qarpeo 0.0.0-alpha.10

package/dist/runtime/server/utils/cms.mjs

@@ -0,0 +1,3268 @@
+import { parseMarkdown as comarkParseMarkdown } from "comark";
+import { render as comarkRender } from "comark/render";
+import { createError, useRuntimeConfig, getCookie } from "nuxt/server";
+import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+import { getD1Binding } from "../../db.mjs";
+import { getKVBinding } from "../../kv.mjs";
+import { fireCMSWebhooks, fireCMSDeployTrigger } from "./cms-events.mjs";
+import { getQarpeoConfig } from "./config.mjs";
+import { getAuthContext } from "./context.mjs";
+function getCMSDb(event) {
+  return getD1Binding("DB", event);
+}
+function nanoid(size = 21) {
+  const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+  const bytes = crypto.getRandomValues(new Uint8Array(size));
+  return Array.from(bytes, (b) => chars[b % chars.length]).join("");
+}
+export function slugifyHeading(text) {
+  return text.toLowerCase().replace(/[^\w\s-]/g, "").replace(/[\s_]+/g, "-").replace(/^-+|-+$/g, "");
+}
+export function stripOrderPrefix(segment) {
+  return segment.replace(/^\d+\./, "");
+}
+export function isGroupSegment(segment) {
+  const stripped = stripOrderPrefix(segment);
+  return /^\([^)]+\)$/.test(stripped);
+}
+export function extractGroupTitle(segment) {
+  const stripped = stripOrderPrefix(segment);
+  const inner = stripped.replace(/^\(|\)$/g, "");
+  return inner.split("-").map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
+}
+export function extractOrderPrefix(segment) {
+  const m = segment.match(/^(\d+)\./);
+  return m ? parseInt(m[1], 10) : void 0;
+}
+export function computeEntryPath(filePathRelative, collectionId) {
+  const normalized = filePathRelative.replace(/\\/g, "/").replace(/\.md$/, "");
+  const segments = normalized.split("/").filter(Boolean);
+  const cleaned = segments.filter((seg) => !isGroupSegment(seg)).map(stripOrderPrefix).filter(Boolean);
+  if (cleaned[cleaned.length - 1] === "index") {
+    cleaned.pop();
+  }
+  if (collectionId && collectionId !== "content" && cleaned[0] !== collectionId) {
+    cleaned.unshift(collectionId);
+  }
+  if (cleaned.length === 0) return "/";
+  return "/" + cleaned.join("/");
+}
+export function matchPathPatterns(entryPath, patterns) {
+  if (!patterns) return false;
+  const list = Array.isArray(patterns) ? patterns : [patterns];
+  if (!list.length) return false;
+  const path = ("/" + entryPath.replace(/\\/g, "/").replace(/^\/+/, "")).replace(/\/+$/, "") || "/";
+  let matched = false;
+  for (const raw of list) {
+    const isNeg = raw.startsWith("!");
+    const rawPattern = isNeg ? raw.slice(1) : raw;
+    const pattern = ("/" + rawPattern.replace(/\\/g, "/").replace(/^\/+/, "")).replace(/\/+$/, "") || "/";
+    let isMatch = false;
+    if (pattern.endsWith("/**")) {
+      const base = pattern.slice(0, -3) || "/";
+      isMatch = path === base || path.startsWith(base + "/");
+    } else if (pattern.includes("*") || pattern.includes("?")) {
+      const regexStr = "^" + pattern.replace(/[.+^${}()|[\]\\]/g, (m) => "\\" + m).replace(/\*\*/g, ".*").replace(/(?<!\.)\*/g, "[^/]*").replace(/\?/g, "[^/]") + "$";
+      isMatch = new RegExp(regexStr).test(path);
+    } else {
+      isMatch = path === pattern;
+    }
+    if (isMatch) {
+      if (isNeg) return false;
+      matched = true;
+    }
+  }
+  return matched;
+}
+export function resolveCollectionForPath(entryPath, collectionsConfig, fallbackId = "content") {
+  if (collectionsConfig) {
+    for (const [colId, colConfig] of Object.entries(collectionsConfig)) {
+      if (colConfig.path && matchPathPatterns(entryPath, colConfig.path)) {
+        return colId;
+      }
+    }
+  }
+  return fallbackId;
+}
+export function extractTOC(md) {
+  const lines = md.split("\n");
+  const flat = [];
+  for (const line of lines) {
+    const m = line.match(/^(#{2,6})\s+(.+)/);
+    if (!m) continue;
+    const depth = m[1].length;
+    const rawText = m[2].trim().replace(/\[([^\]]+)\]\([^)]+\)/g, "$1").replace(/[`*_~]/g, "");
+    flat.push({ id: slugifyHeading(rawText), text: rawText, depth });
+  }
+  const result = [];
+  let current2 = null;
+  for (const item of flat) {
+    if (item.depth === 2) {
+      current2 = { ...item, children: [] };
+      result.push(current2);
+    } else if (current2 && item.depth >= 3) {
