@velora-cms/server 0.11.0

package/dist/routes/api-playground.js

@@ -0,0 +1,21 @@
+import { z } from "zod";
+import { ApiErrorSchema } from "@velora-cms/api-schemas";
+import { requireAdmin } from "../auth/require-auth.js";
+import { filterPublicApiSpec } from "../docs/filter-public-api-spec.js";
+// Admin-only source of the public /api/v1 spec for the API playground
+// (Session 109). Deliberately separate from the public docs surface so the
+// admin tool works regardless of the VELORA_PUBLIC_DOCS off-switch. The
+// response is an arbitrary OpenAPI object, so it's documented with a loose
+// passthrough schema rather than a hand-modelled OpenAPI Zod type.
+export const apiPlaygroundRoutes = async (app) => {
+    app.get("/api/api-playground/openapi", {
+        onRequest: requireAdmin,
+        schema: {
+            response: { 200: z.record(z.string(), z.unknown()), 401: ApiErrorSchema, 403: ApiErrorSchema },
+        },
+    }, 
+    // app.swagger() returns @fastify/swagger's Document type, which has no
+    // index signature — same plain-object shape as filterPublicApiSpec's
+    // OpenAPISpec, just a differently-shaped type declaration.
+    async () => filterPublicApiSpec(app.swagger()));
+};

package/dist/routes/auth.d.ts

@@ -0,0 +1,2 @@
+import type { FastifyPluginAsyncZod } from "fastify-type-provider-zod";
+export declare const authRoutes: FastifyPluginAsyncZod;

package/dist/routes/auth.js

@@ -0,0 +1,102 @@
+import { AuthErrorSchema, LoginRequestSchema, LoginResponseSchema, LogoutResponseSchema, RefreshResponseSchema, } from "@velora-cms/api-schemas";
+import { prisma } from "../db/prisma.js";
+import { rateLimitConfig } from "../auth/rate-limit.js";
+import { LOGIN_RATE_LIMIT, ipOnlyKeyGenerator } from "../auth/route-rate-limits.js";
+import { ACCESS_TOKEN_TTL, generateRefreshToken, hashRefreshToken, refreshCookieOptions, refreshTokenExpiryDate, REFRESH_COOKIE_NAME, verifyPassword, } from "../auth/tokens.js";
+export const authRoutes = async (app) => {
+    // S162: this scope had NO ceiling at all — POST /api/auth/login is
+    // unauthenticated and is the system's most obvious brute-force target.
+    // Registered per-scope, matching the precedent in plugin-api-routes.ts
+    // and public-api.ts: @fastify/rate-limit decorates the instance, so it
+    // is registered in child scopes OR at the root, never both.
+    await app.register(import("@fastify/rate-limit"), rateLimitConfig);
+    app.post("/api/auth/login", {
+        schema: {
+            body: LoginRequestSchema,
+            response: {
+                200: LoginResponseSchema,
+                401: AuthErrorSchema,
+            },
+        },
+        config: {
+            rateLimit: {
+                max: LOGIN_RATE_LIMIT.max(),
+                timeWindow: LOGIN_RATE_LIMIT.timeWindow(),
+                // IP-only: see ipOnlyKeyGenerator's comment. Overriding the
+                // shared generator here is the whole point — the default would
+                // put a token-bearing request in the unlimited jwt: lane.
+                keyGenerator: ipOnlyKeyGenerator,
+            },
+        },
+    }, async (request, reply) => {
+        const { email, password } = request.body;
+        const user = await prisma.user.findUnique({ where: { email } });
+        if (!user || !(await verifyPassword(password, user.passwordHash))) {
+            return reply.code(401).send({ message: "Invalid email or password" });
+        }
+        const { accessToken } = await issueSession(app, reply, user);
+        return {
+            accessToken,
+            user: { id: user.id, email: user.email, name: user.name, role: user.role },
+        };
+    });
+    app.post("/api/auth/refresh", {
+        schema: {
+            response: {
+                200: RefreshResponseSchema,
+                401: AuthErrorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        const currentRefreshToken = request.cookies[REFRESH_COOKIE_NAME];
+        if (!currentRefreshToken) {
+            return reply.code(401).send({ message: "No refresh session" });
+        }
+        const tokenHash = hashRefreshToken(currentRefreshToken);
+        const session = await prisma.session.findUnique({ where: { refreshTokenHash: tokenHash } });
+        if (!session || session.revokedAt || session.expiresAt < new Date()) {
+            reply.clearCookie(REFRESH_COOKIE_NAME, { path: "/api/auth" });
+            return reply.code(401).send({ message: "Invalid or expired refresh token" });
+        }
+        const user = await prisma.user.findUniqueOrThrow({ where: { id: session.userId } });
+        // Rotate: revoke the session this token belonged to, then issue a
+        // brand-new one — a leaked refresh token can't be replayed after use.
