    else groups.set(ref.entity, new Set([ref.id]))\n  }\n\n  const droppedGroups = Math.max(0, groups.size - MAX_MENU_ENTITY_TYPES)\n  return { groups, droppedRefs, droppedGroups }\n}\n\n/**\n * Batch-resolve the live title + existence + publish state of every\n * `{ entity, id }` target, keyed `` `${entity}:${id}` `` (the same key shape\n * `resolveRowTitles` uses).\n *\n * **A MISSING map entry means \"not resolvable here\", NOT \"broken.\"** It happens\n * when the entity type isn't registered in this app, when the caller holds no\n * `view` grant on it, when that group's read failed, or (for a `team`/`user`-\n * scoped entity only) when the row belongs to a different scope than this\n * request's — a scope filter excludes it the same way a delete would, and\n * this function cannot tell the two apart. Callers should render such items\n * as indeterminate — only an explicit `exists: false` (reported ONLY for a\n * `global`-scoped entity, where no scope filter can ever apply) means the\n * target was really deleted.\n *\n * Best-effort per group: one group's failure never takes down the others (and\n * therefore never takes down the editor page).\n */\nexport async function resolveMenuItemSummaries(\n  app: ToolkitApp,\n  refs: ReadonlyArray<{ entity: string; id: string }>,\n): Promise<Map<string, MenuItemSummary>> {\n  const summaries = new Map<string, MenuItemSummary>()\n  if (refs.length === 0) return summaries\n\n  const logger = app.logger.child({ resolve: 'menu-item-summaries' })\n  const { groups, droppedRefs, droppedGroups } = groupRefs(refs)\n\n  if (droppedRefs > 0) {\n    logger.warn(\n      { dropped: droppedRefs, cap: MAX_MENU_TREE_NODES },\n      'menu item summaries dropped targets over the ref budget — some rows will show no status',\n    )\n  }\n  if (droppedGroups > 0) {\n    logger.warn(\n      { dropped: droppedGroups, cap: MAX_MENU_ENTITY_TYPES },\n      'menu item summaries dropped entity-type groups over the fan-out cap',\n    )\n  }\n\n  // Groups are independent and their count is already hard-capped, so this is a\n  // BOUNDED concurrent fan-out (≤ MAX_MENU_ENTITY_TYPES), not an unbounded\n  // `Promise.all` over caller-controlled input.\n  await Promise.all(\n    [...groups.entries()]\n      .slice(0, MAX_MENU_ENTITY_TYPES)\n      .map(([entityName, idSet]) => resolveGroup(app, logger, entityName, idSet, summaries)),\n  )\n\n  return summaries\n}\n\nasync function resolveGroup(\n  app: ToolkitApp,\n  logger: ToolkitApp['logger'],\n  entityName: string,\n  idSet: ReadonlySet<string>,\n  out: Map<string, MenuItemSummary>,\n): Promise<void> {\n  // Unregistered type — leave NO entry (see the \"missing entry\" contract):\n  // claiming `exists: false` would flag every item as broken just because a\n  // plugin isn't loaded in this process.\n  const entity: Entity | undefined = app.entities.get(entityName)\n  if (entity === undefined) return\n\n  const titleField = getEntityTitleField(entity)\n  // `getEntityTitleField` degrades to `'id'` when nothing is display-able. The\n  // row still EXISTS; it just has no title to show.\n  const hasTitle = titleField !== 'id'\n  const isPublishable = entity.behaviors?.some((b) => b.name === 'publishable') ?? false\n  const ids = [...idSet]\n\n  try {\n    const client = app.getClient(entity)\n    // `AdminClient`, so rows come back regardless of publish state — the whole\n    // point (see the module header). Bounded by `ids.length`, itself bounded by\n    // `MAX_MENU_TREE_NODES`.\n    const rows = await client.findMany({\n      where: inArray(column(client.getTable(), 'id'), ids),\n      limit: ids.length,\n    })\n\n    const seen = new Set<string>()\n    for (const row of rows) {\n      const record: Record<string, unknown> = row\n      const id = record.id\n      if (typeof id !== 'string') continue\n      const rawTitle = hasTitle ? record[titleField] : undefined\n      seen.add(id)\n      out.set(summaryKey(entityName, id), {\n        title: typeof rawTitle === 'string' && rawTitle.length > 0 ? rawTitle : null,\n        exists: true,\n        published: isPublishable ? record.status === 'published' : null,\n      })\n    }\n\n    // An id asked for and not returned is USUALLY gone — but for a `team`/\n    // `user`-scoped entity it can also mean \"belongs to a different scope than\n    // this request's\", which `findMany` filters out silently (same\n    // `strictScope: false` fail-open every admin read path shares — see\n    // `packages/core/src/client-factories.ts`). Claiming `exists: false` there\n    // would tell an admin to delete a perfectly live row just because it's\n    // outside their current scope — the exact false alarm the \"missing entry\n    // is indeterminate\" contract exists to prevent. Only a `global`-scoped\n    // entity (no scope filter can ever apply) gets the real broken signal;\n    // anything else is left unresolved (indeterminate) instead.\n    const canTrustAbsence = (entity.scope ?? 'global') === 'global'\n    if (canTrustAbsence) {\n      for (const id of ids) {\n        if (!seen.has(id)) out.set(summaryKey(entityName, id), BROKEN)\n      }\n    }\n  } catch (error) {\n    // Best-effort, per group: a denied entity, a pre-migration table or a\n    // transient read failure must degrade THIS group's badges, not blank the\n    // whole editor page. Logged (never a silent swallow) and left with no\n    // entries, which callers read as indeterminate rather than broken.\n    logger.warn(\n      { entity: entityName, count: ids.length, error: String(error) },\n      'menu item summaries could not be resolved for this entity type',\n    )\n  }\n}\n","/**\n * Admin API routes for `@murumets-ee/menus`.\n *\n * **URL surface served by this module:**\n *\n *   - GET /api/admin/menus/anchors?entity=&id=  — addressable block anchors on\n *     one published document, for the menu editor's anchor picker\n *     (plan/routing phase 08 §5 / 09 §4 + §7).\n *   - GET /api/admin/menus/editor-state?handle=  — a menu's full tree + editor\n *     metadata (summaries, locales, entityTypes, canPublish) by handle. Feeds\n *     `@murumets-ee/menus-ui`'s Tier 3 in-place menu editor surface\n *     (`MenuBlock.customEditorSurface`, `plan/blocks/08-adaptive-ui.md`\n *     §\"Tier 3\") the same props shape the standalone `/admin/menu/[id]` page\n *     builds server-side — see `./editor-state.ts`'s module header for the\n *     v1 scope trade-off (no draft/lock parity).\n *   - GET /api/admin/menus/resolved?handle=a&handle=b  — the PUBLISHED, resolved\n *     items of up to {@link MAX_RESOLVED_HANDLES} menus, for an editing canvas\n *     whose blocks came to name a menu after the page loaded\n *     (davatoidud-toolkit F040). See `handleResolved`.\n *\n * Menu CRUD itself is plain entity CRUD (the `menu` entity is served by\n * admin-ui's generic entity family), so it deliberately has no route here —\n * the embedded editor's Save/Publish buttons PATCH straight through that\n * existing entity-CRUD route, same as the standalone page.\n *\n * ## Security posture\n *\n * The anchors endpoint reads ANOTHER entity's content, so it is gated TWICE:\n *\n * 1. The declarative `menu:view` gate the framework wrapper enforces before\n *    the handler runs — \"may this caller work with menus at all?\".\n * 2. An in-handler `ctx.checkPermission(<target entity>, 'view')` — \"may this\n *    caller see THAT entity's content?\". The static gate can't express this:\n *    the target entity is a request parameter (the exact \"multi-entity routes\n *    ... per-entity permission checks\" case `AdminRouteHandler`'s contract\n *    documents), and without it any menu editor could read the layout of an\n *    entity type they hold no grant on.\n *\n * **Every negative outcome INSIDE the handler answers `200 []`, never 403/404**\n * — no permission on the target entity, unknown entity, entity with no block\n * tree, missing / unpublished / deleted row. One uniform response means the\n * endpoint discloses nothing about which entity types exist, which are\n * block-backed, or which ids are real. (Gate 1 above still answers a real\n * `403` for a caller who lacks `menu:view` itself — that gate protects the\n * endpoint as a whole, not a specific target, so there is no oracle risk in\n * it answering truthfully.) A malformed REQUEST (missing/short/over-long\n * `entity`, non-uuid `id`) still 400s — that is a fact about the caller's own\n * request, not about our data.\n *\n * Reads go through a `QueryClient` bound to the REAL caller's identity and\n * scope — deliberately NOT the elevated `SYSTEM_CONTEXT` that\n * `menu-resolve-context.ts` uses for public rendering. `QueryClient` excludes\n * trashed rows and publish-filters, which is exactly phase 08 §5's \"walking\n * its published layout\": a draft page exposes no anchors, and the picker's\n * manual-string entry is the documented fallback for that case (07 §2.6).\n *\n * Since D017 (plan/api PR04) that publish filter is CONDITIONAL on the\n * caller's `view_unpublished` grant, so this route withholds that one action\n * from the checker it hands the client. The reason is a PRODUCT contract, not\n * a permission one: an anchor picker exists to build navigation that WORKS,\n * and an anchor that only exists in an unpublished layout is a link that 404s\n * (or jumps nowhere) for every visitor. \"Published layout\" is the definition\n * of the endpoint, so it must not vary by who is asking. Nothing is concealed\n * from a privileged caller here — an editor who may read the draft can read it\n * through the normal entity API; they just don't get to pick anchors out of it.\n */\n\nimport type { ResolvedMenuNavItem } from '@murumets-ee/blocks'\nimport {\n  type AdminRoute,\n  type AdminRouteHandler,\n  combineAdminRoutes,\n  defineAdminRoute,\n  getContext,\n  getCurrentApp,\n  getCurrentScope,\n  siteSecurityFields,\n} from '@murumets-ee/core'\nimport type { Entity, SecurityContext } from '@murumets-ee/entity'\nimport {\n  getBlockTreeFieldName,\n  getSearchableConfig,\n  VIEW_UNPUBLISHED_ACTION,\n} from '@murumets-ee/entity'\nimport { QueryClient } from '@murumets-ee/entity/query'\nimport { eq } from 'drizzle-orm'\nimport { z } from 'zod'\nimport { Menu } from '../entity.js'\nimport { getMenu } from '../get-menu.js'\nimport { column } from '../internal/columns.js'\nimport { normalizeMenuEntityTypes } from '../menu-entity-types.js'\nimport { DEFAULT_MENU_DEPTH, MAX_MENU_DEPTH } from '../menu-item-schema.js'\nimport { collectMenuEntityRefs, normalizeMenuTree } from '../menu-tree-normalize.js'\nimport { collectBlockAnchors } from './anchors.js'\nimport type { MenuEditorStateResponse } from './editor-state.js'\nimport { resolveMenuItemSummaries } from './summaries.js'\n\n// ---------------------------------------------------------------------------\n// Request validation\n// ---------------------------------------------------------------------------\n\n/** Canonical UUID shape for the `id` query param. */\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\n/**\n * Longest `entity` param accepted, rejected before any lookup. Mirrors\n * `menu-item-schema.ts`'s `MAX_ENTITY_NAME_LENGTH` — the same bound the write\n * path already applies to an entity name inside a stored link.\n */\nconst MAX_ENTITY_NAME_LENGTH = 64\n\n/**\n * Role stand-in when the authenticated user carries none.\n *\n * `SecurityContext.user.groups` MUST be non-empty: `resolveAuthContext` reads\n * `groups[0]` and throws `ForbiddenError` on an empty array BEFORE it ever\n * consults the checker. The VALUE is inert here — the checker below ignores\n * its `role` argument and delegates to `ctx.checkPermission`, which the API\n * handler already bound to the caller's real role — so the least-privileged\n * built-in role is the honest placeholder.\n */\nconst FALLBACK_ROLE = 'viewer'\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nfunction jsonResponse(data: unknown, status = 200): Response {\n  return new Response(JSON.stringify(data), {\n    status,\n    headers: { 'Content-Type': 'application/json' },\n  })\n}\n\nfunction jsonError(message: string, status: number): Response {\n  return jsonResponse({ error: message }, status)\n}\n\n/** The one uniform \"nothing to offer\" answer — see the module header. */\nfunction noAnchors(): Response {\n  return jsonResponse([])\n}\n\n/**\n * Name of the entity's `field.blockTree()` slot, or `null` when it has none.\n *\n * This WAS a deliberately local linear scan, justified on the grounds that\n * neither `@murumets-ee/blocks`' `resolveBlockTreeField` nor admin-ui's\n * `getBlocksFieldName` was reachable from this package — blocks' lives behind\n * its server entry, and admin-ui is a UI package `menus` must not depend on.\n * The reasoning was right and the conclusion was one step short: the answer\n * belongs in the LEAF all three already depend on. It now lives in\n * `@murumets-ee/entity` (`block-tree-fields.ts`), so this is a `null`-shaped\n * adaptor rather than a sixth copy of the loop.\n */\nfunction findBlockTreeField(entity: Entity): string | null {\n  return getBlockTreeFieldName(entity) ?? null\n}\n\n// ---------------------------------------------------------------------------\n// GET /api/admin/menus/anchors\n// ---------------------------------------------------------------------------\n\nconst handleAnchors: AdminRouteHandler = async (req, ctx) => {\n  const params = new URL(req.url).searchParams\n  const entityName = params.get('entity')\n  const id = params.get('id')\n\n  // Boundary validation. These 400s describe the CALLER'S request, so they\n  // disclose nothing about our data.\n  if (entityName === null || entityName.length === 0) {\n    return jsonError(\"query param 'entity' is required\", 400)\n  }\n  if (entityName.length > MAX_ENTITY_NAME_LENGTH) {\n    return jsonError(\"query param 'entity' is too long\", 400)\n  }\n  if (id === null || !UUID_RE.test(id)) {\n    return jsonError(\"query param 'id' must be a uuid\", 400)\n  }\n\n  const app = getCurrentApp()\n  if (app === undefined) {\n    // Handlers always run inside `runWithContextAsync`; no app means the\n    // request never got a context, which is an internal wiring fault.\n    return jsonError('Internal error', 500)\n  }\n  const logger = app.logger.child({ route: 'menus/anchors', entity: entityName })\n\n  // Gate 2 — the per-target-entity check (see the module header). Answers with\n  // the same empty list as every other negative outcome.