+      current2.children = current2.children || [];
+      current2.children.push(item);
+    } else {
+      result.push(item);
+    }
+  }
+  return result;
+}
+function parseInlineProps(propsStr) {
+  const inner = propsStr.replace(/^\{|\}$/g, "");
+  const result = {};
+  const re = /(\w+)="([^"]*)"/g;
+  let m;
+  while ((m = re.exec(inner)) !== null) {
+    result[m[1]] = m[2];
+  }
+  return result;
+}
+function escapeAttr(val) {
+  return val.replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+export function preprocessMDC(md) {
+  let out = md;
+  out = out.replace(
+    /:::(\w[\w-]*)(\{[^}]*\})?\s*\n([\s\S]*?):::/g,
+    (_match, type, propsStr, body) => {
+      const attrs = parseInlineProps(propsStr || "");
+      const cls = `mdc-${type}`;
+      const attrStr = Object.entries(attrs).map(([k, v]) => ` data-${k}="${escapeAttr(v)}"`).join("");
+      return `<div class="${cls}"${attrStr}>
+${body.trim()}
+</div>`;
+    }
+  );
+  out = out.replace(/::(\w[\w-]*)\s*\n([\s\S]*?)::/g, (_match, type, body) => {
+    return `<div class="mdc-${type}">
+${body.trim()}
+</div>`;
+  });
+  return out;
+}
+export function getCMSConfig(event) {
+  const rc = useRuntimeConfig(event);
+  const cfg = rc?.qarpeo?.cms || {};
+  return {
+    admin: cfg.admin !== false,
+    path: cfg.path || "/cms",
+    apiPath: cfg.apiPath || "/api/cms",
+    contentDir: cfg.contentDir || "content",
+    hybrid: cfg.hybrid !== false,
+    roles: cfg.roles || ["admin", "editor"],
+    revisions: cfg.revisions || { max: 10 },
+    cache: cfg.cache !== false,
+    collections: cfg.collections || {},
+    components: cfg.components || {},
+    sources: cfg.sources || [],
+    exclude: cfg.exclude || void 0,
+    github: cfg.github || void 0,
+    deploy: cfg.deploy || void 0,
+    webhooks: cfg.webhooks || [],
+    webhookSecret: cfg.webhookSecret || void 0,
+    approval: cfg.approval || void 0,
+    scheduledPublish: cfg.scheduledPublish ?? false,
+    shiki: cfg.shiki !== void 0 ? cfg.shiki : true,
+    plugins: cfg.plugins || {},
+    locales: cfg.locales || ["en"],
+    defaultLocale: cfg.defaultLocale || "en"
+  };
+}
+export function resolveCollectionApproval(collectionConfig, globalApproval) {
+  const raw = collectionConfig?.approval ?? globalApproval;
+  if (!raw) return null;
+  if (typeof raw === "object") {
+    return {
+      roles: raw.roles && raw.roles.length > 0 ? raw.roles : ["admin"],
+      allowSelfApproval: raw.allowSelfApproval ?? false
+    };
+  }
+  return {
+    roles: ["admin"],
+    allowSelfApproval: false
+  };
+}
+const _cachedPluginsMap = /* @__PURE__ */ new Map();
+async function _resolveMarkdownPlugins(event) {
+  const rc = useRuntimeConfig(event);
+  const pluginCfg = getQarpeoConfig(event).cms?.plugins || rc?.public?.qarpeo?.cms?.plugins || {};
+  const cacheKey = JSON.stringify(pluginCfg);
+  if (_cachedPluginsMap.has(cacheKey)) return _cachedPluginsMap.get(cacheKey);
+  const plugins = [];
+  if (pluginCfg.shiki !== false) {
+    try {
+      const shikiMod = await import("comark/plugins/shiki");
+      const shikiPlugin = shikiMod.default;
+      const shikiOptions = typeof pluginCfg.shiki === "object" ? pluginCfg.shiki : {};
+      plugins.push(shikiPlugin(shikiOptions));
+    } catch {
+    }
+  }
+  _cachedPluginsMap.set(cacheKey, plugins);
+  return plugins;
+}
+export async function parseMarkdownAST(md, event) {
+  if (!md) return { nodes: [], frontmatter: {}, meta: {} };
+  try {
+    const plugins = await _resolveMarkdownPlugins(event);
+    return await comarkParseMarkdown(md, { plugins });
+  } catch (err) {
+    console.error("[qarpeo:cms] parseMarkdownAST failed:", err);
+    return { nodes: [], frontmatter: {}, meta: {} };
+  }
+}
+export async function processMarkdown(md, event) {
+  if (!md) return { ast: { nodes: [], frontmatter: {}, meta: {} }, html: "" };
+  try {
+    const plugins = await _resolveMarkdownPlugins(event);
+    const ast = await comarkParseMarkdown(md, { plugins });
+    const html = (await comarkRender(ast, { format: "text/html" })).trim();
+    return { ast, html };
+  } catch {
+    return { ast: { nodes: [], frontmatter: {}, meta: {} }, html: md };
+  }
+}
+export async function renderMarkdown(md, event) {
+  if (!md) return "";
+  try {
+    const res = await processMarkdown(md, event);
+    return res.html;
+  } catch {