+        await prisma.session.update({ where: { id: session.id }, data: { revokedAt: new Date() } });
+        const { accessToken } = await issueSession(app, reply, user);
+        return {
+            accessToken,
+            user: { id: user.id, email: user.email, name: user.name, role: user.role },
+        };
+    });
+    app.post("/api/auth/logout", {
+        schema: {
+            response: {
+                200: LogoutResponseSchema,
+            },
+        },
+    }, async (request, reply) => {
+        const currentRefreshToken = request.cookies[REFRESH_COOKIE_NAME];
+        if (currentRefreshToken) {
+            const tokenHash = hashRefreshToken(currentRefreshToken);
+            await prisma.session.updateMany({
+                where: { refreshTokenHash: tokenHash, revokedAt: null },
+                data: { revokedAt: new Date() },
+            });
+        }
+        reply.clearCookie(REFRESH_COOKIE_NAME, { path: "/api/auth" });
+        return { success: true };
+    });
+};
+async function issueSession(app, reply, user) {
+    const accessToken = app.jwt.sign({ sub: user.id, email: user.email, role: user.role }, { expiresIn: ACCESS_TOKEN_TTL });
+    const refreshToken = generateRefreshToken();
+    await prisma.session.create({
+        data: {
+            userId: user.id,
+            refreshTokenHash: hashRefreshToken(refreshToken),
+            expiresAt: refreshTokenExpiryDate(),
+        },
+    });
+    reply.setCookie(REFRESH_COOKIE_NAME, refreshToken, refreshCookieOptions());
+    return { accessToken };
+}

package/dist/routes/content.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyPluginAsyncZod } from "fastify-type-provider-zod";
+import type { ContentDb } from "../db/content-db.js";
+export declare const contentRoutes: FastifyPluginAsyncZod<ContentDb>;

package/dist/routes/content.js

@@ -0,0 +1,471 @@
+import { z } from "zod";
+import { ApiErrorSchema, ContentByPathQuerySchema, ContentByPathResponseSchema, ContentChildrenQuerySchema, ContentChildrenResponseSchema, ContentItemQuerySchema, ContentItemResponseSchema, ContentRestoreBlockedSchema, ContentRestoreResultSchema, ContentTrashBodySchema, ContentTrashConfirmationSchema, ContentTrashListQuerySchema, ContentTrashListResponseSchema, ContentTrashResultSchema, ContentValidationErrorSchema, CreateContentRequestSchema, LatestVersionResponseSchema, VersionListQuerySchema, VersionListResponseSchema, PreviewTokenResponseSchema, PublishContentRequestSchema, PublishContentResponseSchema, ReorderNodesRequestSchema, ReorderNodesResponseSchema, SaveContentRequestSchema, SaveContentResponseSchema, } from "@velora-cms/api-schemas";
+import { ContentValidationError, DocumentTypeNotFoundForContentError, ParentContentNotFoundError, RestoreBlockedError, TreeRulesViolationError, } from "@velora-cms/content-service";
+import { mintPreviewToken } from "../auth/preview-tokens.js";
+import { requireAdmin, requireAuth } from "../auth/require-auth.js";
+import { buildPreviewUrl } from "../config/preview.js";
+const ContentParamsSchema = z.object({ id: z.string().uuid() });
+// ContentService signals a missing content id / version number with a
+// throw (same style throughout publishContent) — routes translate exactly
+// those into 404s and let anything else stay a 500. There is no separate
+// rollback route: POST /:id/publish with an explicit `version` repoints
+// current at that older version, which is the rollback path.