\n  if (!ctx.checkPermission(entityName, 'view')) {\n    logger.debug(\n      { userId: ctx.user.id, role: ctx.user.role },\n      'anchors lookup returned empty — caller holds no view grant on the target entity',\n    )\n    return noAnchors()\n  }\n\n  const entity = app.entities.get(entityName)\n  if (entity === undefined) return noAnchors()\n\n  const blockTreeField = findBlockTreeField(entity)\n  // Not a block-tree-backed content type, so nothing on it is addressable.\n  if (blockTreeField === null) return noAnchors()\n\n  // Bound to the REAL caller — same identity, role and data scope the rest of\n  // this request runs under. `scope` matters: without it a `team`/`user`-scoped\n  // entity would skip its isolation filter on this read path.\n  const scope = getCurrentScope()\n  const client = new QueryClient({\n    entity,\n    db: app.db.readOnly,\n    logger,\n    contextResolver: (): SecurityContext => ({\n      user: { id: ctx.user.id, groups: [ctx.user.role ?? FALLBACK_ROLE] },\n      // Delegates to the caller's real grants for everything EXCEPT\n      // `view_unpublished` (D017), which this endpoint pins closed regardless\n      // of role — see the file header for why \"published layout\" is part of\n      // the endpoint's definition rather than a visibility decision.\n      checker: (_role, resource, action) =>\n        action !== VIEW_UNPUBLISHED_ACTION && ctx.checkPermission(resource, action),\n      ...(scope !== undefined && { scope }),\n      ...siteSecurityFields(undefined, app),\n    }),\n  })\n\n  // `locale` drives BOTH the per-locale publish filter and the translation\n  // merge, so a translatable block tree resolves to the layout the admin is\n  // actually editing. The client publish-filters (see the checker above), so a\n  // draft / trashed / deleted row simply isn't found.\n  const row = await client.findById(id, {\n    ...(ctx.locale !== undefined && { locale: ctx.locale }),\n    ...(ctx.defaultLocale !== undefined && { defaultLocale: ctx.defaultLocale }),\n  })\n  if (row === null) return noAnchors()\n\n  const record: Record<string, unknown> = row\n  const { anchors } = collectBlockAnchors(record[blockTreeField], logger)\n  return jsonResponse(anchors)\n}\n\nconst anchorsRoute = defineAdminRoute({\n  prefix: 'menus',\n  path: 'anchors',\n  method: 'GET',\n  // Building a menu is the umbrella capability; the per-target-entity `view`\n  // check inside the handler is the least-privilege half.\n  permission: 'menu:view',\n  // Mirrors the `menu` entity's own admin-only write posture (`entity.ts`):\n  // only admins build menus today. `registerPermission` UNIONS default roles\n  // across registrations, so this can only add, never narrow.\n  defaultRoles: ['admin'],\n  description:\n    \"List a published document's addressable block anchors for the menu editor's anchor picker.\",\n  tokens: 'accept',\n  handler: handleAnchors,\n})\n\n// ---------------------------------------------------------------------------\n// GET /api/admin/menus/editor-state — the Tier 3 block-editor surface's read\n// ---------------------------------------------------------------------------\n\n/** Longest `handle` accepted — mirrors `get-menu.ts`'s own local bound. */\nconst MAX_HANDLE_LENGTH = 128\n\nconst handleEditorState: AdminRouteHandler = async (req, ctx) => {\n  const handle = new URL(req.url).searchParams.get('handle')\n  if (handle === null || handle.length === 0) {\n    return jsonError(\"query param 'handle' is required\", 400)\n  }\n  if (handle.length > MAX_HANDLE_LENGTH) {\n    return jsonError(\"query param 'handle' is too long\", 400)\n  }\n\n  const app = getCurrentApp()\n  if (app === undefined) return jsonError('Internal error', 500)\n  const logger = app.logger.child({ route: 'menus/editor-state' })\n\n  // Bound to the REAL caller (same `app.getClient` framework accessor\n  // `resolveMenuItemSummaries` uses below) — no elevation. A caller who\n  // cannot view menus never reaches this handler at all (the route's static\n  // `permission: 'menu:view'` gate below), so this is the ordinary\n  // request-scoped client, not `createSystemAdminClient`.\n  const client = app.getClient(Menu)\n  const rows = await client.findMany({\n    where: eq(column(client.getTable(), 'handle'), handle),\n    limit: 1,\n  })\n  const row = rows[0] as Record<string, unknown> | undefined\n  if (row === undefined) return jsonError('Menu not found', 404)\n\n  const id = row.id as string\n  const title = typeof row.title === 'string' ? row.title : ''\n  const storedMaxDepth = row.maxDepth\n  const maxDepth =\n    typeof storedMaxDepth === 'number' && Number.isInteger(storedMaxDepth) && storedMaxDepth >= 1\n      ? Math.min(storedMaxDepth, MAX_MENU_DEPTH)\n      : DEFAULT_MENU_DEPTH\n  const status: 'draft' | 'published' = row.status === 'published' ? 'published' : 'draft'\n\n  // Codes only (no display labels) — see `RequestContext.availableLocales`.\n  // Falling back to the code itself as the label is the same idiom\n  // `generic-block-editor.tsx` uses when no richer locale registry is wired.\n  const localeCodes = getContext()?.availableLocales\n  const defaultLocale = ctx.defaultLocale ?? localeCodes?.[0] ?? 'en'\n  // `MenuTreeEditorProps.defaultLocale` is contractually \"always present in\n  // `locales`\", but the two come from DIFFERENT sources — `defaultLocale` from\n  // `ctx.defaultLocale`, the list from the request's enabled `availableLocales`\n  // — so they can disagree (a default locale that was later disabled, or a\n  // context that carries one but not the other). When they do, prepend it:\n  // otherwise the editor's preview switcher omits the very locale the tree is\n  // authored in, and \"preview as default\" becomes unreachable.\n  const enabled = localeCodes && localeCodes.length > 0 ? [...localeCodes] : []\n  const codes = enabled.includes(defaultLocale) ? enabled : [defaultLocale, ...enabled]\n  const locales = codes.map((code) => ({ code, label: code }))\n\n  const draft = await loadPendingDraft(app, id, logger)\n  const draftData = draft?.data\n\n  // Seed from the pending DRAFT when there is one, else the live row — the\n  // same precedence `MenuEditorPage` applies, and the same `EntityForm`\n  // applies generally. Without it the editor would show the LIVE tree under a\n  // banner saying \"you are editing a pending draft\", and a Save would silently\n  // republish the pre-draft structure.\n  const treeSource = draftData !== undefined && 'tree' in draftData ? draftData.tree : row.tree\n\n  // The SAME tolerant per-node narrowing the standalone `/admin/menu/[id]`\n  // page uses (`../menu-tree-normalize.ts` — one implementation, deliberately).\n  //\n  // NOT a strict whole-tree `buildMenuTreeSchema().safeParse`: that whitelists\n  // locale KEYS against the app's currently-ENABLED locales, so disabling a\n  // locale after items were authored for it failed the entire parse and\n  // collapsed the tree to `[]` — a subsequent save from this surface would\n  // then persist that wipe, while the standalone page (already tolerant) kept\n  // every valid node from the same row. Two editing paths to the same data\n  // must not disagree on malformed input.\n  //\n  // Whatever IS unreadable is counted, not swallowed: `droppedItemCount`\n  // rides the response, and `<MenuTreeEditor>` refuses to save past it\n  // without an explicit confirm.\n  const { items: tree, dropped: droppedItemCount } = normalizeMenuTree(treeSource)\n  if (droppedItemCount > 0) {\n    logger.warn(\n      { menuId: id, handle, dropped: droppedItemCount },\n      'menu editor-state: stored tree contained items that could not be read — the embedded editor shows the rest',\n    )\n  }\n\n  const summaryMap = await resolveMenuItemSummaries(app, collectMenuEntityRefs(tree))\n  const summaries = Object.fromEntries(summaryMap)\n\n  // Same derivation `MenuEditorPage.resolveLinkEntityTypes` uses, minus the\n  // admin-ui label helper (this package must not depend on `admin-ui` — see\n  // the module header on `../plugin.ts`'s sibling `menus-ui` for why the\n  // dependency runs the other way). `labelSingular` is the closest built-in\n  // equivalent to a type-picker's \"one item of this type\" label.\n  const entityTypes = [...app.entities.values()]\n    .filter(\n      (entity) =>\n        getSearchableConfig(entity) !== undefined && ctx.checkPermission(entity.name, 'view'),\n    )\n    .map((entity) => ({\n      name: entity.name,\n      label: entity.admin?.labelSingular ?? entity.admin?.label ?? entity.name,\n    }))\n\n  const canPublish = ctx.checkPermission('menu', 'publish')\n\n  // Same draft-then-live precedence as the tree above (routing PR12 added the\n  // per-menu whitelist): a pending draft that narrowed which content types the\n  // menu accepts must be what the editor shows, or a Save would silently\n  // republish the pre-draft selection.\n  const acceptedEntityTypes = normalizeMenuEntityTypes(\n    draftData !== undefined && 'entityTypes' in draftData ? draftData.entityTypes : row.entityTypes,\n  )\n\n  const body: MenuEditorStateResponse = {\n    menu: { id, handle, title, maxDepth, status, tree, entityTypes: acceptedEntityTypes },\n    summaries,\n    locales,\n    defaultLocale,\n    droppedItemCount,\n    entityTypes,\n    canPublish,\n    ...(draft !== undefined && { draft }),\n  }\n  return jsonResponse(body)\n}\n\n/**\n * A menu's draft + lock are keyed by the DEFAULT snapshot key, never the\n * admin's current content locale: one tree serves every locale (D009), so a\n * per-locale draft would let two locales hold divergent copies of the same\n * structure. `'_'` is the api-handler's own default-snapshot key.\n * `MenuEditorPage` uses the same constant for the same reason.\n */\nconst MENU_SNAPSHOT_LOCALE = '_'\n\n/**\n * The pending draft for this menu, or `undefined`.\n *\n * Read through the REQUEST'S own `AdminClient` (`app.getClient`), so the\n * entity firewall applies exactly as it does everywhere else — no elevation.\n *\n * Failure degrades to \"no draft\" rather than failing the request, matching\n * `MenuEditorPage.loadMenuEditState`: a partially-down draft subsystem should\n * not take the editing surface down with it, and every write is re-authorized\n * server-side regardless of what this returns.\n *\n * ⚠️ **`ContentClient` is imported LAZILY, and must stay that way.**\n * `@murumets-ee/content/client` is `server-only`-tagged, and this module is on\n * the `lumi.config.ts` load path: `menus-ui`'s `menus()` plugin factory\n * statically imports `menusRoutes` from this entry, and the CLI / worker load\n * that config through jiti, which does NOT apply the `react-server` export\n * condition — so a MODULE-SCOPE import of it throws the instant `lumi migrate`\n * (or any other command) loads the config, taking every CLI command down with\n * it. A static import here did exactly that; `pnpm verify:plugin-loads` is the\n * gate that catches it (`packages/menus/dist/admin.mjs` failed to load).\n *\n * The dynamic import defers the module to CALL time, which only ever happens\n * inside a real admin-API request — i.e. inside RSC, where `server-only`\n * resolves to its empty stub. Exactly the same lazy-thunk technique, and the\n * same reasoning, as the page factories in `menus-ui`'s `plugin.ts`.\n */\nasync function loadPendingDraft(\n  app: NonNullable<ReturnType<typeof getCurrentApp>>,\n  menuId: string,\n  logger: { warn(obj: object, msg: string): void },\n): Promise<MenuEditorStateResponse['draft']> {\n  try {\n    const { ContentClient } = await import('@murumets-ee/content/client')\n    const contentClient = new ContentClient({ admin: app.getClient(Menu), entity: Menu })\n    const entry = await contentClient.getDraft(menuId, MENU_SNAPSHOT_LOCALE)\n    if (!entry) return undefined\n    return {\n      data: entry.data,\n      createdBy: entry.createdBy,\n      createdByName: entry.createdByName,\n      // The response is JSON, so normalise `Date | string` to a string here\n      // rather than letting `JSON.stringify` do it implicitly — the declared\n      // response type then matches what actually crosses the wire.\n      updatedAt:\n        entry.updatedAt instanceof Date ? entry.updatedAt.toISOString() : String(entry.updatedAt),\n    }\n  } catch (err) {\n    logger.warn({ err, menuId }, 'menu editor-state: draft state unavailable — continuing without')\n    return undefined\n  }\n}\n\nconst editorStateRoute = defineAdminRoute({\n  prefix: 'menus',\n  path: 'editor-state',\n  method: 'GET',\n  // Same gate the standalone `/admin/menu/[id]` page uses (`menus-ui/plugin.ts`\n  // — `requires: 'menu:view'`). Mutations still go through the entity's own\n  // `menu:update` / `menu:publish` gates on the generic entity CRUD routes —\n  // this endpoint is read-only.\n  permission: 'menu:view',\n  defaultRoles: ['admin'],\n  description:\n    \"Read a menu's full tree + editor metadata by handle, for the blocks editor's in-place Tier 3 menu surface.\",\n  tokens: 'accept',\n  handler: handleEditorState,\n})\n\n// ---------------------------------------------------------------------------\n// GET /api/admin/menus/resolved — menus a canvas came to name after it loaded\n// ---------------------------------------------------------------------------\n\n/**\n * Most distinct handles one request resolves — the amplification bound.\n *\n * The number is `MAX_RENDERED_MENU_HANDLES` in `@murumets-ee/blocks/library`:\n * what one canvas resolves when it opens, so what one canvas can come to need.\n * Restated rather than imported because that entry is the whole block library\n * and this module is on the `lumi.config.ts` load path; `routes.test.ts` holds\n * the two equal.\n */\nexport const MAX_RESOLVED_HANDLES = 8\n\n/**\n * The query, validated before any lookup. Repeated `handle` params rather than\n * one comma-joined value: a handle is stored text, and splitting it on a\n * character it may contain would ask for menus nobody named.\n */\nconst resolvedQuerySchema = z.object({\n  handles: z.array(z.string().min(1).max(MAX_HANDLE_LENGTH)).min(1).max(MAX_RESOLVED_HANDLES),\n})\n\n/** `GET /api/admin/menus/resolved` — `null` for a handle with no published menu. */\nexport interface ResolvedMenusResponse {\n  // The blocks package's own item type, not this package's `ResolvedMenuItem`:\n  // the canvas reads these into `ResolvedMenusContext`, and naming the local\n  // type here would declare it a second time in this entry's `.d.mts`\n  // (`verify:dts`).\n  menus: Record<string, ResolvedMenuNavItem[] | null>\n}\n\n/**\n * The published items of the menus an editing canvas names.\n *\n * A canvas resolves its menus once, on the server, when the page opens\n * (`resolveCanvasMenus` in admin-ui's `canvas-chrome.ts`). A `menu` block added\n * afterwards, a handle changed, or a page reached by navigating inside the\n * canvas can name a menu that load never saw; this is where the canvas asks.