@usegraft/content-api 0.0.0-canary-20260901211203 → 0.2.0

package/dist/index.d.ts

@@ -1,12 +1,6 @@
-import { ContentIndexReader } from '@usegraft/contracts';
+import { ContentIndexReader } from '@usegraft/db';
 
 type ContentApiHandler = (request: Request) => Promise<Response>;
-interface ContentApiRateLimit {
-    /** Requests allowed per identity per window. */
-    limit: number;
-    /** Window length in seconds. Also the `Retry-After` value on a refusal. */
-    windowSeconds: number;
-}
 interface ContentApiHandlerOptions {
     /** Collection names this endpoint may expose. */
     collections: readonly string[];
@@ -14,50 +8,18 @@ interface ContentApiHandlerOptions {
     branch: string;
     /** Reader owned by the caller. The handler never closes it. */
     index: ContentIndexReader;
-    /**
-     * Per-identity backstop. Omitted means unlimited, which is the right default
-     * for a handler mounted behind something that already has a limiter — but a
-     * mount facing the open internet wants one, because these routes run database
-     * listings and full-text searches for callers this handler never
-     * authenticates.
-     */
-    rateLimit?: ContentApiRateLimit;
-    /**
-     * How many proxies in front of this handler are ours. Forwarded to
-     * `rateIdentity`; zero (the default) means `x-forwarded-for` is never read
-     * and every unidentified caller shares one bucket.
-     */
-    trustedProxyHops?: number;
-    /**
-     * Origins allowed to read responses from a browser.
-     *
-     * Omitted means no CORS headers at all, which is same-origin only — the
-     * correct default, because publishing an endpoint to other origins is a
-     * decision for whoever deploys it and not one a library should make on their
-     * behalf. `@usegraft/sdk-react` needs this set whenever the app and the
-     * content API are on different origins, which is the ordinary case.
-     *
-     * An explicit list is echoed back per request (with `Vary: Origin`, so a
-     * cache cannot serve one origin's response to another). `"*"` allows any
-     * origin and is reasonable for content that is public anyway — which this
-     * handler's content is, since it authenticates nobody.
-     */
-    allowedOrigins?: readonly string[] | "*";
 }
 interface ContentApiReaderOptions {
-    /**
-     * API base URL: absolute (https://cms.example.com/api/content/v1), or a
-     * same-origin path (/api/content/v1) when running in a browser, where it
-     * resolves against the page origin.
-     */
+    /** Full API base URL, for example https://cms.example.com/api/content/v1. */
     endpoint: string | URL;
     /** Fetch implementation for non-browser runtimes, tests, or instrumentation. */
     fetch?: typeof globalThis.fetch;
     /** Static headers sent with every request, such as Authorization. */
     headers?: Record<string, string>;
 }
+/** Create the read-only Web-standard handler mounted at /api/content/v1. */
 declare function createContentApiHandler(options: ContentApiHandlerOptions): ContentApiHandler;
 /** Create a ContentIndexReader that reads a remote /api/content/v1 endpoint. */
 declare function createContentApiReader(options: ContentApiReaderOptions): ContentIndexReader;
 
-export { type ContentApiHandlerOptions, type ContentApiRateLimit, type ContentApiReaderOptions, createContentApiHandler, createContentApiReader };
+export { type ContentApiHandlerOptions, type ContentApiReaderOptions, createContentApiHandler, createContentApiReader };