+function isNotFoundError(error) {
+    return (error instanceof Error &&
+        /no (content|version \d+) found/i.test(error.message));
+}
+export const contentRoutes = async (app, opts) => {
+    const { adapter, contentService } = opts;
+    // S156: the admin origin's honest-headless view resolves a pasted URL to a
+    // node. requireAuth (not requireAdmin) — it's a read, like this file's
+    // other GETs; drafts are visible because this is the back office.
+    // No locale/fallback params by decision: a URL names one node, and the
+    // adapter's default-locale-first tiebreak IS the resolution semantic here
+    // (a recorded deviation from api-design.md's locale-params convention).
+    app.get("/api/content/by-path", {
+        onRequest: requireAuth,
+        schema: {
+            querystring: ContentByPathQuerySchema,
+            response: {
+                200: ContentByPathResponseSchema,
+                401: ApiErrorSchema,
+                404: ApiErrorSchema,
+                500: ApiErrorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        const node = await adapter.getContentNodeByPath(request.query.path);
+        if (!node) {
+            return reply.code(404).send({ message: `No content found at path ${request.query.path}` });
+        }
+        return { node };
+    });
+    app.get("/api/content/:id", {
+        onRequest: requireAuth,
+        schema: {
+            params: ContentParamsSchema,
+            querystring: ContentItemQuerySchema,
+            response: {
+                200: ContentItemResponseSchema,
+                401: ApiErrorSchema,
+                404: ApiErrorSchema,
+                500: ApiErrorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        let node = await adapter.getContentNode(request.params.id);
+        if (!node) {
+            return reply.code(404).send({ message: `No content found for id ${request.params.id}` });
+        }
+        // ?locale=fr&fallback=en resolves through the node's translation
+        // group. The fallback decision itself lives in ContentService, not
+        // here (database.md) — without an explicit fallback param, only an
+        // exact translation matches.
+        if (request.query.locale) {
+            try {
+                node = await contentService.getByLocale(node.translationGroupId, request.query.locale, {
+                    fallback: request.query.fallback ?? false,
+                });
+            }
+            catch (error) {
+                if (isNotFoundError(error)) {
+                    return reply.code(404).send({ message: error.message });
+                }
+                throw error;
+            }
+        }
+        const version = await adapter.getContentVersion(node.id, node.currentVersion);
+        if (!version) {
+            // current_version pointing at a missing row is a broken invariant,
+            // not a caller mistake.
+            return reply.code(500).send({
+                message: `current_version (${node.currentVersion}) for ${node.id} has no matching content version`,
+            });
+        }
+        return { node, version };
+    });
+    app.get("/api/content/roots", {
+        onRequest: requireAuth,
+        schema: {
+            querystring: ContentChildrenQuerySchema,
+            response: {
+                200: ContentChildrenResponseSchema,
+                401: ApiErrorSchema,
+            },
+        },
+    }, async (request) => {
+        const { cursor, limit } = request.query;
+        const items = await adapter.getRootNodes({ cursor, limit });
+        const nextCursor = items.length === limit ? (items[items.length - 1]?.id ?? null) : null;
+        return { items, nextCursor };
+    });
+    app.get("/api/content/:id/children", {
+        onRequest: requireAuth,
+        schema: {
+            params: ContentParamsSchema,
+            querystring: ContentChildrenQuerySchema,
+            response: {
+                200: ContentChildrenResponseSchema,
+                401: ApiErrorSchema,
+                404: ApiErrorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        const parent = await adapter.getContentNode(request.params.id);
+        if (!parent) {
+            return reply.code(404).send({ message: `No content found for id ${request.params.id}` });
+        }
+        const { cursor, limit } = request.query;
+        const items = await adapter.getChildren(parent.id, { cursor, limit });
+        // A short page means the walk is done; a full page hands back the last
+        // id as the next cursor (an exactly-full final page just costs one
+        // extra empty-page request).