\n *\n * It answers with exactly what that load would have: the SAME resolver\n * (`getMenu` over `buildMenuResolveDeps`), so published-only, confined to the\n * request's site, and reach-only — never a draft menu, never an unpublished\n * target. That is what a visitor to the site is served, which is why the gate\n * is the canvas's own read permission rather than `menu:view`: see the route.\n *\n * Every handle that RESOLVED is in the answer. `null` means \"no published menu\n * at that handle\", which the canvas records and does not ask for again. A\n * handle whose lookup FAILED is logged and left out, so a passing fault is not\n * remembered as a missing menu and the canvas may ask again. An empty array is\n * a published menu with no items, which a render treats differently from no\n * menu.\n *\n * Bounded: at most {@link MAX_RESOLVED_HANDLES} distinct handles, each one\n * `getMenu` call. More than that, or an over-long handle, is a 400.\n */\nconst handleResolved: AdminRouteHandler = async (req, ctx) => {\n  const parsed = resolvedQuerySchema.safeParse({\n    handles: [...new Set(new URL(req.url).searchParams.getAll('handle'))],\n  })\n  if (!parsed.success) {\n    return jsonError(\n      `query param 'handle' must be given 1 to ${MAX_RESOLVED_HANDLES} times, each 1 to ${MAX_HANDLE_LENGTH} characters`,\n      400,\n    )\n  }\n  const { handles } = parsed.data\n\n  const app = getCurrentApp()\n  if (app === undefined) return jsonError('Internal error', 500)\n  const logger = app.logger.child({ route: 'menus/resolved' })\n\n  // Loaded on use, like `loadPendingDraft`'s import below and for its reason:\n  // the resolver's app binding reaches `@murumets-ee/content`'s resolve graph,\n  // which has no place on the config-load path this module is on.\n  const { buildMenuResolveDeps } = await import('../menu-resolve-context.js')\n  const deps = buildMenuResolveDeps(app)\n  // The locale the api-handler validated off `?locale=`; a request without one\n  // is answered in the site's default, as the canvas itself would be drawn.\n  const locale = ctx.locale ?? ctx.defaultLocale ?? deps.defaultLocale\n\n  const resolved = await Promise.all(\n    handles.map(async (handle): Promise<[string, ResolvedMenuNavItem[] | null] | undefined> => {\n      try {\n        // No `currentPath`, as on the canvas's own load: an editing surface is\n        // not a visit to a URL.\n        const menu = await getMenu(handle, { locale }, deps)\n        return [handle, menu === null ? null : menu.items]\n      } catch (err) {\n        logger.warn(\n          { err, handle, locale },\n          'menu failed to resolve for the canvas; it is left out of the answer',\n        )\n        return undefined\n      }\n    }),\n  )\n  const body: ResolvedMenusResponse = {\n    menus: Object.fromEntries(\n      resolved.filter(\n        (entry): entry is [string, ResolvedMenuNavItem[] | null] => entry !== undefined,\n      ),\n    ),\n  }\n  return jsonResponse(body)\n}\n\nconst resolvedRoute = defineAdminRoute({\n  prefix: 'menus',\n  path: 'resolved',\n  method: 'GET',\n  // The canvas's own read permission — the one its in-canvas navigation read\n  // (`GET /api/admin/blocks/editor-state`) is gated on — and NOT `menu:view`.\n  // What this serves is the published menu a visitor already gets from the\n  // content API, and the page's server render resolves it for anyone who can\n  // open the canvas, whatever their grant on `menu`. Gating on `menu:view`\n  // would have a role that edits pages but not menus see a menu on load and a\n  // placeholder for the one it just added.\n  permission: 'blocks:read-editor-state',\n  // Catalogue metadata only (it seeds nothing): the roles that permission is\n  // declared for by `@murumets-ee/blocks`.\n  defaultRoles: ['admin', 'editor'],\n  description:\n    'Read the published, resolved items of the menus an editing canvas names, by handle.',\n  // An agent's delegated browser session opens the canvas too (agent-access\n  // D020). A read of published navigation; it changes nothing.\n  tokens: 'accept',\n  handler: handleResolved,\n})\n\n/**\n * Every admin route this package contributes, in the `AdminRoute[]` shape\n * `createAdminApiHandler` consumes.\n *\n * Wired declaratively via the plugin's `server.routes` slot — see\n * `@murumets-ee/menus-ui`.\n *\n * @example\n * ```ts\n * import { menusRoutes } from '@murumets-ee/menus/admin'\n *\n * definePlugin({ name: '…', server: { routes: menusRoutes() } })\n * ```\n */\nexport function menusRoutes(): AdminRoute[] {\n  return combineAdminRoutes([anchorsRoute, editorStateRoute, resolvedRoute])\n}\n"],"mappings":"slBA6NA,SAAS,EAAiB,EAAc,EAAgB,EAA2C,CACjG,GAAoB,OAAO,GAAQ,WAA/B,GAA2C,MAAM,QAAQ,CAAG,EAAG,OACnE,IAAM,EAAkC,EACxC,IAAK,IAAM,KAAO,IAAW,EAAgB,CAAC,CAAM,EAAI,CAAC,EAAQ,CAAa,EAAG,CAC/E,GAAI,CAAC,OAAO,OAAO,EAAQ,CAAG,EAAG,SACjC,IAAM,EAAQ,EAAO,GACrB,GAAI,OAAO,GAAU,UAAY,EAAM,OAAS,EAAG,OAAO,CAC5D,CAEF,CAOA,SAAS,EAAkB,EAAc,EAAqC,CAC5E,GAAoB,OAAO,GAAQ,WAA/B,GAA2C,MAAM,QAAQ,CAAG,EAAG,OACnE,IAAM,EAAkC,EACxC,GAAI,CAAC,OAAO,OAAO,EAAQ,CAAM,EAAG,OACpC,IAAM,EAAQ,EAAO,GACrB,OAAO,OAAO,GAAU,UAAY,EAAQ,IAAA,EAC9C,CA+BA,SAASC,EAAc,EAAkD,CACvE,OAAyB,OAAO,GAAU,YAAnC,GAA+C,CAAC,MAAM,QAAQ,CAAK,CAC5E,CAYA,SAAS,EACP,EACA,EACA,EACA,EACc,CACd,IAAM,EAAY,IAAI,IAChB,EAAiB,IAAI,IACvB,EAAA,IACA,EAAmB,EAEvB,SAAS,EAAQ,EAAkC,EAAoB,EAAkB,CACvF,IAAM,EAAS,EAAO,IAAI,CAAU,EAChC,EAAQ,EAAO,IAAI,CAAE,EACpB,EAAO,IAAI,EAAY,IAAI,IAAI,CAAC,CAAE,CAAC,CAAC,CAC3C,CAEA,SAAS,EAAK,EAAgB,EAA+B,CAC3D,GAAI,EAAQ,GAAY,CAAC,MAAM,QAAQ,CAAK,EAAG,MAAO,CAAC,EAEvD,IAAM,EAA+B,EAC/B,EAAsB,CAAC,EAE7B,IAAK,IAAM,KAAO,EAAU,CAC1B,GAAI,GAAU,EAAG,CACf,IACA,QACF,CACA,GAAI,CAACA,EAAc,CAAG,EAAG,SAEzB,IAAM,EAAK,EAAI,GACT,EAAO,EAAI,KAKjB,GAJI,OAAO,GAAO,UAAY,EAAG,SAAW,GACxC,IAAS,QAAU,IAAS,UAG5B,EAAkB,EAAI,QAAS,CAAM,IAAM,GAAO,SAEtD,IAEA,IAAI,EACJ,GAAI,IAAS,OAAQ,CAKnB,IAAM,EAAS,EAAgB,UAAU,EAAI,IAAI,EACjD,GAAI,CAAC,EAAO,QAAS,SACrB,EAAO,EAAO,IAChB,MAAO,GAAI,EAAI,OAAS,IAAA,GAGtB,SAGF,IAAM,EAAW,EAAK,EAAI,SAAU,EAAQ,CAAC,EAEzC,GAAM,OAAS,WACjB,EAAQ,EAAW,EAAK,OAAQ,EAAK,EAAE,EAInC,EAAiB,EAAI,MAAO,EAAQ,CAAa,IAAM,IAAA,IACzD,EAAQ,EAAgB,EAAK,OAAQ,EAAK,EAAE,GAIhD,EAAI,KAAK,CAAE,KAAI,OAAM,OAAM,MAAO,EAAI,MAAO,OAAQ,EAAI,SAAW,GAAM,UAAS,CAAC,CACtF,CAEA,OAAO,CACT,CAGA,MAAO,CAAE,MADK,EAAK,EAAS,CACf,EAAG,YAAW,iBAAgB,kBAAiB,CAC9D,CAmCA,eAAe,EACb,EACA,EACA,EACA,EAC0B,CAC1B,IAAM,EAAQ,IAAI,IACZ,EAAY,IAAI,IAChB,EAAS,IAAI,IAEb,EAAS,CAAC,GAAG,EAAS,UAAU,QAAQ,CAAC,EAmC/C,OAlCI,EAAO,OAAA,IACT,EAAK,QAAQ,KACX,CAAE,SAAQ,SAAQ,YAAa,EAAO,OAAQ,IAAA,EAA2B,EACzE,iEACF,EAGF,MAAM,QAAQ,IACZ,EAAO,MAAM,EAAA,EAAwB,CAAC,CAAC,IAAI,MAAO,CAAC,EAAY,KAAW,CACxE,IAAM,EAAM,CAAC,GAAG,CAAK,EAEf,EAAU,MAAM,EAAK,sBAAsB,EAAY,EAAK,CAAM,EAExE,GADA,EAAM,IAAI,EAAY,CAAO,EACzB,EAAQ,OAAS,EAAG,OAMxB,IAAM,EAAa,CAAC,GAAG,EAAQ,KAAK,CAAC,EAC/B,EAAe,MAAM,EAAK,gBAAgB,EAAY,EAAY,CAAM,EAC9E,EAAU,IAAI,EAAY,CAAY,EAKtC,IAAM,EAAa,EAAS,eAAe,IAAI,CAAU,EACzD,GAAI,IAAe,IAAA,GAAW,OAC9B,IAAM,EAAW,EAAW,OAAQ,GAAO,EAAW,IAAI,CAAE,GAAK,EAAa,IAAI,CAAE,CAAC,EACjF,EAAS,SAAW,GACxB,EAAO,IAAI,EAAY,MAAM,EAAK,cAAc,EAAY,EAAU,CAAM,CAAC,CAC/E,CAAC,CACH,EAEO,CAAE,QAAO,YAAW,QAAO,CACpC,CAYA,SAAS,EACP,EACA,EACA,EACA,EACoB,CACpB,IAAM,EAA0B,CAAC,EAEjC,IAAK,IAAM,KAAQ,EAAO,CACxB,IAAM,EAAW,EAAa,EAAK,SAAU,EAAQ,EAAS,CAAI,EAC5D,EAAW,EAAiB,EAAK,MAAO,EAAQ,EAAK,aAAa,EAExE,GAAI,EAAK,OAAS,SAAU,CAG1B,GADI,EAAS,SAAW,GACpB,IAAa,IAAA,GAAW,SAC5B,EAAI,KAAK,CACP,GAAI,EAAK,GACT,KAAM,SACN,MAAO,EACP,KAAM,KACN,OAAQ,GACR,SAAU,GACV,cAAe,GACf,UACF,CAAC,EACD,QACF,CAEA,IAAM,EAAO,EAAK,KAClB,GAAI,IAAS,IAAA,GAAW,SAExB,IAAI,EACA,EAAQ,EAEZ,GAAI,EAAK,OAAS,SAAU,CAC1B,IAAM,EAAO,EAAQ,MAAM,IAAI,EAAK,MAAM,CAAC,EAAE,IAAI,EAAK,EAAE,EAIxD,GADI,IAAS,IAAA,IACT,EAAQ,UAAU,IAAI,EAAK,MAAM,CAAC,EAAE,IAAI,EAAK,EAAE,IAAM,GAAM,SAC/D,EAAO,EAAK,SAAW,IAAA,GAAY,EAAO,GAAG,EAAK,GAAG,EAAK,SAC1D,IAAU,EAAQ,OAAO,IAAI,EAAK,MAAM,CAAC,EAAE,IAAI,EAAK,EAAE,CACxD,KAcE,GAAO,EAAgB,CAAI,EAKzB,IAAS,MAAQ,EAAK,SAAW,GACjC,IAAU,IAAA,IAAa,EAAM,SAAW,GAE5C,EAAI,KAAK,CACP,GAAI,EAAK,GACT,KAAM,OACN,QACA,OACA,OAAQ,EAAK,OACb,SAAU,GACV,cAAe,GACf,UACF,CAAC,CACH,CAEA,OAAO,CACT,CAYA,SAAS,EAAe,EAAuB,CAC7C,IAAM,EAAO,EAAM,QAAQ,GAAG,EACxB,EAAO,IAAS,GAAK,EAAQ,EAAM,MAAM,EAAG,CAAI,EACtD,OAAO,EAAK,OAAS,GAAK,EAAK,SAAS,GAAG,EAAI,EAAK,MAAM,EAAG,EAAE,EAAI,CACrE,CAOA,SAAS,EAAU,EAAoC,EAA4B,CACjF,IAAI,EAAiB,GAWrB,MAAO,CAAE,MAVK,EAAM,IAAK,GAA2B,CAClD,IAAM,EAAS,EAAU,EAAK,SAAU,CAAM,EACxC,EAAW,EAAK,OAAS,MAAQ,EAAe,EAAK,IAAI,IAAM,EAI/D,EAAgB,EAAO,eAE7B,OADI,GAAY,KAAe,EAAiB,IACzC,CAAE,GAAG,EAAM,WAAU,gBAAe,SAAU,EAAO,KAAM,CACpE,CACa,EAAG,gBAAe,CACjC,CAcA,SAAgB,EAAgB,EAAoB,EAAmC,CACrF,MAAO,CAAE,GAAG,EAAM,MAAO,EAAU,EAAK,MAAO,EAAe,CAAW,CAAC,CAAC,CAAC,KAAM,CACpF,CAmBA,eAAsB,EACpB,EACA,EACA,EAC8B,CAC9B,GAAI,EAAO,SAAW,GAAK,EAAO,OAASD,IAAmB,OAAO,KAErE,IAAM,EAAM,MAAM,EAAK,WAAW,CAAM,EACxC,GAAI,IAAQ,KAAM,OAAO,KAIzB,IAAM,EAAS,EAAI,SACb,EACJ,OAAO,GAAW,UAAY,OAAO,UAAU,CAAM,GAAK,GAAU,EAChE,KAAK,IAAI,EAAA,CAAsB,EAAA,EAG/B,EAAW,EAAY,EAAI,KAAM,EAAK,OAAQ,EAAK,cAAe,CAAQ,EAC5E,EAAS,iBAAmB,GAC9B,EAAK,QAAQ,KACX,CACE,SACA,OAAQ,EAAK,OACb,QAAS,EAAS,iBAClB,IAAA,GACF,EACA,oDACF,EAGF,IAAM,EAAU,MAAM,EAAW,EAAU,EAAK,OAAQ,EAAM,CAAM,EAC9D,EAAqB,CACzB,SACA,MAAO,EAAa,EAAS,MAAO,EAAK,OAAQ,EAAS,CAAI,CAChE,EAEA,OAAO,EAAK,cAAgB,IAAA,GAAY,EAAO,EAAgB,EAAM,EAAK,WAAW,CACvF,CC3jBA,SAASE,EAAc,EAAkD,CACvE,OAAyB,OAAO,GAAU,YAAnC,GAA+C,CAAC,MAAM,QAAQ,CAAK,CAC5E,CASA,SAAS,EACP,EACA,EAC+B,CAC/B,GAAI,CAACA,EAAc,CAAK,EAAG,OAC3B,IAAM,EAAyB,CAAC,EAChC,IAAK,GAAM,CAAC,EAAK,KAAU,OAAO,QAAQ,CAAK,EACzC,EAAU,CAAK,IAAG,EAAI,GAAO,GAEnC,OAAO,CACT,CAEA,MAAM,GAAY,GAAoC,OAAO,GAAU,SACjE,GAAa,GAAqC,OAAO,GAAU,UAOzE,SAAgB,EAAkB,EAAoC,CACpE,IAAI,EAAA,IACA,EAAU,EAEd,SAAS,EAAK,EAAc,EAA2B,CACrD,GAAI,CAAC,MAAM,QAAQ,CAAG,EAAG,MAAO,CAAC,EAGjC,IAAM,EAA+B,EACrC,GAAI,EAAA,EAIF,MADA,IAAW,EAAS,OACb,CAAC,EAGV,IAAM,EAAkB,CAAC,EACzB,IAAK,IAAM,KAAQ,EAAU,CAC3B,GAAI,CAACA,EAAc,CAAI,EAAG,CACxB,IACA,QACF,CAEA,IAAM,EAAK,EAAK,GACV,EAAO,EAAK,KAClB,GAAI,OAAO,GAAO,UAAY,EAAG,SAAW,EAAG,CAC7C,IACA,QACF,CACA,GAAI,IAAS,QAAU,IAAS,SAAU,CACxC,IACA,QACF,CAEA,IAAI,EACJ,GAAI,IAAS,OAAQ,CAKnB,IAAM,EAAS,EAAgB,UAAU,EAAK,IAAI,EAClD,GAAI,CAAC,EAAO,QAAS,CACnB,IACA,QACF,CACA,EAAO,EAAO,IAChB,MAAO,GAAI,EAAK,OAAS,IAAA,GAAW,CAGlC,IACA,QACF,CAEA,GAAI,GAAU,EAAG,CACf,IACA,QACF,CACA,IAWA,IAAM,EAAW,EAAU,EAAK,MAAO,EAAQ,EACzC,EACJ,IAAa,IAAA,IAAa,OAAO,KAAK,CAAQ,CAAC,CAAC,OAAS,EAAI,EAAW,IAAA,GACpE,EAAa,EAAU,EAAK,QAAS,EAAS,EAC9C,EACJ,IAAe,IAAA,IAAa,OAAO,KAAK,CAAU,CAAC,CAAC,OAAS,EAAI,EAAa,IAAA,GAChF,EAAI,KAAK,CACP,KACA,OACA,OAEA,MAAO,GAAS,KAChB,UACA,OAAQ,OAAO,EAAK,QAAW,UAAY,EAAK,OAAS,IAAA,GACzD,SAAU,EAAK,EAAK,SAAU,EAAQ,CAAC,CACzC,CAAC,CACH,CACA,OAAO,CACT,CAEA,MAAO,CAAE,MAAO,EAAK,EAAO,CAAC,EAAG,SAAQ,CAC1C,CAWA,SAAgB,EAAsB,EAA6C,CACjF,IAAM,EAAO,IAAI,IACX,EAAwB,CAAC,EAE/B,SAAS,EAAK,EAAkC,CAC9C,IAAK,IAAM,KAAQ,EAAO,CACxB,IAAM,EAAO,EAAK,KAClB,GAAI,GAAM,OAAS,SAAU,CAC3B,IAAM,EAAM,GAAG,EAAK,OAAO,GAAG,EAAK,KAC9B,EAAK,IAAI,CAAG,IACf,EAAK,IAAI,CAAG,EACZ,EAAK,KAAK,CAAE,OAAQ,EAAK,OAAQ,GAAI,EAAK,EAAG,CAAC,EAElD,CACA,EAAK,EAAK,QAAQ,CACpB,CACF,CAGA,OADA,EAAK,CAAK,EACH,CACT,CCnLA,MAAa,EAAmB,IA0DhC,SAAS,EAAc,EAAkD,CACvE,OAAyB,OAAO,GAAU,YAAnC,GAA+C,CAAC,MAAM,QAAQ,CAAK,CAC5E,CAQA,SAAS,EAAW,EAAwD,CAC1E,IAAM,EAAQ,EAAK,MACnB,GAAI,CAAC,EAAc,CAAK,EAAG,OAE3B,IAAM,EAAS,EAAM,OAGrB,GAFI,OAAO,GAAW,UAClB,EAAO,SAAW,GAAK,EAAO,OAAA,KAC9B,CAAC,EAAe,KAAK,CAAM,EAAG,OAElC,IAAM,EAAW,EAAM,YAQvB,MAAO,CAAE,SAAQ,MANf,OAAO,GAAa,UACpB,EAAS,OAAS,GAClB,EAAS,QAAA,IACL,EACA,CAEiB,CACzB,CAcA,SAAgB,EACd,EACA,EACsB,CACtB,IAAM,EAAyB,CAAC,EAChC,GAAI,CAAC,MAAM,QAAQ,CAAI,EAAG,MAAO,CAAE,UAAS,UAAW,GAAO,QAAS,CAAE,EAKzE,IAAM,EAA4B,EAE9B,EAAU,EACV,EAAY,GAWZ,EAAM,OAAA,MAA2B,EAAY,IACjD,IAAM,EAAmB,CAAC,EAC1B,IAAK,IAAI,EAAI,KAAK,IAAI,EAAM,OAAQ,CAAgB,EAAI,EAAG,GAAK,EAAG,IAAK,EAAM,KAAK,EAAM,EAAE,EAE3F,KAAO,EAAM,OAAS,GAAG,CACvB,GAAI,GAAA,KAA+B,EAAQ,QAAA,IAA8B,CACvE,EAAY,GACZ,KACF,CACA,IAAM,EAAO,EAAM,IAAI,EAOvB,GADA,IACI,CAAC,EAAc,CAAI,EAAG,SAE1B,IAAM,EAAQ,EAAW,CAAI,EACzB,IAAU,IAAA,IAAW,EAAQ,KAAK,CAAK,EAE3C,IAAM,EAAW,EAAK,SACtB,GAAI,MAAM,QAAQ,CAAQ,EAAG,CAC3B,IAAM,EAA4B,EAM5B,EAAO,KAAK,IAAI,EAAmB,EAAS,CAAC,EAC/C,EAAM,OAAS,IAAM,EAAY,IACrC,IAAK,IAAI,EAAI,KAAK,IAAI,EAAM,OAAQ,CAAI,EAAI,EAAG,GAAK,EAAG,IAAK,EAAM,KAAK,EAAM,EAAE,CACjF,CACF,CAcA,OAZI,GACF,GAAQ,KACN,CACE,UACA,UAAW,EAAQ,OACnB,WAAY,EACZ,UAAA,GACF,EACA,6EACF,EAGK,CAAE,UAAS,YAAW,SAAQ,CACvC,CCxKA,SAAS,EAAW,EAAgB,EAAoB,CACtD,MAAO,GAAG,EAAO,GAAG,GACtB,CAEA,MAAM,EAA0B,CAAE,MAAO,KAAM,OAAQ,GAAO,UAAW,IAAK,EAQ9E,SAAS,EAAU,EAIjB,CACA,IAAM,EAAS,IAAI,IACf,EAAW,EACX,EAAc,EAElB,IAAK,IAAM,KAAO,EAAM,CAEtB,GADI,OAAO,EAAI,QAAW,UAAY,OAAO,EAAI,IAAO,UACpD,EAAI,OAAO,SAAW,GAAK,EAAI,GAAG,SAAW,EAAG,SAEpD,IAAM,EAAS,EAAO,IAAI,EAAI,MAAM,EAChC,OAAQ,IAAI,EAAI,EAAE,EACtB,IAAI,GAAA,IAAiC,CACnC,IACA,QACF,CACA,IACI,EAAQ,EAAO,IAAI,EAAI,EAAE,EACxB,EAAO,IAAI,EAAI,OAAQ,IAAI,IAAI,CAAC,EAAI,EAAE,CAAC,CAAC,CAH7C,CAIF,CAEA,IAAM,EAAgB,KAAK,IAAI,EAAG,EAAO,KAAA,EAA4B,EACrE,MAAO,CAAE,SAAQ,cAAa,eAAc,CAC9C,CAoBA,eAAsB,EACpB,EACA,EACuC,CACvC,IAAM,EAAY,IAAI,IACtB,GAAI,EAAK,SAAW,EAAG,OAAO,EAE9B,IAAM,EAAS,EAAI,OAAO,MAAM,CAAE,QAAS,qBAAsB,CAAC,EAC5D,CAAE,SAAQ,cAAa,iBAAkB,EAAU,CAAI,EAwB7D,OAtBI,EAAc,GAChB,EAAO,KACL,CAAE,QAAS,EAAa,IAAA,GAAyB,EACjD,yFACF,EAEE,EAAgB,GAClB,EAAO,KACL,CAAE,QAAS,EAAe,IAAA,EAA2B,EACrD,qEACF,EAMF,MAAM,QAAQ,IACZ,CAAC,GAAG,EAAO,QAAQ,CAAC,CAAC,CAClB,MAAM,EAAA,EAAwB,CAAC,CAC/B,KAAK,CAAC,EAAY,KAAW,EAAa,EAAK,EAAQ,EAAY,EAAO,CAAS,CAAC,CACzF,EAEO,CACT,CAEA,eAAe,EACb,EACA,EACA,EACA,EACA,EACe,CAIf,IAAM,EAA6B,EAAI,SAAS,IAAI,CAAU,EAC9D,GAAI,IAAW,IAAA,GAAW,OAE1B,IAAM,EAAa,EAAoB,CAAM,EAGvC,EAAW,IAAe,KAC1B,EAAgB,EAAO,WAAW,KAAM,GAAM,EAAE,OAAS,aAAa,GAAK,GAC3E,EAAM,CAAC,GAAG,CAAK,EAErB,GAAI,CACF,IAAM,EAAS,EAAI,UAAU,CAAM,EAI7B,EAAO,MAAM,EAAO,SAAS,CACjC,MAAO,EAAQ,EAAO,EAAO,SAAS,EAAG,IAAI,EAAG,CAAG,EACnD,MAAO,EAAI,MACb,CAAC,EAEK,EAAO,IAAI,IACjB,IAAK,IAAM,KAAO,EAAM,CACtB,IAAM,EAAkC,EAClC,EAAK,EAAO,GAClB,GAAI,OAAO,GAAO,SAAU,SAC5B,IAAM,EAAW,EAAW,EAAO,GAAc,IAAA,GACjD,EAAK,IAAI,CAAE,EACX,EAAI,IAAI,EAAW,EAAY,CAAE,EAAG,CAClC,MAAO,OAAO,GAAa,UAAY,EAAS,OAAS,EAAI,EAAW,KACxE,OAAQ,GACR,UAAW,EAAgB,EAAO,SAAW,YAAc,IAC7D,CAAC,CACH,CAaA,IADyB,EAAO,OAAS,YAAc,aAEhD,IAAM,KAAM,EACV,EAAK,IAAI,CAAE,GAAG,EAAI,IAAI,EAAW,EAAY,CAAE,EAAG,CAAM,CAGnE,OAAS,EAAO,CAKd,EAAO,KACL,CAAE,OAAQ,EAAY,MAAO,EAAI,OAAQ,MAAO,OAAO,CAAK,CAAE,EAC9D,gEACF,CACF,CACF,CC7GA,MAAM,EAAU,kEAyBhB,SAAS,EAAa,EAAe,EAAS,IAAe,CAC3D,OAAO,IAAI,SAAS,KAAK,UAAU,CAAI,EAAG,CACxC,SACA,QAAS,CAAE,eAAgB,kBAAmB,CAChD,CAAC,CACH,CAEA,SAAS,EAAU,EAAiB,EAA0B,CAC5D,OAAO,EAAa,CAAE,MAAO,CAAQ,EAAG,CAAM,CAChD,CAGA,SAAS,GAAsB,CAC7B,OAAO,EAAa,CAAC,CAAC,CACxB,CAcA,SAAS,GAAmB,EAA+B,CACzD,OAAO,EAAsB,CAAM,GAAK,IAC1C,CAoFA,MAAM,GAAe,EAAiB,CACpC,OAAQ,QACR,KAAM,UACN,OAAQ,MAGR,WAAY,YAIZ,aAAc,CAAC,OAAO,EACtB,YACE,6FACF,OAAQ,SACR,QAAS,MA5FqC,EAAK,IAAQ,CAC3D,IAAM,EAAS,IAAI,IAAI,EAAI,GAAG,CAAC,CAAC,aAC1B,EAAa,EAAO,IAAI