+    return md;
+  }
+}
+export async function renderPageMarkdown(md) {
+  return renderMarkdown(md);
+}
+export function parseFrontmatter(raw) {
+  const clean = raw ? raw.replace(/^\uFEFF/, "") : "";
+  const fmMatch = clean.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)/);
+  if (!fmMatch) {
+    return { data: {}, content: clean };
+  }
+  const yamlBlock = fmMatch[1] || "";
+  const body = fmMatch[2] || "";
+  let data = {};
+  try {
+    const parsed = parseYaml(yamlBlock);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      data = parsed;
+    }
+  } catch (err) {
+    console.warn("[qarpeo:cms] Warning: failed to parse YAML frontmatter:", err);
+  }
+  return { data, content: body };
+}
+export function formatFrontmatter(data, body) {
+  const cleanData = {};
+  for (const [k, v] of Object.entries(data)) {
+    if (v === void 0 || v === null || k.startsWith("_")) continue;
+    cleanData[k] = v;
+  }
+  const yamlStr = Object.keys(cleanData).length > 0 ? stringifyYaml(cleanData).trim() : "";
+  if (!yamlStr) {
+    return body;
+  }
+  return `---
+${yamlStr}
+---
+
+${body}`;
+}
+export function formatEntryAsMarkdown(entry) {
+  const e = entry;
+  let metadata = {};
+  try {
+    if (e.metadata && typeof e.metadata === "object") {
+      metadata = e.metadata;
+    } else if (e.metadataJson || e.metadata_json) {
+      metadata = JSON.parse(e.metadataJson || e.metadata_json);
+    }
+  } catch {
+  }
+  const cleanMetadata = {};
+  for (const [k, v] of Object.entries(metadata)) {
+    if (!k.startsWith("_")) {
+      cleanMetadata[k] = v;
+    }
+  }
+  const serializedMetadata = serializeReferencesForFrontmatter(cleanMetadata);
+  const rawTags = e.tags;
+  const tags = Array.isArray(rawTags) ? rawTags : typeof rawTags === "string" && rawTags.length > 0 ? rawTags.split(",").map((t) => t.trim()) : void 0;
+  const fmData = {
+    title: e.title,
+    slug: e.slug,
+    ...e.description ? { description: e.description } : {},
+    ...e.coverImage || e.cover_image ? { coverImage: e.coverImage || e.cover_image } : {},
+    ...tags && tags.length > 0 ? { tags } : {},
+    ...typeof e.order === "number" && e.order !== 0 ? { order: e.order } : {},
+    ...e.status && e.status !== "published" ? { status: e.status } : {},
+    ...serializedMetadata
+  };
+  const body = e.contentMd ?? e.content_md ?? "";
+  return formatFrontmatter(fmData, body);
+}
+function toBase64(str) {
+  if (typeof Buffer !== "undefined") {
+    return Buffer.from(str, "utf8").toString("base64");
+  }
+  const bytes = new TextEncoder().encode(str);
+  let binary = "";
+  for (let i = 0; i < bytes.byteLength; i++) {
+    binary += String.fromCharCode(bytes[i]);
+  }
+  return btoa(binary);
+}
+export async function syncEntryToGit(event, collectionId, entry, action) {
+  const config = getCMSConfig(event);
+  const colConfig = config.collections[collectionId] || {};
+  const mode = colConfig.mode || config.mode || "db";
+  if (mode !== "git-sync") {
+    return null;
+  }
+  const result = {};
+  const e = entry;
+  let rawFilePath = e.filePath || e.file_path;
+  if (!rawFilePath) {
+    const targetDir = colConfig.directory || `${config.contentDir}/${collectionId}`;
+    rawFilePath = `${targetDir}/${e.slug}.md`;
+  }
+  let resolvedFsPath = rawFilePath;
+  let fileContent = "";
+  try {
+    const fs = await import("node:fs/promises");
+    const pathMod = await import("node:path");
+    resolvedFsPath = pathMod.isAbsolute(rawFilePath) ? rawFilePath : pathMod.resolve(process.cwd(), rawFilePath);
+    if (action === "delete") {
+      const exists = await fs.stat(resolvedFsPath).catch(() => null);
+      if (exists) {
+        await fs.unlink(resolvedFsPath);
+        result.localFs = true;
+      }
+    } else {
+      fileContent = formatEntryAsMarkdown(entry);
+      await fs.mkdir(pathMod.dirname(resolvedFsPath), { recursive: true });
+      await fs.writeFile(resolvedFsPath, fileContent, "utf8");
+      result.localFs = true;
+      const contentHash = await computeContentHash(fileContent);
+      result.filePath = resolvedFsPath;
+      result.contentHash = contentHash;
+      if (e.id) {
+        const db = getCMSDb(event);
+        await db.prepare(
+          "UPDATE _qarpeo_cms_entries SET file_path = ?, content_hash = ?, source = 'file' WHERE id = ?"