+        const nextCursor = items.length === limit ? (items[items.length - 1]?.id ?? null) : null;
+        return { items, nextCursor };
+    });
+    app.post("/api/content/roots/reorder", {
+        onRequest: requireAuth,
+        schema: {
+            body: ReorderNodesRequestSchema,
+            response: {
+                200: ReorderNodesResponseSchema,
+                400: ApiErrorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        try {
+            await adapter.reorderSiblings(null, request.body.orderedIds);
+        }
+        catch (error) {
+            return reply.code(400).send({ message: error instanceof Error ? error.message : "Reorder failed" });
+        }
+        return { success: true };
+    });
+    app.post("/api/content/:id/children/reorder", {
+        onRequest: requireAuth,
+        schema: {
+            params: ContentParamsSchema,
+            body: ReorderNodesRequestSchema,
+            response: {
+                200: ReorderNodesResponseSchema,
+                400: ApiErrorSchema,
+                404: ApiErrorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        const parent = await adapter.getContentNode(request.params.id);
+        if (!parent) {
+            return reply.code(404).send({ message: `No content found for id ${request.params.id}` });
+        }
+        try {
+            await adapter.reorderSiblings(parent.id, request.body.orderedIds);
+        }
+        catch (error) {
+            return reply.code(400).send({ message: error instanceof Error ? error.message : "Reorder failed" });
+        }
+        return { success: true };
+    });
+    // The newest saved version, regardless of the current_version pointer —
+    // GET /api/content/:id deliberately serves the pointer version, so this
+    // is the only way to read an unpublished draft (what the content editor
+    // edits). Session-gated like the other legacy content reads as of
+    // Session 110.
+    app.get("/api/content/:id/versions/latest", {
+        onRequest: requireAuth,
+        schema: {
+            params: ContentParamsSchema,
+            response: {
+                200: LatestVersionResponseSchema,
+                401: ApiErrorSchema,
+                404: ApiErrorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        const version = await adapter.getLatestContentVersion(request.params.id);
+        if (!version) {
+            return reply.code(404).send({ message: `No content found for id ${request.params.id}` });
+        }
+        return { version };
+    });
+    // Version history, newest first, metadata only (no data payload).
+    // Version numbers are contiguous 1..latest and rows are never deleted
+    // (immutability), so the page enumerates numbers and resolves each via
+    // the unique (content_id, version) index — no list method on the
+    // adapter needed. If history views ever page through thousands of
+    // versions, a real listContentVersions adapter method replaces this
+    // loop; at a history page size of ≤100 point lookups it's not worth
+    // the interface change yet.
+    app.get("/api/content/:id/versions", {
+        onRequest: requireAuth,
+        schema: {
+            params: ContentParamsSchema,
+            querystring: VersionListQuerySchema,
+            response: {
+                200: VersionListResponseSchema,
+                401: ApiErrorSchema,
+                404: ApiErrorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        const latest = await adapter.getLatestContentVersion(request.params.id);
+        if (!latest) {
+            return reply.code(404).send({ message: `No content found for id ${request.params.id}` });
+        }
+        const { cursor, limit } = request.query;
+        const start = cursor ? Math.min(cursor - 1, latest.version) : latest.version;
+        const numbers = [];
+        for (let n = start; n >= 1 && numbers.length < limit; n--)
+            numbers.push(n);
+        const items = [];
+        for (const n of numbers) {
+            const full = await adapter.getContentVersion(request.params.id, n);
+            if (full) {
+                const { data: _data, ...meta } = full;
+                items.push(meta);
+            }
+        }
+        const last = items[items.length - 1];
+        const nextCursor = last && last.version > 1 ? last.version : null;
+        return { items, nextCursor };
+    });
+    // One specific version, full data — the history view's "see what it
+    // looked like before" read.