,QAAQ,EAChC,EAAK,EAAO,IAAI,IAAI,EAI1B,GAAI,IAAe,MAAQ,EAAW,SAAW,EAC/C,OAAO,EAAU,mCAAoC,GAAG,EAE1D,GAAI,EAAW,OAAS,GACtB,OAAO,EAAU,mCAAoC,GAAG,EAE1D,GAAI,IAAO,MAAQ,CAAC,EAAQ,KAAK,CAAE,EACjC,OAAO,EAAU,kCAAmC,GAAG,EAGzD,IAAM,EAAM,EAAc,EAC1B,GAAI,IAAQ,IAAA,GAGV,OAAO,EAAU,iBAAkB,GAAG,EAExC,IAAM,EAAS,EAAI,OAAO,MAAM,CAAE,MAAO,gBAAiB,OAAQ,CAAW,CAAC,EAI9E,GAAI,CAAC,EAAI,gBAAgB,EAAY,MAAM,EAKzC,OAJA,EAAO,MACL,CAAE,OAAQ,EAAI,KAAK,GAAI,KAAM,EAAI,KAAK,IAAK,EAC3C,iFACF,EACO,EAAU,EAGnB,IAAM,EAAS,EAAI,SAAS,IAAI,CAAU,EAC1C,GAAI,IAAW,IAAA,GAAW,OAAO,EAAU,EAE3C,IAAM,EAAiB,GAAmB,CAAM,EAEhD,GAAI,IAAmB,KAAM,OAAO,EAAU,EAK9C,IAAM,EAAQ,EAAgB,EAsBxB,EAAM,MAAM,IArBC,EAAY,CAC7B,SACA,GAAI,EAAI,GAAG,SACX,SACA,qBAAyC,CACvC,KAAM,CAAE,GAAI,EAAI,KAAK,GAAI,OAAQ,CAAC,EAAI,KAAK,MAAQ,QAAa,CAAE,EAKlE,SAAU,EAAO,EAAU,IACzB,IAAW,GAA2B,EAAI,gBAAgB,EAAU,CAAM,EAC5E,GAAI,IAAU,IAAA,IAAa,CAAE,OAAM,EACnC,GAAG,EAAmB,IAAA,GAAW,CAAG,CACtC,EACF,CAMuB,CAAC,CAAC,SAAS,EAAI,CACpC,GAAI,EAAI,SAAW,IAAA,IAAa,CAAE,OAAQ,EAAI,MAAO,EACrD,GAAI,EAAI,gBAAkB,IAAA,IAAa,CAAE,cAAe,EAAI,aAAc,CAC5E,CAAC,EACD,GAAI,IAAQ,KAAM,OAAO,EAAU,EAGnC,GAAM,CAAE,WAAY,EAAoBC,EAAO,GAAiB,CAAM,EACtE,OAAO,EAAa,CAAO,CAC7B,CAiBA,CAAC,EASK,GAAuC,MAAO,EAAK,IAAQ,CAC/D,IAAM,EAAS,IAAI,IAAI,EAAI,GAAG,CAAC,CAAC,aAAa,IAAI,QAAQ,EACzD,GAAI,IAAW,MAAQ,EAAO,SAAW,EACvC,OAAO,EAAU,mCAAoC,GAAG,EAE1D,GAAI,EAAO,OAAS,IAClB,OAAO,EAAU,mCAAoC,GAAG,EAG1D,IAAM,EAAM,EAAc,EAC1B,GAAI,IAAQ,IAAA,GAAW,OAAO,EAAU,iBAAkB,GAAG,EAC7D,IAAM,EAAS,EAAI,OAAO,MAAM,CAAE,MAAO,oBAAqB,CAAC,EAOzD,EAAS,EAAI,UAAU,CAAI,EAK3B,GAAM,MAJO,EAAO,SAAS,CACjC,MAAO,GAAG,EAAO,EAAO,SAAS,EAAG,QAAQ,EAAG,CAAM,EACrD,MAAO,CACT,CAAC,EAAA,CACgB,GACjB,GAAI,IAAQ,IAAA,GAAW,OAAO,EAAU,iBAAkB,GAAG,EAE7D,IAAM,EAAK,EAAI,GACT,EAAQ,OAAO,EAAI,OAAU,SAAW,EAAI,MAAQ,GACpD,EAAiB,EAAI,SACrB,EACJ,OAAO,GAAmB,UAAY,OAAO,UAAU,CAAc,GAAK,GAAkB,EACxF,KAAK,IAAI,EAAA,CAA8B,EAAA,EAEvC,EAAgC,EAAI,SAAW,YAAc,YAAc,QAK3E,EAAc,EAAW,CAAC,EAAE,iBAC5B,EAAgB,EAAI,eAAiB,IAAc,IAAM,KAQzD,EAAU,GAAe,EAAY,OAAS,EAAI,CAAC,GAAG,CAAW,EAAI,CAAC,EAEtE,GADQ,EAAQ,SAAS,CAAa,EAAI,EAAU,CAAC,EAAe,GAAG,CAAO,EAAA,CAC9D,IAAK,IAAU,CAAE,OAAM,MAAO,CAAK,EAAE,EAErD,EAAQ,MAAM,GAAiB,EAAK,EAAI,CAAM,EAC9C,EAAY,GAAO,KAuBnB,CAAE,MAAO,EAAM,QAAS,GAAqB,EAhBhC,IAAc,IAAA,IAAa,SAAU,EAAY,EAAU,KAAO,EAAI,IAgBV,EAC3E,EAAmB,GACrB,EAAO,KACL,CAAE,OAAQ,EAAI,SAAQ,QAAS,CAAiB,EAChD,4GACF,EAGF,IAAM,EAAa,MAAM,EAAyB,EAAK,EAAsB,CAAI,CAAC,EAC5E,EAAY,OAAO,YAAY,CAAU,EAOzC,EAAc,CAAC,GAAG,EAAI,SAAS,OAAO,CAAC,CAAC,CAC3C,OACE,GACC,EAAoB,CAAM,IAAM,IAAA,IAAa,EAAI,gBAAgB,EAAO,KAAM,MAAM,CACxF,CAAC,CACA,IAAK,IAAY,CAChB,KAAM,EAAO,KACb,MAAO,EAAO,OAAO,eAAiB,EAAO,OAAO,OAAS,EAAO,IACtE,EAAE,EAEE,EAAa,EAAI,gBAAgB,OAAQ,SAAS,EAoBxD,OAAO,EAAa,CATlB,KAAM,CAAE,KAAI,SAAQ,QAAO,WAAU,SAAQ,OAAM,YALzB,EAC1B,IAAc,IAAA,IAAa,gBAAiB,EAAY,EAAU,YAAc,EAAI,WAIF,CAAE,EACpF,YACA,UACA,gBACA,mBACA,cACA,aACA,GAAI,IAAU,IAAA,IAAa,CAAE,OAAM,CAEd,CAAC,CAC1B,EAqCA,eAAe,GACb,EACA,EACA,EAC2C,CAC3C,GAAI,CACF,GAAM,CAAE,iBAAkB,MAAM,OAAO,+BAEjC,EAAQ,MAAM,IADM,EAAc,CAAE,MAAO,EAAI,UAAU,CAAI,EAAG,OAAQ,CAAK,CACnD,CAAC,CAAC,SAAS,EAAQ,GAAoB,EAEvE,OADK,EACE,CACL,KAAM,EAAM,KACZ,UAAW,EAAM,UACjB,cAAe,EAAM,cAIrB,UACE,EAAM,qBAAqB,KAAO,EAAM,UAAU,YAAY,EAAI,OAAO,EAAM,SAAS,CAC5F,EAVY,MAWd,OAAS,EAAK,CACZ,EAAO,KAAK,CAAE,MAAK,QAAO,EAAG,iEAAiE,EAC9F,MACF,CACF,CAEA,MAAM,EAAmB,EAAiB,CACxC,OAAQ,QACR,KAAM,eACN,OAAQ,MAKR,WAAY,YACZ,aAAc,CAAC,OAAO,EACtB,YACE,6GACF,OAAQ,SACR,QAAS,EACX,CAAC,EAeY,GAAuB,EAO9B,GAAsB,EAAE,OAAO,CACnC,QAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,CAAwB,CAC5F,CAAC,EAsFK,GAAgB,EAAiB,CACrC,OAAQ,QACR,KAAM,WACN,OAAQ,MAQR,WAAY,2BAGZ,aAAc,CAAC,QAAS,QAAQ,EAChC,YACE,sFAGF,OAAQ,SACR,QAAS,MAvEsC,EAAK,IAAQ,CAC5D,IAAM,EAAS,GAAoB,UAAU,CAC3C,QAAS,CAAC,GAAG,IAAI,IAAI,IAAI,IAAI,EAAI,GAAG,CAAC,CAAC,aAAa,OAAO,QAAQ,CAAC,CAAC,CACtE,CAAC,EACD,GAAI,CAAC,EAAO,QACV,OAAO,EACL,4EACA,GACF,EAEF,GAAM,CAAE,WAAY,EAAO,KAErB,EAAM,EAAc,EAC1B,GAAI,IAAQ,IAAA,GAAW,OAAO,EAAU,iBAAkB,GAAG,EAC7D,IAAM,EAAS,EAAI,OAAO,MAAM,CAAE,MAAO,gBAAiB,CAAC,EAKrD,CAAE,wBAAyB,MAAM,OAAO,uCACxC,EAAO,EAAqB,CAAG,EAG/B,EAAS,EAAI,QAAU,EAAI,eAAiB,EAAK,cAEjD,EAAW,MAAM,QAAQ,IAC7B,EAAQ,IAAI,KAAO,IAAwE,CACzF,GAAI,CAGF,IAAM,EAAO,MAAM,EAAQ,EAAQ,CAAE,QAAO,EAAG,CAAI,EACnD,MAAO,CAAC,EAAQ,IAAS,KAAO,KAAO,EAAK,KAAK,CACnD,OAAS,EAAK,CACZ,EAAO,KACL,CAAE,MAAK,SAAQ,QAAO,EACtB,qEACF,EACA,MACF,CACF,CAAC,CACH,EAQA,OAAO,EAAa,CANlB,MAAO,OAAO,YACZ,EAAS,OACN,GAA2D,IAAU,IAAA,EACxE,CACF,CAEqB,CAAC,CAC1B,CAuBA,CAAC,EAgBD,SAAgB,IAA4B,CAC1C,OAAO,EAAmB,CAAC,GAAc,EAAkB,EAAa,CAAC,CAC3E"}

package/dist/columns-D9y6Mvcp.mjs

@@ -0,0 +1,2 @@
+import{sanitizeHref as e}from"@murumets-ee/blocks/links";import{z as t}from"zod";import{auditable as n,defineEntity as r,field as i,publishable as a}from"@murumets-ee/entity";import{getContentConfig as o}from"@murumets-ee/content/plugin";const s=6,c=500,l=128,u=/^[A-Za-z0-9_-]+$/,d=t.discriminatedUnion(`kind`,[t.object({kind:t.literal(`entity`),entity:t.string().min(1).max(64),id:t.string().uuid(),anchor:t.string().min(1).max(128).regex(u).optional()}),t.object({kind:t.literal(`url`),url:t.string().min(1).max(2048).transform(t=>e(t)).refine(e=>e!==``,{message:`link url uses a disallowed protocol (allowed: http, https, mailto, tel, or a relative path)`})}),t.object({kind:t.literal(`email`),email:t.string().email().max(254)})]);function f(e,n){let r=new Set(n);return t.unknown().superRefine((e,n)=>{if(typeof e!=`object`||!e||Array.isArray(e))return;let i=Object.keys(e);if(i.length>r.size){n.addIssue({code:t.ZodIssueCode.custom,message:`too many locale keys — configured locales are: ${[...r].join(`, `)}`});return}for(let e of i)r.has(e)||n.addIssue({code:t.ZodIssueCode.custom,path:[e],message:`unknown locale key — configured locales are: ${[...r].join(`, `)}`})}).pipe(t.record(t.string(),e))}function p(e){let n=f(t.string().max(200),e.allowedLocales),r=f(t.boolean(),e.allowedLocales),i=t.lazy(()=>t.object({id:t.string().min(1).max(64),kind:t.enum([`link`,`header`]),link:d.optional(),label:n.nullable().default(null),enabled:r.optional(),newTab:t.boolean().optional(),children:t.array(i).default([])}).superRefine((e,n)=>{if(e.kind===`link`){e.link===void 0&&n.addIssue({code:t.ZodIssueCode.custom,path:[`link`],message:`a link item requires a link target`});return}e.link!==void 0&&n.addIssue({code:t.ZodIssueCode.custom,path:[`link`],message:`a header item must not carry a link target`}),(e.label===null||Object.keys(e.label).length===0)&&n.addIssue({code:t.ZodIssueCode.custom,path:[`label`],message:`a header item requires a label for at least one locale`})}));return i}function m(e){return t.array(p(e))}function h(e){if(!Array.isArray(e))return{depth:0,nodeCount:0};let t=0,n=0,r=e.map(e=>({node:e,depth:1}));for(;r.length>0;){let e=r.pop();if(e===void 0)break;let{node:i,depth:a}=e;if(typeof i!=`object`||!i||Array.isArray(i))continue;if(n++,a>t&&(t=a),n>500||t>6)return{depth:t,nodeCount:n};let o=i.children;if(Array.isArray(o)){let e=o;for(let t of e)r.push({node:t,depth:a+1})}}return{depth:t,nodeCount:n}}function g(e,t){return h(e).depth<=t}const _=t.string().min(1).max(64),v=t.array(_).max(64).nullable().transform(e=>{if(e===null)return null;let t=[...new Set(e)];return t.length===0?null:t});function y(e){if(!Array.isArray(e))return null;let t=e,n=[],r=new Set;for(let e of t)if(!(typeof e!=`string`||e.length===0)&&!(e.length>64)&&!r.has(e)&&(r.add(e),n.push(e),n.length===64))break;return n.length===0?null:n}function b(e){if(e.keys.includes(`entityTypes`))throw new t.ZodError([{code:`custom`,path:[`entityTypes`],message:`bulk update on '${e.entityName}' cannot write 'entityTypes': updateMany runs no per-row hooks, so the whitelist would bypass its schema check. A whitelist is per-menu — update each row individually, or write a migration for a one-off backfill.`}])}function x(e){return new t.ZodError(e.issues.map(e=>({...e,path:[`entityTypes`,...e.path]})))}function S(e){if(!(`entityTypes`in e))return e;let t=v.safeParse(e.entityTypes);if(!t.success)throw x(t.error);return{...e,entityTypes:t.data}}function C(){return{name:`menuEntityTypesValidation`,hooks:{beforeCreate:async e=>S(e),beforeUpdate:async(e,t)=>S(t)},assertBulkUpdate:b}}function w(e,n=[]){return new t.ZodError([{code:t.ZodIssueCode.custom,path:[`tree`,...n],message:e}])}function T(e){return new t.ZodError(e.issues.map(e=>({...e,path:[`tree`,...e.path]})))}function E(e){if(!(typeof e!=`number`||!Number.isInteger(e))&&!(e<1||e>6))return e}async function D(e,t,n){let r=E(e.maxDepth);if(r!==void 0)return r;if(!n)return 3;if(!t?.loadCurrent)throw Error(`menu: BehaviorContext.loadCurrent is unavailable — cannot validate the tree against the menu's maxDepth. Writes must go through AdminClient.update.`);return E((await t.loadCurrent())?.maxDepth)??3}async function O(e,t){let n=E(e.maxDepth);if(n===void 0)return;if(!t?.loadCurrent)throw Error(`menu: BehaviorContext.loadCurrent is unavailable — cannot validate the stored tree against the new maxDepth. Writes must go through AdminClient.update.`);let{depth:r}=h((await t.loadCurrent())?.tree);if(r>n)throw w(`the stored menu tree is nested ${r} levels deep, deeper than this menu's new maxDepth (${n}) — flatten the tree first`)}async function k(e,t,n,r){let i=e.tree;if(i===void 0)return n&&await O(e,t),e;if(i===null||!Array.isArray(i))throw w(`menu tree must be an array of menu items`);let{depth:a,nodeCount:o}=h(i);if(o>500)throw w(`menu tree has too many items (max 500)`);if(a>6)throw w(`menu tree is nested too deeply (absolute max 6 levels)`);let s=m({allowedLocales:r()}).safeParse(i);if(!s.success)throw T(s.error);let c=await D(e,t,n);if(a>c)throw w(`menu tree is nested deeper than this menu's maxDepth (${c})`);return{...e,tree:s.data}}function A(e){let t=e?.resolveAllowedLocales??(()=>o().locales.map(e=>e.code));return{name:`menuTreeValidation`,hooks:{beforeCreate:async(e,n)=>k(e,n,!1,t),beforeUpdate:async(e,n,r)=>k(n,r,!0,t)}}}const j=r({name:`menu`,site:`bound`,admin:{label:`Menus`,icon:`menu`},fields:{handle:i.slug({from:`title`}),title:i.text({required:!0}),maxDepth:i.number({default:3,min:1,max:6,integer:!0}),tree:i.json({refScan:!0,default:[]}),entityTypes:i.json({default:null})},behaviors:[n(),a(),A(),C()],scope:`global`,access:{view:`public`,create:`group.admin`,update:`group.admin`,delete:`group.admin`}});function M(e,t){return e[t]}export{d as a,c,h as d,g as f,u as i,p as l,j as n,l as o,y as r,s,M as t,m as u};
+//# sourceMappingURL=columns-D9y6Mvcp.mjs.map

package/dist/columns-D9y6Mvcp.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"columns-D9y6Mvcp.mjs","names":["roots","prefixIssues"],"sources":["../src/menu-item-schema.ts","../src/menu-entity-types.ts","../src/behaviors/menu-entity-types-validation.ts","../src/behaviors/menu-tree-validation.ts","../src/entity.ts","../src/internal/columns.ts"],"sourcesContent":["/**\n * `MenuItem` — the menu tree node — and its recursive Zod validation\n * (plan/routing phase 08 §3).\n *\n * A menu's `tree` column is ordered nested JSONB (D008), so the ONLY thing\n * standing between an admin PATCH and the database is this schema: it is the\n * boundary validation required by CLAUDE.md's C5. It enforces\n *\n * - the `kind`-conditional shape (`link` items carry a `LinkValue`, `header`\n *   items carry a label map and no link),\n * - locale keys drawn from the app's configured locale set,\n * - `LinkValue`s that mirror `@murumets-ee/blocks`' union exactly, with `url`\n *   kinds protocol-gated through the SAME `sanitizeHref` allowlist the link\n *   picker uses (no `javascript:` / `data:` / protocol-relative smuggling),\n * - hard structural bounds on tree size + nesting, checked BEFORE the\n *   recursive parse so a hostile payload can't turn validation itself into a\n *   stack-overflow / CPU amplification vector.\n *\n * This module is deliberately **pure**: no `@murumets-ee/core`, no content\n * plugin lookup, no DB. The allowed-locale set is passed IN, so the schema can\n * be built server-side (the `menuTreeValidation()` behavior) or client-side\n * (PR10's editor, with locales handed down from the server) from the same code.\n * Cross-field depth validation against the entity's sibling `maxDepth` column\n * lives in {@link validateTreeDepth}, which the behavior calls separately.\n */\n\nimport { sanitizeHref } from '@murumets-ee/blocks/links'\nimport { z } from 'zod'\n\n/**\n * Absolute nesting cap for any menu, independent of a menu's own `maxDepth`\n * (phase 07 §2.7 — \"depth is capped per menu (default 3, max 6)\"). Also the\n * bound that keeps the recursive parse from being a DoS vector.\n */\nexport const MAX_MENU_DEPTH = 6\n\n/** `maxDepth`'s default — a 3-level menu (phase 08 §2). */\nexport const DEFAULT_MENU_DEPTH = 3\n\n/**\n * Upper bound on the number of nodes in one menu tree. Navigation menus are\n * hand-curated: a few dozen items is a big one. The cap exists so a single\n * PATCH can't hand the validator (and `extractRefs`' ref walk, and every\n * subsequent render) an unbounded amount of work — CLAUDE.md's\n * \"no unbounded fan-out\" rule applied to a single request payload.\n */\nexport const MAX_MENU_TREE_NODES = 500\n\n/**\n * Max stored length of a `url`-kind link. Pinned to `entity`'s\n * `MAX_EXTERNAL_URL_LENGTH` (the `external_link_usage.url_raw` column width)\n * at COMPILE time via `satisfies` + a type-only import — so a longer URL is\n * rejected at the boundary instead of being silently dropped from the\n * reference graph. Same drift-proofing trick as content's\n * `DEFAULT_LOCALE_SENTINEL`; `import type` has zero runtime cost, so the pure\n * schema module keeps its (client-safe) dependency-free shape.\n */\nexport const MAX_MENU_URL_LENGTH =\n  2048 satisfies typeof import('@murumets-ee/entity/refs')['MAX_EXTERNAL_URL_LENGTH']\n\n/** Max length of an item's stable id (a UUID today; generated client-side). */\nconst MAX_ITEM_ID_LENGTH = 64\n\n/** Max length of a per-locale label string. */\nconst MAX_LABEL_LENGTH = 200\n\n/**\n * Max length of an entity-link fragment/anchor.\n *\n * Exported because this module is the SINGLE OWNER of the anchor bounds: the\n * write-side schema below, the read-side anchor walk\n * (`admin/anchors.ts`) and the editor's manual-entry fallback\n * (`@murumets-ee/menus-ui`'s anchor picker, via the client-safe `./schema`\n * subpath) all validate against exactly these two constants. Two of those three\n * used to carry their own copy; a drift between them would let the picker offer\n * — or the editor accept — a value the write boundary then rejects.\n */\nexport const MAX_ANCHOR_LENGTH = 128\n\n/**\n * Max length of an entity NAME inside an entity link (`page`, `article`, …).\n *\n * Exported for the same single-owner reason as {@link MAX_ANCHOR_LENGTH}: the\n * per-menu `entityTypes` whitelist (`./menu-entity-types.ts`) stores values of\n * exactly this kind, and a second copy of the bound could drift into a\n * whitelist entry the link schema then refuses.