+        ).bind(resolvedFsPath, contentHash, e.id).run();
+      }
+    }
+  } catch (err) {
+  }
+  const ghConfig = {
+    ...config.github || {},
+    ...colConfig.github || {}
+  };
+  const repo = ghConfig.repo || (typeof process !== "undefined" ? process.env.GITHUB_REPOSITORY : void 0);
+  const token = ghConfig.token || (typeof process !== "undefined" ? process.env.GITHUB_TOKEN || process.env.GH_TOKEN : void 0);
+  if (repo && token) {
+    try {
+      const [owner, repoName] = repo.split("/");
+      if (!owner || !repoName) {
+        console.warn(`[qarpeo:cms] Invalid GitHub repo format: "${repo}". Expected "owner/repo".`);
+      } else {
+        let gitPath = resolvedFsPath.replace(/\\/g, "/");
+        const match = gitPath.match(/(?:^|[\\/])((?:content|docs)[\\/].*)$/i);
+        if (match) {
+          gitPath = match[1];
+        } else if (colConfig.directory) {
+          gitPath = `${colConfig.directory}/${entry.slug}.md`;
+        } else {
+          gitPath = `${config.contentDir}/${collectionId}/${entry.slug}.md`;
+        }
+        gitPath = gitPath.replace(/\\/g, "/").replace(/^\/+/, "");
+        const baseBranch = ghConfig.branch || "main";
+        const actionVerb = action === "create" ? "create" : action === "delete" ? "delete" : "update";
+        const template = ghConfig.commitMessage || "content({collection}): {action} {slug}";
+        const commitMsg = template.replace("{collection}", collectionId).replace("{slug}", entry.slug).replace("{action}", actionVerb);
+        const headers = {
+          Accept: "application/vnd.github.v3+json",
+          Authorization: `Bearer ${token}`,
+          "User-Agent": "qarpeo-cms",
+          "Content-Type": "application/json"
+        };
+        let existingSha;
+        try {
+          const checkRes = await fetch(
+            `https://api.github.com/repos/${owner}/${repoName}/contents/${gitPath}?ref=${baseBranch}`,
+            { headers }
+          );
+          if (checkRes.ok) {
+            const checkData = await checkRes.json();
+            existingSha = checkData.sha;
+          }
+        } catch {
+        }
+        let targetBranch = baseBranch;
+        let prUrl;
+        if (ghConfig.pr) {
+          try {
+            const refRes = await fetch(
+              `https://api.github.com/repos/${owner}/${repoName}/git/ref/heads/${ghConfig.prBase || baseBranch}`,
+              { headers }
+            );
+            if (refRes.ok) {
+              const refData = await refRes.json();
+              const baseSha = refData.object?.sha;
+              const newBranch = `${ghConfig.branchPrefix || "content/"}${collectionId}-${entry.slug}-${Date.now().toString(36)}`;
+              const createBranchRes = await fetch(
+                `https://api.github.com/repos/${owner}/${repoName}/git/refs`,
+                {
+                  method: "POST",
+                  headers,
+                  body: JSON.stringify({
+                    ref: `refs/heads/${newBranch}`,
+                    sha: baseSha
+                  })
+                }
+              );
+              if (createBranchRes.ok) {
+                targetBranch = newBranch;
+              }
+            }
+          } catch {
+          }
+        }
+        let commitSha;
+        if (action === "delete") {
+          if (existingSha) {
+            const delRes = await fetch(
+              `https://api.github.com/repos/${owner}/${repoName}/contents/${gitPath}`,
+              {
+                method: "DELETE",
+                headers,
+                body: JSON.stringify({
+                  message: commitMsg,
+                  sha: existingSha,
+                  branch: targetBranch
+                })
+              }
+            );
+            if (delRes.ok) {
+              const delData = await delRes.json();
+              commitSha = delData.commit?.sha;
+            }
+          }
+        } else {
+          if (!fileContent) {
+            fileContent = formatEntryAsMarkdown(entry);
+          }
+          const base64Content = toBase64(fileContent);
+          const putRes = await fetch(
+            `https://api.github.com/repos/${owner}/${repoName}/contents/${gitPath}`,
+            {
+              method: "PUT",
+              headers,
+              body: JSON.stringify({
+                message: commitMsg,