+    app.get("/api/content/:id/versions/:version", {
+        onRequest: requireAuth,
+        schema: {
+            params: ContentParamsSchema.extend({
+                version: z.coerce.number().int().positive(),
+            }),
+            response: {
+                200: LatestVersionResponseSchema,
+                401: ApiErrorSchema,
+                404: ApiErrorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        const version = await adapter.getContentVersion(request.params.id, request.params.version);
+        if (!version) {
+            return reply.code(404).send({
+                message: `No version ${request.params.version} found for content ${request.params.id}`,
+            });
+        }
+        return { version };
+    });
+    app.post("/api/content", {
+        onRequest: requireAuth,
+        schema: {
+            body: CreateContentRequestSchema,
+            response: {
+                201: ContentItemResponseSchema,
+                // Union so both bodies serialize on the one 400 slot: the
+                // structured field-validation body, and the plain-message body
+                // Fastify's own Zod body validation produces (a bare
+                // ContentValidationErrorSchema turned those into a 500).
+                400: z.union([ContentValidationErrorSchema, ApiErrorSchema]),
+                401: ApiErrorSchema,
+                404: ApiErrorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        try {
+            const result = await contentService.createContent({
+                ...request.body,
+                createdBy: request.user.sub,
+            });
+            return reply.code(201).send(result);
+        }
+        catch (error) {
+            if (error instanceof ContentValidationError) {
+                return reply.code(400).send({ message: error.message, fieldErrors: error.failures });
+            }
+            if (error instanceof ParentContentNotFoundError) {
+                return reply.code(404).send({ message: error.message });
+            }
+            if (error instanceof DocumentTypeNotFoundForContentError || error instanceof TreeRulesViolationError) {
+                return reply.code(400).send({ message: error.message });
+            }
+            throw error;
+        }
+    });
+    app.put("/api/content/:id", {
+        onRequest: requireAuth,
+        schema: {
+            params: ContentParamsSchema,
+            body: SaveContentRequestSchema,
+            response: {
+                200: SaveContentResponseSchema,
+                400: z.union([ContentValidationErrorSchema, ApiErrorSchema]),
+                401: ApiErrorSchema,
+                404: ApiErrorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        try {
+            const version = await contentService.saveContent(request.params.id, request.body.data, request.user.sub);
+            return { version };
+        }
+        catch (error) {
+            if (error instanceof ContentValidationError) {
+                return reply.code(400).send({ message: error.message, fieldErrors: error.failures });
+            }
+            if (isNotFoundError(error)) {
+                return reply.code(404).send({ message: error.message });
+            }
+            throw error;
+        }
+    });
+    app.post("/api/content/:id/publish", {
+        onRequest: requireAuth,
+        schema: {
+            params: ContentParamsSchema,
+            // Optional body: absent (or {}) publishes the latest saved version.
+            // Fastify hands a bodyless POST to validation as null, not
+            // undefined — hence nullish, not optional.
+            body: PublishContentRequestSchema.nullish(),
+            response: {
+                200: PublishContentResponseSchema,
+                401: ApiErrorSchema,
+                404: ApiErrorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        try {
+            const node = await contentService.publishContent(request.params.id, request.body?.version);
+            return { node };
+        }
+        catch (error) {
+            if (isNotFoundError(error)) {
+                return reply.code(404).send({ message: error.message });
+            }
+            throw error;
+        }
+    });
+    // S161: the trash browse surface. Admin-gated like DELETE below (and
+    // unlike this file's requireAuth routes) — trash operations are
+    // destructive-adjacent even though reversible. This resolves correctly
+    // against GET /api/content/:id (registered earlier in this file, not
+    // later) regardless of registration order: find-my-way ranks a static
+    // path segment ("trash") above a parametric one ("/:id") when matching,
+    // and ContentParamsSchema requires :id to be a uuid, which the literal
+    // string "trash" never is. Registration order is not the mechanism here.
+    app.get("/api/content/trash", {
+        onRequest: requireAdmin,
+        schema: {
+            querystring: ContentTrashListQuerySchema,
+            response: {
+                200: ContentTrashListResponseSchema,
+                401: ApiErrorSchema,
+                403: ApiErrorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        const { cursor, limit } = request.query;
+        const items = await adapter.listTrashedSubtrees({ cursor, limit });
+        // A full page means there may be more; a short page is the end. Same
+        // convention as this file's other cursor-paginated reads.