\n */\nexport const MAX_ENTITY_NAME_LENGTH = 64\n\n/**\n * Anchors are slugified by the block editor (phase 08 §5) and rendered into an\n * `href` as `#<anchor>`; restricting them to slug characters keeps that\n * interpolation inert.\n *\n * Exported for the same single-owner reason as {@link MAX_ANCHOR_LENGTH}.\n */\nexport const ANCHOR_PATTERN = /^[A-Za-z0-9_-]+$/\n\n/**\n * A menu item's link target — the item-type union phase 07 §2.2 and phase 08 §3\n * define: `entity` (+ optional anchor) | `url` | `email`.\n *\n * **A NARROWED SUBSET of `@murumets-ee/blocks`' `LinkValue`, deliberately.**\n * Blocks additionally carries a `media` kind; menus does NOT, because no phase\n * gives a menu a media-href seam to resolve one with (phase 11 §2 specifies\n * `href` as \"canonical path from `toolkit_paths`; external URLs verbatim;\n * header items null\" and nothing else). Accepting a `media` link would let it\n * validate, persist, and register an `entity_refs` row — arming delete\n * protection for that file — while the renderer had no way to emit it: the item\n * would silently never appear. Rejecting it at the write boundary turns that\n * dead weight into a real 400. Widening later is additive (an arm here plus a\n * `resolveMediaHref` dep on `MenuResolveDeps`) and needs no shape change.\n *\n * Every `MenuLinkValue` IS a valid blocks `LinkValue` (the subset direction, and\n * the one `resolveLinkHref` needs) — pinned at compile time by an assignment in\n * `menu-item-schema.test.ts`, so a drift in blocks' union is a build error\n * rather than a silent divergence.\n *\n * The `anchor?: string | undefined` is forced by the combination of Zod and this\n * repo's `exactOptionalPropertyTypes`: `.optional()` always widens to\n * `T | undefined`, which is NOT assignable to blocks' `anchor?: string` under\n * that flag.\n */\nexport type MenuLinkValue =\n  | { kind: 'entity'; entity: string; id: string; anchor?: string | undefined }\n  | { kind: 'url'; url: string }\n  | { kind: 'email'; email: string }\n\n/**\n * A menu tree node (phase 08 §3 / D009).\n *\n * `label: null` means \"use the LIVE title of the linked entity, per locale\";\n * a map is an explicit per-locale override. `enabled` is per-locale visibility\n * in BOTH directions — absent/`true` shows the item, `false` hides it in that\n * locale — so one tree serves every locale (no `menu_translations` table).\n *\n * Declared as a `type`, NOT an `interface`, on purpose: only type aliases get\n * TypeScript's implicit index signature, and without it `MenuItem[]` is not\n * assignable to the `Record<string, unknown>[]` arm of `AdminClient.create/\n * update`'s json-field value type — every caller storing a typed tree would\n * need a cast.\n */\nexport type MenuItem = {\n  /** Stable id — DND identity + anchor for audit diffs. */\n  id: string\n  /** `header` = a text-only dropdown parent with no link of its own. */\n  kind: 'link' | 'header'\n  /**\n   * Present iff `kind === 'link'`.\n   *\n   * The explicit `| undefined` is required by the repo's\n   * `exactOptionalPropertyTypes` — Zod's `.optional()` emits\n   * `LinkValue | undefined`, and without it the schema wouldn't typecheck\n   * against this interface.\n   */\n  link?: MenuLinkValue | undefined\n  /** `null` = live entity title per locale; a map = explicit override. */\n  label: Record<string, string> | null\n  /** Per-locale visibility. Absent/`true` = visible; `false` = hidden. */\n  enabled?: Record<string, boolean> | undefined\n  newTab?: boolean | undefined\n  children: MenuItem[]\n}\n\n/**\n * One menu item's target, as the editor needs to render its row\n * (`@murumets-ee/menus/admin`'s `resolveMenuItemSummaries`).\n *\n * Declared here — not in `admin/summaries.ts` — for the same reason\n * {@link BlockAnchor} is: it is a pure data shape with no server dependency,\n * so the client-safe `./schema` subpath can re-export it without pulling the\n * server-only resolver along. `import type` is erased at compile time either\n * way, but a single canonical home (this leaf module) is simpler to reason\n * about than \"which of two server-only files owns the type\".\n */\nexport interface MenuItemSummary {\n  /**\n   * The target row's live title, or `null` when the entity declares no\n   * display-able field. Unlike the public render path — which DROPS such an\n   * item rather than show a raw uuid as navigation — the admin editor still\n   * reports the target as present, just unlabelled.\n   */\n  title: string | null\n  /** `false` = the target row is gone (deleted) → a BROKEN item. */\n  exists: boolean\n  /** `null` when the entity isn't publishable — no draft/published distinction applies. */\n  published: boolean | null\n}\n\n/**\n * One addressable block anchor on a document (`@murumets-ee/menus/admin`'s\n * `collectBlockAnchors` / the anchors endpoint). See {@link MenuItemSummary}'s\n * doc for why this pure shape lives here rather than in `admin/anchors.ts`.\n */\nexport interface BlockAnchor {\n  /** The stable id rendered as the block element's `id` attribute. */\n  anchor: string\n  /** Display text — `anchorLabel` when usable, else the anchor value itself. */\n  label: string\n}\n\n/** Options for {@link buildMenuItemSchema} / {@link buildMenuTreeSchema}. */\nexport interface MenuSchemaOptions {\n  /**\n   * Locale codes accepted as keys in `label` / `enabled` maps. Anything else\n   * is a validation error — a typo'd locale would produce a label no renderer\n   * ever reads (the same failure mode content's `validateLocale` guards).\n   */\n  allowedLocales: readonly string[]\n}\n\n/**\n * {@link MenuLinkValue} as Zod. Blocks models its own `LinkValue` as a plain TS\n * type + structural guards (zod-free by design), so this is the first Zod\n * encoding of it — narrowed to the three kinds a menu item may carry.\n *\n * There is deliberately NO `media` arm (see {@link MenuLinkValue}): a media\n * link has no href seam at render time, so accepting one would store a\n * permanently invisible item. `z.discriminatedUnion` rejects it with an\n * `Invalid discriminator value. Expected 'entity' | 'url' | 'email'` issue —\n * which names the allowed set without echoing the caller's own value back.\n *\n * `url` kinds run through `sanitizeHref`, the single source of truth for the\n * href protocol allowlist (`http:`/`https:`/`mailto:`/`tel:` + relative\n * paths); it returns `''` for anything it rejects, including\n * protocol-relative `//evil.com` and obfuscated `java\\nscript:`.\n */\nexport const LinkValueSchema = z.discriminatedUnion('kind', [\n  z.object({\n    kind: z.literal('entity'),\n    entity: z.string().min(1).max(MAX_ENTITY_NAME_LENGTH),\n    id: z.string().uuid(),\n    anchor: z.string().min(1).max(MAX_ANCHOR_LENGTH).regex(ANCHOR_PATTERN).optional(),\n  }),\n  z.object({\n    kind: z.literal('url'),\n    // Transform-then-refine, NOT refine-alone: `sanitizeHref` trims, so\n    // validating its output while storing the raw input would let a value\n    // that PASSED validation differ from the value that gets STORED (leading\n    // /trailing whitespace). Storing the sanitizer's own return value keeps\n    // stored == validated. The arrow wrapper is required — `sanitizeHref`'s\n    // second parameter is the protocol allowlist, and passing Zod's ctx into\n    // it would silently replace the allowlist.\n    url: z\n      .string()\n      .min(1)\n      .max(MAX_MENU_URL_LENGTH)\n      .transform((value) => sanitizeHref(value))\n      .refine((value) => value !== '', {\n        message:\n          'link url uses a disallowed protocol (allowed: http, https, mailto, tel, or a relative path)',\n      }),\n  }),\n  z.object({\n    kind: z.literal('email'),\n    email: z.string().email().max(254),\n  }),\n])\n\n/**\n * A `Record<locale, T>` whose keys must all be configured locale codes.\n *\n * The key check is PIPED INTO the record parse rather than refined on top of\n * it, so it runs against the RAW value BEFORE any per-value parsing. That\n * ordering is the whole point: with `z.record(...).superRefine(...)`, zod\n * parses all N values first, so a 1,000,000-key map of wrong-typed values\n * emits 1,000,000 `invalid_type` issues before a width check on top could ever\n * fire (verified empirically against zod 3.25). Piping caps BOTH shapes —\n * unknown keys and bad values — at a single issue.\n */\nfunction localeMap<T extends z.ZodTypeAny>(\n  valueSchema: T,\n  allowedLocales: readonly string[],\n): z.ZodType<Record<string, z.infer<T>>, z.ZodTypeDef, unknown> {\n  const allowed = new Set(allowedLocales)\n  return z\n    .unknown()\n    .superRefine((value, ctx) => {\n      // Not a plain object — let the record parse below emit the single\n      // \"expected object\" issue rather than duplicating its message here.\n      if (value === null || typeof value !== 'object' || Array.isArray(value)) return\n\n      const keys = Object.keys(value)\n      // Width bound, checked FIRST. A legitimate map holds at most one entry\n      // per configured locale, so a wider map is malformed by construction and\n      // gets ONE issue for the whole map. Without this, a single node carrying\n      // e.g. 1,000,000 keys sails past the tree pre-scan (which bounds node\n      // COUNT and DEPTH, never map WIDTH) and turns validation itself into the\n      // amplification vector it exists to prevent: a multi-hundred-MB issue\n      // array plus an oversized audit-log write, from one request.\n      // CLAUDE.md's \"no unbounded fan-out\" applied to a single payload.\n      if (keys.length > allowed.size) {\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          message: `too many locale keys — configured locales are: ${[...allowed].join(', ')}`,\n        })\n        return\n      }\n\n      // Past the width bound this loop is bounded by the CONFIGURED locale\n      // count, never by the payload.\n      for (const key of keys) {\n        if (!allowed.has(key)) {\n          ctx.addIssue({\n            code: z.ZodIssueCode.custom,\n            path: [key],\n            // Names the allowed set (server-side data), never echoes the\n            // caller-supplied key into the message — see the api-handler's\n            // \"refine()/custom messages must not echo user input\" contract.\n            message: `unknown locale key — configured locales are: ${[...allowed].join(', ')}`,\n          })\n        }\n      }\n    })\n    .pipe(z.record(z.string(), valueSchema))\n}\n\n/**\n * The recursive per-node schema. Input is `unknown` (this parses untrusted\n * JSONB), output is a fully-narrowed {@link MenuItem}. Unknown properties are\n * STRIPPED by Zod's default object behavior, so writing the parse result back\n * onto the payload also sanitizes it — nothing a caller invents gets stored.\n */\nexport function buildMenuItemSchema(\n  options: MenuSchemaOptions,\n): z.ZodType<MenuItem, z.ZodTypeDef, unknown> {\n  const labelMap = localeMap(z.string().max(MAX_LABEL_LENGTH), options.allowedLocales)\n  const enabledMap = localeMap(z.boolean(), options.allowedLocales)\n\n  const schema: z.ZodType<MenuItem, z.ZodTypeDef, unknown> = z.lazy(() =>\n    z\n      .object({\n        id: z.string().min(1).max(MAX_ITEM_ID_LENGTH),\n        kind: z.enum(['link', 'header']),\n        link: LinkValueSchema.optional(),\n        label: labelMap.nullable().default(null),\n        enabled: enabledMap.optional(),\n        newTab: z.boolean().optional(),\n        children: z.array(schema).default([]),\n      })\n      .superRefine((node, ctx) => {\n        if (node.kind === 'link') {\n          if (node.link === undefined) {\n            ctx.addIssue({\n              code: z.ZodIssueCode.custom,\n              path: ['link'],\n              message: 'a link item requires a link target',\n            })\n          }\n          return\n        }\n        // header\n        if (node.link !== undefined) {\n          ctx.addIssue({\n            code: z.ZodIssueCode.custom,\n            path: ['link'],\n            message: 'a header item must not carry a link target',\n          })\n        }\n        // A header has no entity to borrow a live title from, so its label\n        // map is required (phase 08 §3) — otherwise it renders as nothing.\n        if (node.label === null || Object.keys(node.label).length === 0) {\n          ctx.addIssue({\n            code: z.ZodIssueCode.custom,\n            path: ['label'],\n            message: 'a header item requires a label for at least one locale',\n          })\n        }\n      }),\n  )\n\n  return schema\n}\n\n/** The whole tree — an array of {@link buildMenuItemSchema} nodes. */\nexport function buildMenuTreeSchema(\n  options: MenuSchemaOptions,\n): z.ZodType<MenuItem[], z.ZodTypeDef, unknown> {\n  return z.array(buildMenuItemSchema(options))\n}\n\n/** Result of {@link measureMenuTree}. */\nexport interface MenuTreeMeasurement {\n  /** Deepest nesting level; `0` for an empty tree, `1` for flat items. */\n  depth: number\n  /** Total node count across every level. */\n  nodeCount: number\n}\n\n/**\n * Measure a (possibly untrusted) tree's depth + node count **iteratively**, so\n * measuring can never blow the stack the way a recursive walk over a hostile\n * payload would. Stops early once either hard bound is exceeded and reports\n * the over-limit value — the caller turns that into a validation error.\n *\n * Accepts `unknown` on purpose: this runs BEFORE the Zod parse (bounding the\n * work that parse will do), so it can't assume a well-formed shape.\n */\nexport function measureMenuTree(tree: unknown): MenuTreeMeasurement {\n  if (!Array.isArray(tree)) return { depth: 0, nodeCount: 0 }\n\n  let maxDepth = 0\n  let nodeCount = 0\n  // `Array.isArray` narrows an `unknown` to `any[]`; re-binding through a\n  // `readonly unknown[]` annotation keeps every element typed as `unknown`\n  // instead of silently leaking `any` into the walk.\n  const roots: readonly unknown[] = tree\n  const stack: Array<{ node: unknown; depth: number }> = roots.map((node) => ({ node, depth: 1 }))\n\n  while (stack.length > 0) {\n    const current = stack.pop()\n    if (current === undefined) break\n    const { node, depth } = current\n    if (node === null || typeof node !== 'object' || Array.isArray(node)) continue\n\n    nodeCount++\n    if (depth > maxDepth) maxDepth = depth\n    // Early abort: past either bound the exact totals no longer matter, only\n    // that they're over — and continuing would be the amplification we're\n    // guarding against.