package/dist/index.js

@@ -1,9 +1,5 @@
 // src/index.ts
-import {
-  ErrorCodes,
-  GraftError,
-  rateIdentity
-} from "@usegraft/contracts";
+import { ErrorCodes, GraftError } from "@usegraft/contracts";
 var CONTENT_API_BASE = "/api/content/v1";
 var MAX_QUERY_LIMIT = 500;
 var JSON_CONTENT_TYPE = "application/json; charset=utf-8";
@@ -143,14 +139,6 @@ function json(value, status = 200, extra) {
   headers.set("content-type", JSON_CONTENT_TYPE);
   return new Response(JSON.stringify(value), { status, headers });
 }
-function responseHeadersFor(error) {
-  if (error.code === "METHOD_NOT_ALLOWED") return { allow: "GET" };
-  if (error.code === "RATE_LIMITED") {
-    const retryAfter = error.details?.retryAfter;
-    if (typeof retryAfter === "number") return { "retry-after": String(retryAfter) };
-  }
-  return void 0;
-}
 function statusFor(error) {
   switch (error.code) {
     case "COLLECTION_NOT_FOUND":
@@ -160,8 +148,6 @@ function statusFor(error) {
       return 405;
     case "INPUT_VALIDATION_FAILED":
       return 400;
-    case "RATE_LIMITED":
-      return 429;
     default:
       return 500;
   }
@@ -213,54 +199,10 @@ function assertNoBranchOverride(url) {
     );
   }
 }
-function createRateLimiter(limit, windowSeconds) {
-  const windowMs = windowSeconds * 1e3;
-  const buckets = /* @__PURE__ */ new Map();
-  const SWEEP_THRESHOLD = 4096;
-  return (identity, now) => {
-    if (buckets.size >= SWEEP_THRESHOLD) {
-      for (const [key, bucket2] of buckets) {
-        if (bucket2.resetAt <= now) buckets.delete(key);
-      }
-    }
-    const bucket = buckets.get(identity);
-    if (bucket === void 0 || bucket.resetAt <= now) {
-      buckets.set(identity, { count: 1, resetAt: now + windowMs });
-      return void 0;
-    }
-    bucket.count += 1;
-    if (bucket.count <= limit) return void 0;
-    return Math.max(1, Math.ceil((bucket.resetAt - now) / 1e3));
-  };
-}
-function corsHeaders(request, allowed) {
-  if (allowed === void 0) return void 0;
-  const origin = request.headers.get("origin");
-  if (origin === null) return void 0;
-  if (allowed === "*") {
-    return { "access-control-allow-origin": "*" };
-  }
-  if (!allowed.includes(origin)) return void 0;
-  return { "access-control-allow-origin": origin, vary: "Origin" };
-}
 function createContentApiHandler(options) {
   const collections = new Set(options.collections);
-  const consume = options.rateLimit === void 0 ? void 0 : createRateLimiter(options.rateLimit.limit, options.rateLimit.windowSeconds);
-  const trustedProxyHops = options.trustedProxyHops ?? 0;
   return async (request) => {
     const url = new URL(request.url);
-    const cors = corsHeaders(request, options.allowedOrigins);
-    if (request.method === "OPTIONS" && cors !== void 0) {
-      return new Response(null, {
-        status: 204,
-        headers: {
-          ...cors,
-          "access-control-allow-methods": "GET, OPTIONS",
-          "access-control-allow-headers": request.headers.get("access-control-request-headers") ?? "authorization,content-type",
-          "access-control-max-age": "86400"
-        }
-      });
-    }
     try {
       const route = url.pathname === `${CONTENT_API_BASE}/documents` ? "documents" : url.pathname === `${CONTENT_API_BASE}/search` ? "search" : void 0;
       if (route === void 0) {
@@ -279,21 +221,6 @@ function createContentApiHandler(options) {
           details: { method: request.method }
         });
       }
-      if (consume !== void 0 && options.rateLimit !== void 0) {
-        const retryAfter = consume(rateIdentity(request, trustedProxyHops), Date.now());
-        if (retryAfter !== void 0) {
-          throw new GraftError({
-            code: "RATE_LIMITED",
-            message: `This content endpoint allows ${options.rateLimit.limit} requests per ${options.rateLimit.windowSeconds}s per caller.`,
-            fix: `Wait ${retryAfter}s \u2014 the Retry-After header says how long \u2014 then retry. Cache reads at your CDN if you need a higher sustained rate.`,
-            details: {
-              limit: options.rateLimit.limit,
-              windowSeconds: options.rateLimit.windowSeconds,
-              retryAfter
-            }
-          });
-        }
-      }
       assertNoBranchOverride(url);
       const collection = requiredParam(url, "collection");
       if (!collections.has(collection)) {
@@ -322,7 +249,7 @@ function createContentApiHandler(options) {
           offset: parseOffset(url),
           branch: options.branch
         });
-        return json({ rows: rows.map(toWireRow) }, 200, cors);
+        return json({ rows: rows.map(toWireRow) });
       }
       const query = requiredParam(url, "query");
       const hits = await options.index.searchContent({
@@ -331,52 +258,31 @@ function createContentApiHandler(options) {
         limit,
         branch: options.branch
       });
-      return json(
-        {
-          hits: hits.map(
-            ({ row, rank, snippet }) => ({
-              row: toWireRow(row),
-              rank,
-              snippet
-            })
-          )
-        },
-        200,
-        cors
-      );
+      return json({
+        hits: hits.map(
+          ({ row, rank, snippet }) => ({
+            row: toWireRow(row),
+            rank,
+            snippet
+          })
+        )
+      });
     } catch (error) {
       const graftError = error instanceof GraftError ? error : protocolError(
         `Content API failed to read its index: ${error instanceof Error ? error.message : String(error)}`
       );
-      const extra = { ...responseHeadersFor(graftError), ...cors };
-      return json(
-        graftError.toJSON(),
-        statusFor(graftError),
-        Object.keys(extra).length > 0 ? extra : void 0
-      );
+      const extra = graftError.code === "METHOD_NOT_ALLOWED" ? { allow: "GET" } : void 0;
+      return json(graftError.toJSON(), statusFor(graftError), extra);
     }
   };
 }
 function normalizeEndpoint(endpoint) {
-  const url = endpoint instanceof URL ? new URL(endpoint) : resolveEndpointUrl(endpoint);
+  const url = new URL(endpoint.toString());
   url.pathname = url.pathname.replace(/\/+$/, "");
   url.search = "";
   url.hash = "";
   return url;
 }
-function resolveEndpointUrl(endpoint) {
-  const base = globalThis.location?.href;
-  try {
-    return base === void 0 ? new URL(endpoint) : new URL(endpoint, base);
-  } catch {
-    throw new GraftError({
-      code: "CONFIG_INVALID",
-      message: `\`endpoint\` is not a valid URL: ${endpoint}`,
-      fix: base === void 0 ? "Outside a browser there is no page origin to resolve a relative path against. Pass an absolute endpoint, e.g. https://cms.example.com/api/content/v1." : "Pass an absolute endpoint (https://cms.example.com/api/content/v1) or a same-origin path (/api/content/v1).",
-      details: { endpoint, base }
-    });
-  }
-}
 function createContentApiReader(options) {
   const endpoint = normalizeEndpoint(options.endpoint);
   const fetchImpl = options.fetch ?? globalThis.fetch;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usegraft/content-api",
-  "version": "0.0.0-canary-20260901211203",
+  "version": "0.2.0",
   "description": "A versioned read-only HTTP transport for Graft's authored content index.",
   "keywords": [
     "agent",
@@ -37,10 +37,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@usegraft/contracts": "0.0.0-canary-20260901211203"
-  },
-  "devDependencies": {
-    "@usegraft/db": "0.0.0-canary-20260901211203"
+    "@usegraft/contracts": "0.2.0",
+    "@usegraft/db": "0.2.0"
   },
   "engines": {
     "node": ">=22.16"