+        const last = items.at(-1);
+        const nextCursor = items.length === limit && last ? `${last.deletedAt}|${last.id}` : null;
+        return reply.code(200).send({ items, nextCursor });
+    });
+    // S154: content's first delete surface. Two-step like the structured-data
+    // uninstall gate — unconfirmed 409 names the blast radius (the whole
+    // subtree, not just this node), confirmed trashes it. Soft delete only:
+    // reversible via the restore route below. Admin-gated (not just
+    // requireAuth, unlike this file's other routes) since it's destructive
+    // even though reversible.
+    app.delete("/api/content/:id", {
+        onRequest: requireAdmin,
+        schema: {
+            params: ContentParamsSchema,
+            body: ContentTrashBodySchema,
+            response: {
+                200: ContentTrashResultSchema,
+                401: ApiErrorSchema,
+                403: ApiErrorSchema,
+                404: ApiErrorSchema,
+                409: ContentTrashConfirmationSchema,
+            },
+        },
+    }, async (request, reply) => {
+        const node = await adapter.getContentNode(request.params.id);
+        if (!node) {
+            return reply.code(404).send({ message: `No content found for id ${request.params.id}` });
+        }
+        if (request.body?.confirm !== true) {
+            const subtreeCount = await adapter.countContentSubtree(request.params.id);
+            // Clamped defensively: countContentSubtree only counts LIVE rows,
+            // so if the target itself somehow isn't live when this executes
+            // (e.g. trashed out from under this request between the
+            // getContentNode check above and here), subtreeCount could be 0 —
+            // and 0 - 1 would render as "-1 descendant(s)" in the 409 body.
+            const descendantCount = Math.max(0, subtreeCount - 1);
+            return reply.code(409).send({
+                requiresConfirmation: true,
+                // ContentNode has no display-name field of its own — path is
+                // the closest thing to one.
+                nodeName: node.path,
+                descendantCount,
+                message: `deleting "${node.path}" moves it and ${descendantCount} descendant(s) to the trash — retry with confirm: true`,
+            });
+        }
+        const result = await contentService.trashContent(request.params.id);
+        return reply.code(200).send(result);
+    });
+    app.post("/api/content/:id/restore", {
+        onRequest: requireAdmin,
+        schema: {
+            params: ContentParamsSchema,
+            response: {
+                200: ContentRestoreResultSchema,
+                401: ApiErrorSchema,
+                403: ApiErrorSchema,
+                404: ApiErrorSchema,
+                409: ContentRestoreBlockedSchema,
+            },
+        },
+    }, async (request, reply) => {
+        try {
+            const result = await contentService.restoreContent(request.params.id);
+            return reply.code(200).send(result);
+        }
+        catch (error) {
+            if (error instanceof RestoreBlockedError) {
+                return reply.code(409).send({
+                    message: error.message,
+                    blockingAncestorPath: error.blockingAncestorPath,
+                });
+            }
+            if (isNotFoundError(error)) {
+                return reply.code(404).send({ message: error.message });
+            }
+            throw error;
+        }
+    });
+    // Session 116: mints a stateless, short-TTL, single-content-id preview
+    // token (apps/server/src/auth/preview-tokens.ts) that unlocks a draft
+    // read on the public content API for exactly this id. Any existing
+    // content id may be minted for, published or not — a session holder is
+    // a trusted editor previewing their own work, not an anonymous reader.
+    app.post("/api/content/:id/preview-token", {
+        onRequest: requireAuth,
+        schema: {
+            params: ContentParamsSchema,
+            response: {
+                200: PreviewTokenResponseSchema,
+                401: ApiErrorSchema,
+                404: ApiErrorSchema,
+            },
+        },
+    }, async (request, reply) => {
+        const node = await adapter.getContentNode(request.params.id);
+        if (!node) {
+            return reply.code(404).send({ message: `No content found for id ${request.params.id}` });
+        }
+        const { token, expiresAt } = mintPreviewToken(node.id);
+        return {
+            token,
+            expiresAt,
+            previewUrl: buildPreviewUrl(token, node.id),
+        };
+    });
+};

package/dist/routes/data-types.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyPluginAsyncZod } from "fastify-type-provider-zod";
+import type { ContentDb } from "../db/content-db.js";
+export declare const dataTypeRoutes: FastifyPluginAsyncZod<ContentDb>;