\n    if (nodeCount > MAX_MENU_TREE_NODES || maxDepth > MAX_MENU_DEPTH) {\n      return { depth: maxDepth, nodeCount }\n    }\n\n    const children = (node as { children?: unknown }).children\n    if (Array.isArray(children)) {\n      const items: readonly unknown[] = children\n      for (const child of items) stack.push({ node: child, depth: depth + 1 })\n    }\n  }\n\n  return { depth: maxDepth, nodeCount }\n}\n\n/**\n * Cross-field check: does `tree` nest no deeper than the menu's own\n * `maxDepth`? Lives outside the node schema because a per-node Zod refinement\n * has no visibility of the sibling `maxDepth` COLUMN — the behavior calls this\n * after the recursive parse.\n */\nexport function validateTreeDepth(tree: unknown, maxDepth: number): boolean {\n  return measureMenuTree(tree).depth <= maxDepth\n}\n","/**\n * The per-menu `entityTypes` whitelist — \"which content types may be linked\n * from this menu\" (plan/routing phase 07 §2.8, 09 §3, 10 §4).\n *\n * Drupal's per-content-type menu offering, minus the config-entity ceremony: a\n * `page` doesn't declare \"I belong in menus\", each MENU declares which types it\n * accepts. Two surfaces consume it — the menu editor's \"Add link\" picker (which\n * content types its Content tab offers) and the Meta panel's Menus section\n * (which menus an entity's edit screen offers to join).\n *\n * ## Semantics — `null` is \"everything\", and it is the ONLY unrestricted shape\n *\n * `null` (or an absent column) = the menu accepts every entity type. That is the\n * default, and it is what every menu row written before this column existed\n * reads back as, so the whitelist is backward-compatible by construction.\n *\n * An EMPTY array means the same thing, and {@link MenuEntityTypesSchema}\n * normalises it to `null` on the way in — the editor's \"nothing selected\" state\n * naturally produces `[]`, and letting both spellings persist would mean every\n * reader had to remember to check for two. Readers still tolerate a stored `[]`\n * (a hand-edited row, an older dump) via {@link menuAcceptsEntityType}.\n *\n * A menu that accepts NOTHING is deliberately unrepresentable: it could only\n * ever be a mistake, and \"empty selection\" is far more likely to mean \"I haven't\n * narrowed this yet\" than \"refuse everything\".\n *\n * ## Not a security boundary\n *\n * This is an authoring affordance. It decides what a picker OFFERS; it does not\n * decide what a caller may write — `menu:update` on the entity PATCH does, and\n * `menuTreeValidation()` re-checks the tree's shape regardless of the whitelist.\n * So the read path fails OPEN (a malformed column means \"no restriction\"): a\n * junk value must not hide every menu from the admin who needs to fix it. The\n * WRITE path fails closed, as every boundary does.\n *\n * @module\n */\n\nimport { z } from 'zod'\nimport { MAX_ENTITY_NAME_LENGTH } from './menu-item-schema.js'\n\n/**\n * Upper bound on how many entity types one menu's whitelist may name.\n *\n * A real app registers a few dozen entities, so this is a malformed-payload\n * guard rather than a product limit — it keeps a hostile PATCH from parking an\n * unbounded array in the column (and, through it, in every editor's RSC\n * payload).\n *\n * **Not** `MAX_MENU_ENTITY_TYPES` (`./get-menu.ts`, 16). That one bounds RENDER\n * fan-out — how many distinct types one menu render may issue batched lookups\n * for — and applies to the types actually present in the stored tree. This one\n * bounds the stored AUTHORING whitelist, which costs no I/O at all.\n */\nexport const MAX_MENU_ENTITY_TYPE_WHITELIST = 64\n\n/** One entity name in the whitelist — same bound `link.entity` carries. */\nconst EntityTypeName = z.string().min(1).max(MAX_ENTITY_NAME_LENGTH)\n\n/**\n * The write-boundary schema for `menu.entityTypes`.\n *\n * Strict where {@link normalizeMenuEntityTypes} is tolerant: a junk entry is a\n * 400, not a silent drop, because silently discarding half an admin's selection\n * and reporting success is worse than refusing the write. Duplicates ARE folded\n * (an idempotent selection is not an error), and `[]` becomes `null` so the\n * column only ever holds one representation of \"unrestricted\".\n */\nexport const MenuEntityTypesSchema: z.ZodType<string[] | null, z.ZodTypeDef, unknown> = z\n  .array(EntityTypeName)\n  // DELIBERATE ORDER — `.max()` runs on the RAW array, BEFORE the dedup in the\n  // transform below, so 65 copies of `'page'` is a 400 even though it would\n  // store one entry. The bound is on the PAYLOAD, not on the result: deduping\n  // first would mean accepting an unbounded array to prove it was small.\n  .max(MAX_MENU_ENTITY_TYPE_WHITELIST)\n  .nullable()\n  .transform((value) => {\n    if (value === null) return null\n    const deduped = [...new Set(value)]\n    return deduped.length === 0 ? null : deduped\n  })\n\n/**\n * Narrow a raw `entityTypes` column value (untrusted shape) to a usable\n * whitelist, or `null` for \"no restriction\".\n *\n * The read-side counterpart of {@link MenuEntityTypesSchema}, and tolerant for\n * the same reason `normalizeMenuTree` is: rows written before this column\n * existed, hand edits and restored dumps all reach readers, and a render must\n * degrade rather than throw. Anything unusable — a non-array, a non-string\n * entry, a whitelist that reduces to nothing — reads as `null`.\n */\nexport function normalizeMenuEntityTypes(value: unknown): string[] | null {\n  if (!Array.isArray(value)) return null\n  // `Array.isArray` narrows `unknown` to `any[]`; re-binding through a\n  // `readonly unknown[]` annotation keeps every element typed as `unknown`.\n  const raw: readonly unknown[] = value\n\n  const out: string[] = []\n  const seen = new Set<string>()\n  for (const entry of raw) {\n    if (typeof entry !== 'string' || entry.length === 0) continue\n    if (entry.length > MAX_ENTITY_NAME_LENGTH) continue\n    if (seen.has(entry)) continue\n    seen.add(entry)\n    out.push(entry)\n    if (out.length === MAX_MENU_ENTITY_TYPE_WHITELIST) break\n  }\n  return out.length === 0 ? null : out\n}\n\n/**\n * Does this menu accept links to `entityType`?\n *\n * Takes the RAW column value so callers holding a `field.json()`-typed row can\n * ask directly, without narrowing first. Exact string match — entity names are\n * lowercase identifiers, and a case-insensitive or prefix match would silently\n * widen a whitelist the admin wrote precisely.\n *\n * Fails OPEN (see the module header): absent, empty and malformed all mean \"no\n * restriction\".\n */\nexport function menuAcceptsEntityType(value: unknown, entityType: string): boolean {\n  const whitelist = normalizeMenuEntityTypes(value)\n  return whitelist === null || whitelist.includes(entityType)\n}\n","/**\n * `menuEntityTypesValidation()` — boundary validation for the\n * `menu.entityTypes` JSONB column (plan/routing phase 07 §2.8, F056).\n *\n * `field.json()`'s own validation is the deliberately permissive JSON union, so\n * without this hook an admin PATCH could park any shape — including an unbounded\n * array — in the column, and every reader (editor picker, Meta panel, every RSC\n * payload that carries the row) would pay for it. CLAUDE.md's \"validate at the\n * boundary\" applied to the one column `menuTreeValidation()` doesn't cover.\n *\n * **Why a second behavior rather than a branch inside `menuTreeValidation()`.**\n * The two share nothing: the tree check is CROSS-FIELD (it reads the sibling\n * `maxDepth` column through `loadCurrent`) and CROSS-MODULE (locale keys against\n * the content plugin's registry, hence its injectable resolver option); this one\n * is self-contained and needs no context at all. Folding it in would put an\n * option-less concern behind `MenuTreeValidationOptions` and make a behavior\n * named \"tree validation\" own a non-tree column.\n *\n * Errors are `ZodError`s so the admin API maps them to **400 with structured\n * issues** rather than a 500 — same contract `menuTreeValidation()` relies on.\n * Issues are pathed at `entityTypes` so the client can point at the field.\n */\n\nimport type { Behavior, BulkUpdateInfo } from '@murumets-ee/entity'\nimport { z } from 'zod'\nimport { MenuEntityTypesSchema } from '../menu-entity-types.js'\n\n/**\n * `AdminClient.updateMany` runs NO per-row hooks, so `beforeUpdate` above never\n * fires on that path — a bulk statement could otherwise park an unbounded or\n * malformed array in the column and every reader would pay for it, which is the\n * exact hole this behavior exists to close. `assertBulkUpdate` is the sanctioned\n * cover for that gap (same mechanism `hierarchical()` uses to stop a partial\n * bulk tree write).\n *\n * This REJECTS rather than validates: `updateMany` sets one value across every\n * matched row, and \"every menu accepts exactly these types\" is not a coherent\n * intent — a whitelist is per-menu by definition. There is no legitimate bulk\n * caller to serve, so refusing is both safer and more honest than silently\n * validating a shape nobody should be writing this way.\n */\nfunction assertNoBulkEntityTypesWrite(info: BulkUpdateInfo): void {\n  if (!info.keys.includes('entityTypes')) return\n  throw new z.ZodError([\n    {\n      code: 'custom',\n      path: ['entityTypes'],\n      message:\n        `bulk update on '${info.entityName}' cannot write 'entityTypes': updateMany runs no ` +\n        'per-row hooks, so the whitelist would bypass its schema check. A whitelist is ' +\n        'per-menu — update each row individually, or write a migration for a one-off backfill.',\n    },\n  ])\n}\n\n/** Prefix every issue path with `entityTypes` so the client can locate it. */\nfunction prefixIssues(error: z.ZodError): z.ZodError {\n  return new z.ZodError(\n    error.issues.map((issue) => ({ ...issue, path: ['entityTypes', ...issue.path] })),\n  )\n}\n\n/**\n * Validate + normalize `data.entityTypes` in place, returning the payload with\n * the PARSED value (so `[]` is persisted as `null` and duplicates are folded —\n * see `../menu-entity-types.ts` for why there is exactly one unrestricted\n * shape).\n *\n * A payload without the key is a partial update that doesn't touch the column;\n * it passes through untouched rather than being defaulted, which would let a\n * `{ tree }`-only PATCH silently clear an authored whitelist.\n */\nfunction validateEntityTypes(data: Record<string, unknown>): Record<string, unknown> {\n  if (!('entityTypes' in data)) return data\n\n  const parsed = MenuEntityTypesSchema.safeParse(data.entityTypes)\n  if (!parsed.success) throw prefixIssues(parsed.error)\n  return { ...data, entityTypes: parsed.data }\n}\n\n/**\n * Recursive-free Zod validation of `menu.entityTypes` on every create/update.\n *\n * Contributes NO fields, so the field-map type param is the EMPTY map\n * `Record<never, never>` — NOT `Record<string, never>`, which would merge into\n * the entity's field map and collapse every field to `never`.\n */\nexport function menuEntityTypesValidation(): Behavior<\n  Record<never, never>,\n  'menuEntityTypesValidation'\n> {\n  return {\n    name: 'menuEntityTypesValidation',\n    hooks: {\n      beforeCreate: async (data) => validateEntityTypes(data),\n      beforeUpdate: async (_id, data) => validateEntityTypes(data),\n    },\n    assertBulkUpdate: assertNoBulkEntityTypesWrite,\n  }\n}\n","/**\n * `menuTreeValidation()` — boundary validation for the `menu.tree` JSONB column\n * (plan/routing phase 08 §3, F040 pt.2).\n *\n * Why a behavior and not field-local validation: two of the four rules are\n * CROSS-FIELD or CROSS-MODULE. The tree's nesting depth is checked against the\n * sibling `maxDepth` COLUMN, and the locale keys are checked against the app's\n * configured content locales — neither is visible to `field.json()`'s\n * (deliberately permissive) JSON union. `BehaviorContext` gives a hook both:\n * the update payload and, via `loadCurrent`, the pre-update row.\n *\n * Errors are raised as `ZodError`s on purpose: the admin API handler maps\n * `ZodError` to **400 with structured issues** (a plain `Error` would surface\n * as a 500), so an editor saving a malformed tree gets a per-node message\n * pointing at the offending item instead of \"Internal server error\".\n */\n\nimport { getContentConfig } from '@murumets-ee/content/plugin'\nimport type { Behavior, BehaviorContext } from '@murumets-ee/entity'\nimport { z } from 'zod'\nimport {\n  buildMenuTreeSchema,\n  DEFAULT_MENU_DEPTH,\n  MAX_MENU_DEPTH,\n  MAX_MENU_TREE_NODES,\n  measureMenuTree,\n} from '../menu-item-schema.js'\n\n/** Options for {@link menuTreeValidation}. */\nexport interface MenuTreeValidationOptions {\n  /**\n   * Resolve the locale codes accepted as `label` / `enabled` keys.\n   *\n   * Defaults to the `content()` plugin's configured locales, read LAZILY (per\n   * write, never at module scope) so the behavior can be constructed before\n   * the app boots. Injectable so the behavior is unit-testable without a\n   * booted content plugin.\n   */\n  resolveAllowedLocales?: () => readonly string[]\n}\n\n/** One-issue `ZodError` at `tree`(`.path`) — the 400-mapped failure shape. */\nfunction treeError(message: string, path: Array<string | number> = []): z.ZodError {\n  return new z.ZodError([{ code: z.ZodIssueCode.custom, path: ['tree', ...path], message }])\n}\n\n/** Prefix every issue path with `tree` so the client can locate the node. */\nfunction prefixIssues(error: z.ZodError): z.ZodError {\n  return new z.ZodError(error.issues.map((issue) => ({ ...issue, path: ['tree', ...issue.path] })))\n}\n\n/** A `maxDepth` value from an (unvalidated, pre-field-validation) payload. */\nfunction readMaxDepth(value: unknown): number | undefined {\n  if (typeof value !== 'number' || !Number.isInteger(value)) return undefined\n  if (value < 1 || value > MAX_MENU_DEPTH) return undefined\n  return value\n}\n\n/**\n * The effective `maxDepth` for this write.\n *\n * Hooks run BEFORE field validation, so a payload's `maxDepth` may be absent\n * or junk; junk falls through to the persisted/default value and is rejected a\n * moment later by the field's own `min`/`max`. On a partial update that\n * touches only `tree`, the persisted value comes from `loadCurrent()` (the\n * eagerly-loaded pre-update snapshot).\n */\nasync function resolveMaxDepth(\n  data: Record<string, unknown>,\n  ctx: BehaviorContext | undefined,\n  isUpdate: boolean,\n): Promise<number> {\n  const fromPayload = readMaxDepth(data.maxDepth)\n  if (fromPayload !