+                content: base64Content,
+                branch: targetBranch,
+                ...existingSha ? { sha: existingSha } : {}
+              })
+            }
+          );
+          if (putRes.ok) {
+            const putData = await putRes.json();
+            commitSha = putData.commit?.sha;
+          } else {
+            const errData = await putRes.json().catch(() => ({}));
+            console.warn(
+              `[qarpeo:cms] GitHub commit failed (${putRes.status}):`,
+              errData?.message || putRes.statusText
+            );
+          }
+        }
+        if (ghConfig.pr && targetBranch !== baseBranch) {
+          try {
+            const prRes = await fetch(`https://api.github.com/repos/${owner}/${repoName}/pulls`, {
+              method: "POST",
+              headers,
+              body: JSON.stringify({
+                title: commitMsg,
+                head: targetBranch,
+                base: ghConfig.prBase || baseBranch,
+                body: `Automated content change from Qarpeo CMS for \`${collectionId}/${entry.slug}\`.`
+              })
+            });
+            if (prRes.ok) {
+              const prData = await prRes.json();
+              prUrl = prData.html_url;
+            }
+          } catch {
+          }
+        }
+        result.github = {
+          ok: true,
+          commitSha,
+          prUrl
+        };
+      }
+    } catch (err) {
+      console.warn(`[qarpeo:cms] GitHub sync error:`, err?.message || err);
+      result.github = {
+        ok: false,
+        error: err?.message || String(err)
+      };
+    }
+  }
+  return result;
+}
+export async function computeContentHash(text) {
+  const enc = new TextEncoder();
+  const buf = await crypto.subtle.digest("SHA-256", enc.encode(text));
+  return Array.from(new Uint8Array(buf)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+export function getCMSTenantId(event) {
+  const tenantId = event?.context?.tenant?.id || event?.context?.tenantId || event?.context?.organizationId || event?.context?.orgId || null;
+  return tenantId ? String(tenantId) : null;
+}
+export function getCMSTenantPrefix(event) {
+  const tenantId = getCMSTenantId(event);
+  return tenantId ? `${tenantId}:` : "";
+}
+export async function getCMSCollection(event, collectionId) {
+  const config = getCMSConfig(event);
+  const tenantPrefix = getCMSTenantPrefix(event);
+  if (config.cache) {
+    try {
+      const kv = getKVBinding(event);
+      const cached = await kv.get(`${tenantPrefix}cms:schema:${collectionId}`, {
+        type: "json"
+      });
+      if (cached) return cached;
+    } catch {
+    }
+  }
+  const db = getCMSDb(event);
+  const row = await db.prepare("SELECT * FROM _qarpeo_cms_collections WHERE id = ?").bind(collectionId).first();
+  if (!row) return null;
+  const collection = rowToCollection(row);
+  if (config.cache) {
+    try {
+      const kv = getKVBinding(event);
+      await kv.put(`${tenantPrefix}cms:schema:${collectionId}`, JSON.stringify(collection), {
+        expirationTtl: 300
+      });
+    } catch {
+    }
+  }
+  return collection;
+}
+function rowToCollection(row, config) {
+  let fields;
+  try {
+    fields = JSON.parse(row.schema_json || "{}");
+  } catch {
+    fields = {};
+  }
+  const id = row.id;
+  const resolvedConfig = config || getCMSConfig();
+  const colCfg = resolvedConfig.collections?.[id];
+  return {
+    id,
+    name: row.name,
+    description: row.description,
+    schemaJson: row.schema_json,
+    fields,
+    source: row.source,
+    order: row.order ?? 0,
+    singleton: colCfg?.singleton,
+    tenantId: row.tenant_id || void 0,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+export async function listCMSCollections(event) {
+  await ensureCMSSynced(event);
+  const db = getCMSDb(event);
+  const results = await db.prepare('SELECT * FROM _qarpeo_cms_collections ORDER BY "order" ASC, name ASC').all();
+  return (results.results || []).map(
+    (r) => rowToCollection(r)
+  );
+}
+export async function createCMSCollection(event, data) {
+  const db = getCMSDb(event);
+  const now = Date.now();
+  const schemaJson = JSON.stringify(data.fields || {});
+  await db.prepare(
+    "INSERT INTO _qarpeo_cms_collections (id, name, description, schema_json, source, created_at, updated_at) VALUES (?, ?, ?, ?, 'db', ?, ?)"