== undefined) return fromPayload\n  if (!isUpdate) return DEFAULT_MENU_DEPTH\n\n  if (!ctx?.loadCurrent) {\n    // Fail loud rather than silently skipping the cross-field check — an\n    // unvalidated depth is a correctness hole. AdminClient always wires\n    // `loadCurrent` on the update codepath, so this only trips on a\n    // mis-wired / direct hook invocation. (Same posture as `pathParent`.)\n    throw new Error(\n      'menu: BehaviorContext.loadCurrent is unavailable — cannot validate the tree ' +\n        \"against the menu's maxDepth. Writes must go through AdminClient.update.\",\n    )\n  }\n  const current = await ctx.loadCurrent()\n  // A vanished/unreadable row can't supply its own bound, so fall back to the\n  // DEFAULT (3) — the same value a create would get — not the absolute cap\n  // (6). Falling back to the ceiling would make an edge case the single most\n  // PERMISSIVE path in the behavior; the safe fallback is the floor. The\n  // absolute cap still applies separately, and the update itself fails\n  // downstream when the row is genuinely gone.\n  return readMaxDepth(current?.maxDepth) ?? DEFAULT_MENU_DEPTH\n}\n\n/**\n * The REVERSE cross-field check: an update that narrows `maxDepth` without\n * touching `tree`.\n *\n * `{\"maxDepth\": 1}` on a menu whose stored tree is 5 levels deep used to skip\n * validation entirely (the payload has no `tree`, so there was nothing to\n * measure) — the write succeeded and the row then PERMANENTLY violated\n * \"tree depth <= maxDepth\" until someone happened to edit the tree again.\n * Both directions of the invariant have to be enforced, so when `maxDepth`\n * moves we measure the PERSISTED tree against the new bound.\n */\nasync function validateStoredTreeAgainstNewMaxDepth(\n  data: Record<string, unknown>,\n  ctx: BehaviorContext | undefined,\n): Promise<void> {\n  // Absent (or junk — the field's own min/max rejects that a moment later)\n  // means this write doesn't move the bound, so there's nothing to re-check.\n  const maxDepth = readMaxDepth(data.maxDepth)\n  if (maxDepth === undefined) return\n\n  if (!ctx?.loadCurrent) {\n    // Same fail-loud posture as `resolveMaxDepth` — silently skipping the\n    // check is precisely the hole this function closes.\n    throw new Error(\n      'menu: BehaviorContext.loadCurrent is unavailable — cannot validate the stored tree ' +\n        'against the new maxDepth. Writes must go through AdminClient.update.',\n    )\n  }\n\n  const current = await ctx.loadCurrent()\n  // Measured iteratively and on a value already bounded at write time, so this\n  // is cheap even for the largest legal tree.\n  const { depth } = measureMenuTree(current?.tree)\n  if (depth > maxDepth) {\n    throw treeError(\n      `the stored menu tree is nested ${depth} levels deep, deeper than this menu's ` +\n        `new maxDepth (${maxDepth}) — flatten the tree first`,\n    )\n  }\n}\n\n/**\n * Validate + normalize `data.tree` in place. Returns the payload with `tree`\n * replaced by the PARSED value, so unknown properties a caller invented are\n * stripped before they reach the column.\n */\nasync function validateTree(\n  data: Record<string, unknown>,\n  ctx: BehaviorContext | undefined,\n  isUpdate: boolean,\n  resolveAllowedLocales: () => readonly string[],\n): Promise<Record<string, unknown>> {\n  const tree = data.tree\n  if (tree === undefined) {\n    // No tree in the payload — but a `maxDepth`-only update still has to be\n    // checked against the tree already in the column.\n    if (isUpdate) await validateStoredTreeAgainstNewMaxDepth(data, ctx)\n    return data\n  }\n  if (tree === null || !Array.isArray(tree)) {\n    throw treeError('menu tree must be an array of menu items')\n  }\n\n  // Structural bounds FIRST — this walk is iterative, so it holds even for a\n  // payload crafted to blow the recursive parse's stack.\n  const { depth, nodeCount } = measureMenuTree(tree)\n  if (nodeCount > MAX_MENU_TREE_NODES) {\n    throw treeError(`menu tree has too many items (max ${MAX_MENU_TREE_NODES})`)\n  }\n  if (depth > MAX_MENU_DEPTH) {\n    throw treeError(`menu tree is nested too deeply (absolute max ${MAX_MENU_DEPTH} levels)`)\n  }\n\n  const parsed = buildMenuTreeSchema({ allowedLocales: resolveAllowedLocales() }).safeParse(tree)\n  if (!parsed.success) throw prefixIssues(parsed.error)\n\n  const maxDepth = await resolveMaxDepth(data, ctx, isUpdate)\n  if (depth > maxDepth) {\n    throw treeError(`menu tree is nested deeper than this menu's maxDepth (${maxDepth})`)\n  }\n\n  return { ...data, tree: parsed.data }\n}\n\n/**\n * Recursive Zod validation of `menu.tree` on every create/update.\n *\n * Contributes NO fields, so the field-map type param is the EMPTY map\n * `Record<never, never>` — NOT `Record<string, never>`, which would merge into\n * the entity's field map and collapse every field to `never` (a break that\n * only surfaces through the built `.d.mts`).\n */\nexport function menuTreeValidation(\n  options?: MenuTreeValidationOptions,\n): Behavior<Record<never, never>, 'menuTreeValidation'> {\n  const resolveAllowedLocales =\n    options?.resolveAllowedLocales ?? (() => getContentConfig().locales.map((l) => l.code))\n\n  return {\n    name: 'menuTreeValidation',\n    hooks: {\n      beforeCreate: async (data, ctx) => validateTree(data, ctx, false, resolveAllowedLocales),\n      beforeUpdate: async (_id, data, ctx) => validateTree(data, ctx, true, resolveAllowedLocales),\n    },\n  }\n}\n","/**\n * The `menu` entity (plan/routing phase 08 §2, D008/D009).\n *\n * A menu is a normal entity whose item tree is ONE ordered nested JSONB column\n * — the family WordPress migrated to and Statamic uses, and the same storage\n * philosophy as our blocks layouts. Whole-tree edits save atomically in one\n * PATCH, and `publishable()` gives draft-then-publish menu editing for free.\n *\n * Locale variance lives INSIDE the tree (per-item `label` / `enabled` maps),\n * so there is deliberately no `translatable` field and no `menu_translations`\n * table — one structure serves every locale (D009).\n */\n\nimport { auditable, defineEntity, field, publishable } from '@murumets-ee/entity'\nimport { menuEntityTypesValidation } from './behaviors/menu-entity-types-validation.js'\nimport { menuTreeValidation } from './behaviors/menu-tree-validation.js'\nimport { DEFAULT_MENU_DEPTH, MAX_MENU_DEPTH } from './menu-item-schema.js'\n\nexport const Menu = defineEntity({\n  name: 'menu',\n  // Menus belong to one site (multisite D002); the `handle` unique is per site,\n  // so every site can have its own `main` and `footer`.\n  site: 'bound',\n  admin: {\n    label: 'Menus',\n    icon: 'menu',\n  },\n  fields: {\n    // Fetch key — 'main', 'footer' (phase 07 §2.8). `from: 'title'` is the\n    // admin form's client-side auto-fill source (SlugField watches it); the\n    // value itself is author-chosen and stable, so `sluggable()` (which would\n    // REGENERATE the handle when the title changes) is deliberately not used.\n    // `field.slug()` already sets `unique` + `indexed` — no need to repeat them.\n    handle: field.slug({ from: 'title' }),\n    title: field.text({ required: true }),\n    // 1..6 — the renderer clamps too (phase 07 §2.7).\n    maxDepth: field.number({\n      default: DEFAULT_MENU_DEPTH,\n      min: 1,\n      max: MAX_MENU_DEPTH,\n      integer: true,\n    }),\n    // MenuItem[] — shape validated by `menuTreeValidation()`; `refScan` makes\n    // every LinkValue in the tree register in `entity_refs` /\n    // `external_link_usage` on save, so a menu item pointing at a page shows\n    // up in delete-protection warnings and the broken-links dashboard\n    // (phase 08 §4) with no menus-side ref code at all.\n    tree: field.json({ refScan: true, default: [] }),\n    // Which content types may be linked FROM this menu (phase 07 §2.8) — the\n    // menu editor's picker and the Meta panel's Menus section both read it.\n    // `null` = accepts every type, which is what every row written before this\n    // column existed reads back as, so the whitelist is backward-compatible by\n    // construction. Shape validated by `menuEntityTypesValidation()`; semantics\n    // and the read-side predicate live in `./menu-entity-types.ts`.\n    //\n    // No `refScan`: the value holds entity NAMES, not `LinkValue`s — there is\n    // no row to reference, so a scan would find nothing.\n    entityTypes: field.json({ default: null }),\n  },\n  behaviors: [auditable(), publishable(), menuTreeValidation(), menuEntityTypesValidation()],\n  scope: 'global',\n  // Advisory metadata (the firewall is deny-by-default + operator grants).\n  // Menus are site-wide navigation: a bad edit is visible on EVERY page, and\n  // the tree is a structural artifact rather than content — so writes are\n  // admin-only, while `view` is public because the frontend reads menus\n  // unauthenticated through the content API.\n  access: {\n    view: 'public',\n    create: 'group.admin',\n    update: 'group.admin',\n    delete: 'group.admin',\n  },\n})\n","/**\n * Typed column access for a dynamically-generated entity table.\n *\n * `AdminClient.getTable()` / `QueryClient.getTable()` both return\n * `PgTableWithColumns<any>` (Drizzle cannot type columns that are generated\n * from a runtime entity definition), so reading a column off one directly\n * yields `any` and silently erodes this package's type coverage. Narrowing\n * through this helper pins the ONE column being filtered on — the same idiom\n * `@murumets-ee/content`'s `buildEnumerateDeps` uses.\n *\n * Internal to `@murumets-ee/menus`; not part of any public entry.\n */\n\nimport type { PgColumn, PgTableWithColumns } from 'drizzle-orm/pg-core'\n\n/** Read one named column off a runtime-generated entity table, typed. */\nexport function column<K extends string>(\n  // biome-ignore lint/suspicious/noExplicitAny: Drizzle cannot type dynamically-generated column schemas — `PgTableWithColumns<any>` is `getTable()`'s own declared return type (CLAUDE.md's sanctioned case).\n  table: PgTableWithColumns<any>,\n  name: K,\n): PgColumn {\n  return (table as unknown as Record<K, PgColumn>)[name]\n}\n"],"mappings":"8OAkCA,MAAa,EAAiB,EAYjB,EAAsB,IA+BtB,EAAoB,IAmBpB,EAAiB,mBAmIjB,EAAkB,EAAE,mBAAmB,OAAQ,CAC1D,EAAE,OAAO,CACP,KAAM,EAAE,QAAQ,QAAQ,EACxB,OAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,EAA0B,EACpD,GAAI,EAAE,OAAO,CAAC,CAAC,KAAK,EACpB,OAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,GAAqB,CAAC,CAAC,MAAM,CAAc,CAAC,CAAC,SAAS,CAClF,CAAC,EACD,EAAE,OAAO,CACP,KAAM,EAAE,QAAQ,KAAK,EAQrB,IAAK,EACF,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,IAAmB,CAAC,CACxB,UAAW,GAAU,EAAa,CAAK,CAAC,CAAC,CACzC,OAAQ,GAAU,IAAU,GAAI,CAC/B,QACE,6FACJ,CAAC,CACL,CAAC,EACD,EAAE,OAAO,CACP,KAAM,EAAE,QAAQ,OAAO,EACvB,MAAO,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,CACnC,CAAC,CACH,CAAC,EAaD,SAAS,EACP,EACA,EAC8D,CAC9D,IAAM,EAAU,IAAI,IAAI,CAAc,EACtC,OAAO,EACJ,QAAQ,CAAC,CACT,aAAa,EAAO,IAAQ,CAG3B,GAAsB,OAAO,GAAU,WAAnC,GAA+C,MAAM,QAAQ,CAAK,EAAG,OAEzE,IAAM,EAAO,OAAO,KAAK,CAAK,EAS9B,GAAI,EAAK,OAAS,EAAQ,KAAM,CAC9B,EAAI,SAAS,CACX,KAAM,EAAE,aAAa,OACrB,QAAS,kDAAkD,CAAC,GAAG,CAAO,CAAC,CAAC,KAAK,IAAI,GACnF,CAAC,EACD,MACF,CAIA,IAAK,IAAM,KAAO,EACX,EAAQ,IAAI,CAAG,GAClB,EAAI,SAAS,CACX,KAAM,EAAE,aAAa,OACrB,KAAM,CAAC,CAAG,EAIV,QAAS,gDAAgD,CAAC,GAAG,CAAO,CAAC,CAAC,KAAK,IAAI,GACjF,CAAC,CAGP,CAAC,CAAC,CACD,KAAK,EAAE,OAAO,EAAE,OAAO,EAAG,CAAW,CAAC,CAC3C,CAQA,SAAgB,EACd,EAC4C,CAC5C,IAAM,EAAW,EAAU,EAAE,OAAO,CAAC,CAAC,IAAI,GAAgB,EAAG,EAAQ,cAAc,EAC7E,EAAa,EAAU,EAAE,QAAQ,EAAG,EAAQ,cAAc,EAE1D,EAAqD,EAAE,SAC3D,EACG,OAAO,CACN,GAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAkB,EAC5C,KAAM,EAAE,KAAK,CAAC,OAAQ,QAAQ,CAAC,EAC/B,KAAM,EAAgB,SAAS,EAC/B,MAAO,EAAS,SAAS,CAAC,CAAC,QAAQ,IAAI,EACvC,QAAS,EAAW,SAAS,EAC7B,OAAQ,EAAE,QAAQ,CAAC,CAAC,SAAS,EAC7B,SAAU,EAAE,MAAM,CAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CACtC,CAAC,CAAC,CACD,aAAa,EAAM,IAAQ,CAC1B,GAAI,EAAK,OAAS,OAAQ,CACpB,EAAK,OAAS,IAAA,IAChB,EAAI,SAAS,CACX,KAAM,EAAE,aAAa,OACrB,KAAM,CAAC,MAAM,EACb,QAAS,oCACX,CAAC,EAEH,MACF,CAEI,EAAK,OAAS,IAAA,IAChB,EAAI,SAAS,CACX,KAAM,EAAE,aAAa,OACrB,KAAM,CAAC,MAAM,EACb,QAAS,4CACX,CAAC,GAIC,EAAK,QAAU,MAAQ,OAAO,KAAK,EAAK,KAAK,CAAC,CAAC,SAAW,IAC5D,EAAI,SAAS,CACX,KAAM,EAAE,aAAa,OACrB,KAAM,CAAC,OAAO,EACd,QAAS,wDACX,CAAC,CAEL,CAAC,CACL,EAEA,OAAO,CACT,CAGA,SAAgB,EACd,EAC8C,CAC9C,OAAO,EAAE,MAAM,EAAoB,CAAO,CAAC,CAC7C,CAmBA,SAAgB,EAAgB,EAAoC,CAClE,GAAI,CAAC,MAAM,QAAQ,CAAI,EAAG,MAAO,CAAE,MAAO,EAAG,UAAW,CAAE,EAE1D,IAAI,EAAW,EACX,EAAY,EAKV,EAAiDA,EAAM,IAAK,IAAU,CAAE,OAAM,MAAO,CAAE,EAAE,EAE/F,KAAO,EAAM,OAAS,GAAG,CACvB,IAAM,EAAU,EAAM,IAAI,EAC1B,GAAI,IAAY,IAAA,GAAW,MAC3B,GAAM,CAAE,OAAM,SAAU,EACxB,GAAqB,OAAO,GAAS,WAAjC,GAA6C,MAAM,QAAQ,CAAI,EAAG,SAOtE,GALA,IACI,EAAQ,IAAU,EAAW,GAI7B,EAAA,KAAmC,EAAA,EACrC,MAAO,CAAE,MAAO,EAAU,WAAU,EAGtC,IAAM,EAAY,EAAgC,SAClD,GAAI,MAAM,QAAQ,CAAQ,EAAG,CAC3B,IAAM,EAA4B,EAClC,IAAK,IAAM,KAAS,EAAO,EAAM,KAAK,CAAE,KAAM,EAAO,MAAO,EAAQ,CAAE,CAAC,CACzE,CACF,CAEA,MAAO,CAAE,MAAO,EAAU,WAAU,CACtC,CAQA,SAAgB,EAAkB,EAAe,EAA2B,CAC1E,OAAO,EAAgB,CAAI,CAAC,CAAC,OAAS,CACxC,CCjYA,MAAM,EAAiB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,EAA0B,EAWtD,EAA2E,EACrF,MAAM,CAAc,CAAC,CAKrB,IAAA,EAAkC,CAAC,CACnC,SAAS,CAAC,CACV,UAAW,GAAU,CACpB,GAAI,IAAU,KAAM,OAAO,KAC3B,IAAM,EAAU,CAAC,GAAG,IAAI,IAAI,CAAK,CAAC,EAClC,OAAO,EAAQ,SAAW,EAAI,KAAO,CACvC,CAAC,EAYH,SAAgB,EAAyB,EAAiC,CACxE,GAAI,CAAC,MAAM,QAAQ,CAAK,EAAG,OAAO,KAGlC,IAAM,EAA0B,EAE1B,EAAgB,CAAC,EACjB,EAAO,IAAI,IACjB,IAAK,IAAM,KAAS,EACd,YAAO,GAAU,UAAY,EAAM,SAAW,IAC9C,IAAM,OAAA,KACN,GAAK,IAAI,CAAK,IAClB,EAAK,IAAI,CAAK,EACd,EAAI,KAAK,CAAK,EACV,EAAI,SAAA,IAA2C,MAErD,OAAO,EAAI,SAAW,EAAI,KAAO,CACnC,CCpEA,SAAS,EAA6B,EAA4B,CAC3D,KAAK,KAAK,SAAS,aAAa,EACrC,MAAM,IAAI,EAAE,SAAS,CACnB,CACE,KAAM,SACN,KAAM,CAAC,aAAa,EACpB,QACE,mBAAmB,EAAK,WAAW,qNAGvC,CACF,CAAC,CACH,CAGA,SAASC,EAAa,EAA+B,CACnD,OAAO,IAAI,EAAE,SACX,EAAM,OAAO,IAAK,IAAW,CAAE,GAAG,EAAO,KAAM,CAAC,cAAe,GAAG,EAAM,IAAI,CAAE,EAAE,CAClF,CACF,CAYA,SAAS,EAAoB,EAAwD,CACnF,GAAI,EAAE,gBAAiB,GAAO,OAAO,EAErC,IAAM,EAAS,EAAsB,UAAU,EAAK,WAAW,EAC/D,GAAI,CAAC,EAAO,QAAS,MAAMA,EAAa,EAAO,KAAK,EACpD,MAAO,CAAE,GAAG,EAAM,YAAa,EAAO,IAAK,CAC7C,CASA,SAAgB,GAGd,CACA,MAAO,CACL,KAAM,4BACN,MAAO,CACL,aAAc,KAAO,IAAS,EAAoB,CAAI,EACtD,aAAc,MAAO,EAAK,IAAS,EAAoB,CAAI,CAC7D,EACA,iBAAkB,CACpB,CACF,CCzDA,SAAS,EAAU,EAAiB,EAA+B,CAAC,EAAe,CACjF,OAAO,IAAI,EAAE,SAAS,CAAC,CAAE,KAAM,EAAE,aAAa,OAAQ,KAAM,CAAC,OAAQ,GAAG,CAAI,EAAG,SAAQ,CAAC,CAAC,CAC3F,CAGA,SAAS,EAAa,EAA+B,CACnD,OAAO,IAAI,EAAE,SAAS,EAAM,OAAO,IAAK,IAAW,CAAE,GAAG,EAAO,KAAM,CAAC,OAAQ,GAAG,EAAM,IAAI,CAAE,EAAE,CAAC,CAClG,CAGA,SAAS,EAAa,EAAoC,CACpD,YAAO,GAAU,UAAY,CAAC,OAAO,UAAU,CAAK,IACpD,IAAQ,GAAK,EAAA,GACjB,OAAO,CACT,CAWA,eAAe,EACb,EACA,EACA,EACiB,CACjB,IAAM,EAAc,EAAa,EAAK,QAAQ,EAC9C,GAAI,IAAgB,IAAA,GAAW,OAAO,EACtC,GAAI,CAAC,EAAU,MAAA,GAEf,GAAI,CAAC,GAAK,YAKR,MAAU,MACR,qJAEF,EASF,OAAO,GAAa,MAPE,EAAI,YAAY,EAAA,EAOT,QAAQ,GAAA,CACvC,CAaA,eAAe,EACb,EACA,EACe,CAGf,IAAM,EAAW,EAAa,EAAK,QAAQ,EAC3C,GAAI,IAAa,IAAA,GAAW,OAE5B,GAAI,CAAC,GAAK,YAGR,MAAU,MACR,yJAEF,EAMF,GAAM,CAAE,SAAU,GAAgB,MAHZ,EAAI,YAAY,EAAA,EAGK,IAAI,EAC/C,GAAI,EAAQ,EACV,MAAM,EACJ,kCAAkC,EAAM,sDACrB,EAAS,2BAC9B,CAEJ,CAOA,eAAe,EACb,EACA,EACA,EACA,EACkC,CAClC,IAAM,EAAO,EAAK,KAClB,GAAI,IAAS,IAAA,GAIX,OADI,GAAU,MAAM,EAAqC,EAAM,CAAG,EAC3D,EAET,GAAI,IAAS,MAAQ,CAAC,MAAM,QAAQ,CAAI,EACtC,MAAM,EAAU,0CAA0C,EAK5D,GAAM,CAAE,QAAO,aAAc,EAAgB,CAAI,EACjD,GAAI,EAAA,IACF,MAAM,EAAU,wCAA2D,EAE7E,GAAI,EAAA,EACF,MAAM,EAAU,wDAAwE,EAG1F,IAAM,EAAS,EAAoB,CAAE,eAAgB,EAAsB,CAAE,CAAC,CAAC,CAAC,UAAU,CAAI,EAC9F,GAAI,CAAC,EAAO,QAAS,MAAM,EAAa,EAAO,KAAK,EAEpD,IAAM,EAAW,MAAM,EAAgB,EAAM,EAAK,CAAQ,EAC1D,GAAI,EAAQ,EACV,MAAM,EAAU,yDAAyD,EAAS,EAAE,EAGtF,MAAO,CAAE,GAAG,EAAM,KAAM,EAAO,IAAK,CACtC,CAUA,SAAgB,EACd,EACsD,CACtD,IAAM,EACJ,GAAS,4BAAgC,EAAiB,CAAC,CAAC,QAAQ,IAAK,GAAM,EAAE,IAAI,GAEvF,MAAO,CACL,KAAM,qBACN,MAAO,CACL,aAAc,MAAO,EAAM,IAAQ,EAAa,EAAM,EAAK,GAAO,CAAqB,EACvF,aAAc,MAAO,EAAK,EAAM,IAAQ,EAAa,EAAM,EAAK,GAAM,CAAqB,CAC7F,CACF,CACF,CCvLA,MAAa,EAAO,EAAa,CAC/B,KAAM,OAGN,KAAM,QACN,MAAO,CACL,MAAO,QACP,KAAM,MACR,EACA,OAAQ,CAMN,OAAQ,EAAM,KAAK,CAAE,KAAM,OAAQ,CAAC,EACpC,MAAO,EAAM,KAAK,CAAE,SAAU,EAAK,CAAC,EAEpC,SAAU,EAAM,OAAO,CACrB,QAAA,EACA,IAAK,EACL,IAAA,EACA,QAAS,EACX,CAAC,EAMD,KAAM,EAAM,KAAK,CAAE,QAAS,GAAM,QAAS,CAAC,CAAE,CAAC,EAU/C,YAAa,EAAM,KAAK,CAAE,QAAS,IAAK,CAAC,CAC3C,EACA,UAAW,CAAC,EAAU,EAAG,EAAY,EAAG,EAAmB,EAAG,EAA0B,CAAC,EACzF,MAAO,SAMP,OAAQ,CACN,KAAM,SACN,OAAQ,cACR,OAAQ,cACR,OAAQ,aACV,CACF,CAAC,ECxDD,SAAgB,EAEd,EACA,EACU,CACV,OAAQ,EAAyC,EACnD"}