+  ).bind(data.id, data.name, data.description ?? null, schemaJson, now, now).run();
+  return {
+    id: data.id,
+    name: data.name,
+    description: data.description ?? null,
+    schemaJson,
+    fields: data.fields,
+    source: "db",
+    createdAt: now,
+    updatedAt: now
+  };
+}
+export async function updateCMSCollection(event, id, data) {
+  const db = getCMSDb(event);
+  const now = Date.now();
+  const schemaJson = JSON.stringify(data.fields || {});
+  await db.prepare(
+    "UPDATE _qarpeo_cms_collections SET name = COALESCE(?, name), description = COALESCE(?, description), schema_json = ?, updated_at = ? WHERE id = ?"
+  ).bind(data.name ?? null, data.description ?? null, schemaJson, now, id).run();
+  try {
+    const kv = getKVBinding(event);
+    const tenantPrefix = getCMSTenantPrefix(event);
+    await kv.delete(`${tenantPrefix}cms:schema:${id}`);
+  } catch {
+  }
+}
+export async function deleteCMSCollection(event, id) {
+  const db = getCMSDb(event);
+  const row = await db.prepare("SELECT source FROM _qarpeo_cms_collections WHERE id = ?").bind(id).first();
+  if (!row) throw createError({ statusCode: 404, message: `Collection '${id}' not found` });
+  if (row.source === "config") {
+    throw createError({
+      statusCode: 403,
+      message: "Cannot delete a config-seeded collection from the API. Remove it from nuxt.config.ts instead."
+    });
+  }
+  await db.prepare("DELETE FROM _qarpeo_cms_collections WHERE id = ?").bind(id).run();
+  try {
+    const kv = getKVBinding(event);
+    const tenantPrefix = getCMSTenantPrefix(event);
+    await kv.delete(`${tenantPrefix}cms:schema:${id}`);
+  } catch {
+  }
+}
+function rowToEntry(row) {
+  let metadata;
+  try {
+    metadata = JSON.parse(row.metadata_json || "{}");
+  } catch {
+    metadata = {};
+  }
+  const toc = metadata?._toc || void 0;
+  const nav = metadata?._nav || void 0;
+  const tocObj = toc || { links: [] };
+  const ast = metadata?._ast || void 0;
+  if (metadata) {
+    delete metadata._ast;
+    delete metadata._toc;
+    delete metadata._nav;
+  }
+  const body = ast && Array.isArray(ast.nodes) ? {
+    ...ast,
+    toc: tocObj
+  } : {
+    value: row.content_md || "",
+    content: row.content_md || "",
+    toc: tocObj
+  };
+  return {
+    ...metadata,
+    id: row.id,
+    collectionId: row.collection_id,
+    slug: row.slug,
+    path: row.path || void 0,
+    title: row.title,
+    description: row.description,
+    coverImage: row.cover_image,
+    tags: row.tags,
+    order: row.order,
+    contentMd: row.content_md,
+    contentHtml: row.content_html,
+    body,
+    toc: toc || { links: [] },
+    navigation: nav,
+    metadataJson: row.metadata_json,
+    metadata,
+    status: row.status,
+    source: row.source,
+    filePath: row.file_path,
+    contentHash: row.content_hash,
+    authorId: row.author_id,
+    publishedAt: row.published_at,
+    tenantId: row.tenant_id || void 0,
+    locale: row.locale || "en",
+    version: row.version || "latest",
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+function isReferenceValue(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v) && typeof v.collectionId === "string" && typeof v.slug === "string";
+}
+export async function getCollectionFields(event, collectionId) {
+  const config = getCMSConfig(event);
+  const configFields = config.collections?.[collectionId]?.fields;
+  let dbFields;
+  try {
+    const db = getCMSDb(event);
+    const row = await db.prepare("SELECT schema_json FROM _qarpeo_cms_collections WHERE id = ?").bind(collectionId).first();
+    if (row?.schema_json) {
+      dbFields = JSON.parse(row.schema_json);
+    }
+  } catch {
+  }
+  return { ...configFields || {}, ...dbFields || {} };
+}
+async function fetchEntryRef(event, collectionId, slugOrId) {
+  const db = getCMSDb(event);
+  const tenantId = getCMSTenantId(event);
+  const row = await db.prepare(
+    `SELECT id, collection_id, slug, title FROM _qarpeo_cms_entries
+       WHERE collection_id = ? AND (slug = ? OR id = ?)
+       ${tenantId ? "AND (tenant_id = ? OR tenant_id IS NULL)" : ""}
+       LIMIT 1`
+  ).bind(
+    ...tenantId ? [collectionId, slugOrId, slugOrId, tenantId] : [collectionId, slugOrId, slugOrId]
+  ).first();
+  if (!row) return null;
+  return {
+    id: row.id,
+    collectionId: row.collection_id,
+    slug: row.slug,
+    title: row.title
+  };
+}
+async function resolveReferenceInput(event, input, defaultTargetCollectionId, filter, fieldName) {
+  if (input == null || input === "") {
+    throw createError({ statusCode: 400, message: "Reference value is required" });
+  }
+  let collectionId;
+  let slugOrId;
+  if (typeof input === "string") {
+    const trimmed = input.trim();
+    if (!trimmed) {
+      throw createError({ statusCode: 400, message: "Reference value is required" });
+    }
+    const slashIdx = trimmed.indexOf("/");
+    if (slashIdx > 0) {
+      collectionId = trimmed.slice(0, slashIdx);
+      slugOrId = trimmed.slice(slashIdx + 1);
+    } else {
+      collectionId = defaultTargetCollectionId;
+      slugOrId = trimmed;
+    }
+  } else if (isReferenceValue(input)) {
+    collectionId = input.collectionId;
+    slugOrId = input.id || input.slug;
+  } else {
+    throw createError({
+      statusCode: 400,
+      message: 'Invalid reference value: expected an id, "collection/slug", or a reference object'
+    });
+  }
+  if (!collectionId || !slugOrId) {
+    throw createError({
+      statusCode: 400,
+      message: "Reference value is missing collection or slug/id"
+    });
+  }
+  const resolved = await fetchEntryRef(event, collectionId, slugOrId);
+  if (!resolved) {
+    throw createError({
+      statusCode: 400,
+      message: `Referenced entry "${slugOrId}" not found in collection "${collectionId}"`
+    });
+  }
+  if (filter && Object.keys(filter).length > 0) {
+    const fullEntry = await getCMSEntry(event, collectionId, resolved.id, { preview: true });
+    if (fullEntry) {
+      for (const [key, expected] of Object.entries(filter)) {
+        const actual = fullEntry.metadata?.[key];
+        if (actual !== expected) {
+          const label = fieldName ? `reference field "${fieldName}"` : "reference";
+          throw createError({
+            statusCode: 400,
+            message: `The ${label} target "${resolved.slug}" does not match the required filter (${key} must be ${String(expected)})`
+          });
+        }
+      }
+    }
+  }
+  return resolved;
+}
+async function validateAndNormalizeReferenceFields(event, collectionId, metadata) {
+  const fields = await getCollectionFields(event, collectionId);
+  for (const [fieldName, fieldDef] of Object.entries(fields)) {
+    if (fieldDef.type !== "reference" || !fieldDef.reference) continue;
+    const refOpts = fieldDef.reference;
+    const multiple = refOpts.multiple === true;
+    const value = metadata[fieldName];
+    if (value == null || value === "") {
+      if (fieldDef.required) {
+        throw createError({
+          statusCode: 400,
+          message: `Reference field "${fieldName}" is required`
+        });
+      }
+      if (multiple) metadata[fieldName] = [];
+      continue;
+    }
+    if (multiple) {
+      const items = Array.isArray(value) ? value : [value];
+      const resolved = [];
+      for (const item of items) {
+        if (item == null || item === "") continue;
+        resolved.push(
+          await resolveReferenceInput(event, item, refOpts.to, refOpts.filter, fieldName)
+        );
+      }
+      metadata[fieldName] = resolved;
+    } else {
+      metadata[fieldName] = await resolveReferenceInput(
+        event,
+        value,
+        refOpts.to,
+        refOpts.filter,
+        fieldName
+      );
+    }
+  }
+  return metadata;
+}
+function resolveComponentDefinition(fieldDef, config) {