package/dist/menu-resolve-context-2s6VJs_m.mjs

@@ -0,0 +1,2 @@
+import{n as e,t}from"./columns-D9y6Mvcp.mjs";import{createSystemReachResolver as n}from"@murumets-ee/core";import{getEntityTitleField as r,isTemplateDrawn as i}from"@murumets-ee/entity";import{QueryClient as a}from"@murumets-ee/entity/query";import{eq as o,inArray as s}from"drizzle-orm";import{getContentConfig as c}from"@murumets-ee/content/plugin";import{createDetailTemplateProvider as l}from"@murumets-ee/content/detail-template";import{buildCanonicalPathsBatchDeps as u,buildEnumerateDeps as d,getCanonicalPaths as f}from"@murumets-ee/content/resolve";const p=n(`menu-resolver`);function m(n){let m=n.db.readOnly,h=u(n),{filterPublished:g}=d(n);return{getMenuRow:async r=>{let i=new a({entity:e,db:m,logger:n.logger.child({resolve:`menu`}),contextResolver:p}),s=(await i.findMany({where:o(t(i.getTable(),`handle`),r),limit:1}))[0];return s===void 0?null:{maxDepth:s.maxDepth,tree:s.tree}},resolveCanonicalPaths:(e,t,n)=>f(e,t,n,h),filterPublished:g,resolveTitles:async(e,o,u)=>{let d=new Map;if(o.length===0)return d;let f=n.entities.get(e);if(f===void 0)return d;let h=i(f)?l(()=>n,{defaultLocale:c().defaultLocale}):void 0,g=r(f);if(h===void 0&&g===`id`)return d;let _=new a({entity:f,db:m,logger:n.logger.child({resolve:`menu-title`,entity:e}),contextResolver:p}),v=t(_.getTable(),`id`);for(let t=0;t<o.length;t+=500){let r=o.slice(t,t+500),i=await _.findMany({where:s(v,[...r]),locale:u,limit:r.length});for(let t of i){let r=t,i=r.id,a;if(h===void 0)a=r[g];else try{a=(await h.publicRow({entity:e,row:r,locale:u})).title}catch(t){n.logger.warn({err:t,entity:e},`menus: detail-template title projection failed — the item is dropped`)}typeof i==`string`&&typeof a==`string`&&a.length>0&&d.set(i,a)}}return d},defaultLocale:c().defaultLocale,logger:n.logger.child({resolve:`menu`})}}export{m as buildMenuResolveDeps};
+//# sourceMappingURL=menu-resolve-context-2s6VJs_m.mjs.map

package/dist/menu-resolve-context-2s6VJs_m.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"menu-resolve-context-2s6VJs_m.mjs","names":[],"sources":["../src/menu-resolve-context.ts"],"sourcesContent":["/**\n * App-binding for {@link import('./get-menu.js').getMenu} (plan/routing PR09).\n *\n * `./get-menu.ts` is a LEAF — it takes every dependency as an injected function\n * so it imports no `@murumets-ee/core` graph. THIS module is the outer seam\n * that holds those imports and builds concrete deps from a live `ToolkitApp`,\n * mirroring `@murumets-ee/content`'s `paths/resolve-context.ts` exactly. Because\n * the real `getCanonicalPaths` / `PublishFilter` are ASSIGNED to the leaf's\n * structurally-declared dep slots here, drift between the two packages is a\n * build error at this file rather than a silent divergence.\n *\n * **Reads run under an ELEVATED system context** (same `SYSTEM_CONTEXT` shape\n * and rationale as content's `resolve-context.ts` — read that file's header).\n * Rendering a menu is a SYSTEM derivation: it must work for an anonymous public\n * request, or for a build-time SSG run with no request context at all, and must\n * not fail just because the caller holds no per-entity `view` grant. Elevation\n * bypasses ONLY the permission/scope assertion — `QueryClient`'s PUBLISH filter\n * and trashed-row exclusion still apply, because the elevated context grants\n * reach WITHOUT `view_unpublished` (D017; see {@link SYSTEM_CONTEXT}), so:\n *  - an unpublished / trashed MENU still resolves to `null` (nothing renders),\n *  - an unpublished / trashed TARGET is still absent from the publish gate and\n *    from the title read, so its item is dropped.\n * The only data elevation exposes is a published document's title + canonical\n * path — the same facts the public sitemap already enumerates.\n */\n\nimport { createDetailTemplateProvider } from '@murumets-ee/content/detail-template'\nimport { getContentConfig } from '@murumets-ee/content/plugin'\nimport {\n  buildCanonicalPathsBatchDeps,\n  buildEnumerateDeps,\n  getCanonicalPaths,\n} from '@murumets-ee/content/resolve'\nimport type { ToolkitApp } from '@murumets-ee/core'\nimport { createSystemReachResolver } from '@murumets-ee/core'\nimport type { SecurityContext } from '@murumets-ee/entity'\nimport { getEntityTitleField, isTemplateDrawn } from '@murumets-ee/entity'\nimport { QueryClient } from '@murumets-ee/entity/query'\nimport { eq, inArray } from 'drizzle-orm'\nimport { Menu } from './entity.js'\nimport type { MenuResolveDeps, MenuRow } from './get-menu.js'\nimport { column } from './internal/columns.js'\n\n/**\n * Elevated **reach** resolver — grants reach, never visibility of unpublished\n * rows. See the file header.\n *\n * That invariant used to rest on `QueryClient` applying the publish filter\n * unconditionally; since D017 it rests on this resolver withholding\n * `view_unpublished`, which {@link createSystemReachResolver} does centrally.\n * A `checker: () => true` here would make `_menu` render items pointing at\n * draft documents.\n */\n// Named, not defaulted: `content`'s path resolver is the other elevated reader\n// and passes `'path-resolver'`. Two of them logging the default `'system'` would\n// be indistinguishable in audit output.\nconst SYSTEM_CONTEXT: () => SecurityContext = createSystemReachResolver('menu-resolver')\n\n/** Ids per batched title lookup — mirrors content's `CANONICAL_BATCH_SIZE`. */\nconst TITLE_BATCH_SIZE = 500\n\n/**\n * Build the concrete {@link MenuResolveDeps} for an app.\n *\n * Cheap to call per request (it constructs no clients eagerly — each read\n * builds its own `QueryClient`, matching `buildEnumerateDeps`'s per-call shape,\n * so this never depends on plugin boot ORDER).\n */\nexport function buildMenuResolveDeps(app: ToolkitApp): MenuResolveDeps {\n  const db = app.db.readOnly\n  const canonicalBatch = buildCanonicalPathsBatchDeps(app)\n  const { filterPublished } = buildEnumerateDeps(app)\n\n  return {\n    getMenuRow: async (handle: string): Promise<MenuRow | null> => {\n      const client = new QueryClient({\n        entity: Menu,\n        db,\n        logger: app.logger.child({ resolve: 'menu' }),\n        contextResolver: SYSTEM_CONTEXT,\n      })\n      // `publishable()` on `Menu` means this client filters to PUBLISHED rows\n      // for any principal without `view_unpublished` — and `SYSTEM_CONTEXT`\n      // withholds it (D017), so the filter always applies HERE. A draft menu\n      // returns nothing, which `getMenu` turns into `null`. Do not swap this\n      // resolver for a blanket `checker: () => true`: that grants the action and\n      // silently publishes drafts.\n      //\n      // No `locale` is passed: the menu entity has no translations and no\n      // locale-status table (locale variance lives INSIDE the tree, per D009),\n      // so a locale would only cost a pointless translation merge.\n      const rows = await client.findMany({\n        where: eq(column(client.getTable(), 'handle'), handle),\n        limit: 1,\n      })\n      const row = rows[0]\n      if (row === undefined) return null\n      return { maxDepth: row.maxDepth, tree: row.tree }\n    },\n\n    resolveCanonicalPaths: (entityType, ids, locale) =>\n      getCanonicalPaths(entityType, ids, locale, canonicalBatch),\n\n    filterPublished,\n\n    resolveTitles: async (entityType, ids, locale) => {\n      const titles = new Map<string, string>()\n      if (ids.length === 0) return titles\n      // An unregistered entity type yields NO title, so its items are dropped\n      // — fail-closed, matching `buildEnumerateDeps`'s own unknown-type branch.\n      const entity = app.entities.get(entityType)\n      if (entity === undefined) return titles\n\n      // A row DRAWN BY A STORED TEMPLATE (block-library D009, F051) is public\n      // only as far as its site's detail bindings say. Its admin title column is\n      // not one of those values (a legal document's is its `type` key), so it is\n      // never read for a label: the item takes the row's DECLARED title — the\n      // same one its own page shows — and drops if the site declares none.\n      const declaredTitles = isTemplateDrawn(entity)\n        ? createDetailTemplateProvider(() => app, {\n            defaultLocale: getContentConfig().defaultLocale,\n          })\n        : undefined\n\n      const titleField = getEntityTitleField(entity)\n      // `getEntityTitleField` degrades to the row's own `id` when the entity has\n      // no display-able field — a raw UUID is not a menu label. Fail closed and\n      // let the item drop, matching this module's own stated posture.\n      if (declaredTitles === undefined && titleField === 'id') return titles\n      const client = new QueryClient({\n        entity,\n        db,\n        logger: app.logger.child({ resolve: 'menu-title', entity: entityType }),\n        contextResolver: SYSTEM_CONTEXT,\n      })\n      const idColumn = column(client.getTable(), 'id')\n\n      for (let i = 0; i < ids.length; i += TITLE_BATCH_SIZE) {\n        const chunk = ids.slice(i, i + TITLE_BATCH_SIZE)\n        // `locale` drives `mergeTranslations`, so a translatable title comes\n        // back in the requested locale (falling back to the base row's value)\n        // — the \"live entity title (locale-merged)\" phase 11 §2 asks for.\n        const rows = await client.findMany({\n          where: inArray(idColumn, [...chunk]),\n          locale,\n          limit: chunk.length,\n        })\n        for (const row of rows) {\n          const record: Record<string, unknown> = row\n          const id = record.id\n          let title: unknown\n          if (declaredTitles === undefined) {\n            title = record[titleField]\n          } else {\n            // Per ITEM, like everything else here: a projection that throws\n            // costs that one label (the item drops), never the whole menu.\n            try {\n              title = (await declaredTitles.publicRow({ entity: entityType, row: record, locale }))\n                .title\n            } catch (err) {\n              app.logger.warn(\n                { err, entity: entityType },\n                'menus: detail-template title projection failed — the item is dropped',\n              )\n            }\n          }\n          if (typeof id === 'string' && typeof title === 'string' && title.length > 0) {\n            titles.set(id, title)\n          }\n        }\n      }\n      return titles\n    },\n\n    defaultLocale: getContentConfig().defaultLocale,\n    logger: app.logger.child({ resolve: 'menu' }),\n  }\n}\n"],"mappings":"8iBAwDA,MAAM,EAAwC,EAA0B,eAAe,EAYvF,SAAgB,EAAqB,EAAkC,CACrE,IAAM,EAAK,EAAI,GAAG,SACZ,EAAiB,EAA6B,CAAG,EACjD,CAAE,mBAAoB,EAAmB,CAAG,EAElD,MAAO,CACL,WAAY,KAAO,IAA4C,CAC7D,IAAM,EAAS,IAAI,EAAY,CAC7B,OAAQ,EACR,KACA,OAAQ,EAAI,OAAO,MAAM,CAAE,QAAS,MAAO,CAAC,EAC5C,gBAAiB,CACnB,CAAC,EAeK,GAAM,MAJO,EAAO,SAAS,CACjC,MAAO,EAAG,EAAO,EAAO,SAAS,EAAG,QAAQ,EAAG,CAAM,EACrD,MAAO,CACT,CAAC,EAAA,CACgB,GAEjB,OADI,IAAQ,IAAA,GAAkB,KACvB,CAAE,SAAU,EAAI,SAAU,KAAM,EAAI,IAAK,CAClD,EAEA,uBAAwB,EAAY,EAAK,IACvC,EAAkB,EAAY,EAAK,EAAQ,CAAc,EAE3D,kBAEA,cAAe,MAAO,EAAY,EAAK,IAAW,CAChD,IAAM,EAAS,IAAI,IACnB,GAAI,EAAI,SAAW,EAAG,OAAO,EAG7B,IAAM,EAAS,EAAI,SAAS,IAAI,CAAU,EAC1C,GAAI,IAAW,IAAA,GAAW,OAAO,EAOjC,IAAM,EAAiB,EAAgB,CAAM,EACzC,MAAmC,EAAK,CACtC,cAAe,EAAiB,CAAC,CAAC,aACpC,CAAC,EACD,IAAA,GAEE,EAAa,EAAoB,CAAM,EAI7C,GAAI,IAAmB,IAAA,IAAa,IAAe,KAAM,OAAO,EAChE,IAAM,EAAS,IAAI,EAAY,CAC7B,SACA,KACA,OAAQ,EAAI,OAAO,MAAM,CAAE,QAAS,aAAc,OAAQ,CAAW,CAAC,EACtE,gBAAiB,CACnB,CAAC,EACK,EAAW,EAAO,EAAO,SAAS,EAAG,IAAI,EAE/C,IAAK,IAAI,EAAI,EAAG,EAAI,EAAI,OAAQ,GAAK,IAAkB,CACrD,IAAM,EAAQ,EAAI,MAAM,EAAG,EAAI,GAAgB,EAIzC,EAAO,MAAM,EAAO,SAAS,CACjC,MAAO,EAAQ,EAAU,CAAC,GAAG,CAAK,CAAC,EACnC,SACA,MAAO,EAAM,MACf,CAAC,EACD,IAAK,IAAM,KAAO,EAAM,CACtB,IAAM,EAAkC,EAClC,EAAK,EAAO,GACd,EACJ,GAAI,IAAmB,IAAA,GACrB,EAAQ,EAAO,QAIf,GAAI,CACF,GAAS,MAAM,EAAe,UAAU,CAAE,OAAQ,EAAY,IAAK,EAAQ,QAAO,CAAC,EAAA,CAChF,KACL,OAAS,EAAK,CACZ,EAAI,OAAO,KACT,CAAE,MAAK,OAAQ,CAAW,EAC1B,sEACF,CACF,CAEE,OAAO,GAAO,UAAY,OAAO,GAAU,UAAY,EAAM,OAAS,GACxE,EAAO,IAAI,EAAI,CAAK,CAExB,CACF,CACA,OAAO,CACT,EAEA,cAAe,EAAiB,CAAC,CAAC,cAClC,OAAQ,EAAI,OAAO,MAAM,CAAE,QAAS,MAAO,CAAC,CAC9C,CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@murumets-ee/menus",
-  "version": "0.99.0",
+  "version": "0.102.0",
   "license": "Elastic-2.0",
   "type": "module",
   "exports": {
@@ -35,10 +35,10 @@
   "dependencies": {
     "drizzle-orm": "^0.45.2",
     "zod": "^3.24.1",
-    "@murumets-ee/blocks": "0.99.0",
-    "@murumets-ee/core": "0.99.0",
-    "@murumets-ee/entity": "0.99.0",
-    "@murumets-ee/content": "0.99.0"
+    "@murumets-ee/blocks": "0.102.0",
+    "@murumets-ee/core": "0.102.0",
+    "@murumets-ee/entity": "0.102.0",
+    "@murumets-ee/content": "0.102.0"
   },
   "devDependencies": {
     "@types/node": "^20.19.42",
@@ -46,8 +46,8 @@
     "tsdown": "^0.22.2",
     "typescript": "^5.7.3",
     "vitest": "^2.1.8",
-    "@murumets-ee/content-api": "0.99.0",
-    "@murumets-ee/db": "0.99.0"
+    "@murumets-ee/content-api": "0.102.0",
+    "@murumets-ee/db": "0.102.0"
   },
   "typeCoverage": {
     "atLeast": 100