+  if (fieldDef.type !== "component") return null;
+  const compOpts = fieldDef.component;
+  if (!compOpts) return null;
+  if (typeof compOpts === "string") {
+    return config.components?.[compOpts] ?? null;
+  }
+  if (compOpts.name) {
+    return config.components?.[compOpts.name] ?? null;
+  }
+  if (compOpts.fields) {
+    return { fields: compOpts.fields };
+  }
+  return null;
+}
+async function validateAndNormalizeComponentFields(event, collectionId, metadata) {
+  const config = getCMSConfig(event);
+  const fields = await getCollectionFields(event, collectionId);
+  for (const [fieldName, fieldDef] of Object.entries(fields)) {
+    if (fieldDef.type !== "component") continue;
+    const compDef = resolveComponentDefinition(fieldDef, config);
+    if (!compDef) continue;
+    const compOpts = typeof fieldDef.component === "object" ? fieldDef.component : null;
+    const isRepeatable = fieldDef.repeatable || (compOpts?.repeatable ?? false);
+    const value = metadata[fieldName];
+    if (value == null || value === "") {
+      if (fieldDef.required) {
+        throw createError({
+          statusCode: 400,
+          message: `Component field "${fieldName}" is required`
+        });
+      }
+      if (isRepeatable) metadata[fieldName] = [];
+      continue;
+    }
+    if (isRepeatable && !Array.isArray(value)) {
+      metadata[fieldName] = [value];
+    }
+    if (isRepeatable && compOpts?.max != null && Array.isArray(metadata[fieldName])) {
+      const arr = metadata[fieldName];
+      if (arr.length > compOpts.max) {
+        throw createError({
+          statusCode: 400,
+          message: `Component field "${fieldName}" exceeds maximum of ${compOpts.max} items`
+        });
+      }
+    }
+    if (isRepeatable && compOpts?.min != null && Array.isArray(metadata[fieldName])) {
+      const arr = metadata[fieldName];
+      if (arr.length < compOpts.min) {
+        throw createError({
+          statusCode: 400,
+          message: `Component field "${fieldName}" requires at least ${compOpts.min} items`
+        });
+      }
+    }
+  }
+  return metadata;
+}
+export function defineCMSComponent(def) {
+  return def;
+}
+export async function resolveReference(event, ref) {
+  if (!ref || !ref.id && !ref.slug) return null;
+  const collectionId = ref.collectionId;
+  if (!collectionId) return null;
+  const slugOrId = ref.id || ref.slug;
+  if (!slugOrId) return null;
+  return getCMSEntry(event, collectionId, slugOrId);
+}
+async function populateReferenceFields(event, entry, populate) {
+  if (!entry.metadata || Object.keys(entry.metadata).length === 0) return entry;
+  const fields = await getCollectionFields(event, entry.collectionId);
+  const populatedMeta = { ...entry.metadata };
+  for (const [fieldName, fieldDef] of Object.entries(fields)) {
+    if (fieldDef.type !== "reference") continue;
+    if (Array.isArray(populate) && !populate.includes(fieldName)) continue;
+    const value = populatedMeta[fieldName];
+    if (value == null) continue;
+    if (Array.isArray(value)) {
+      populatedMeta[fieldName] = await Promise.all(
+        value.filter(isReferenceValue).map(async (r) => ({
+          ...r,
+          entry: await resolveReference(event, r)
+        }))
+      );
+    } else if (isReferenceValue(value)) {
+      populatedMeta[fieldName] = { ...value, entry: await resolveReference(event, value) };
+    }
+  }
+  return { ...entry, metadata: populatedMeta };
+}
+const REFERENCE_PATH_RE = /^[a-zA-Z0-9_-]+\/[a-zA-Z0-9_-]+$/;
+function serializeReferencesForFrontmatter(metadata) {
+  const out = {};
+  for (const [k, v] of Object.entries(metadata)) {
+    if (isReferenceValue(v)) {
+      out[k] = `${v.collectionId}/${v.slug}`;
+    } else if (Array.isArray(v) && v.length > 0 && v.every((item) => isReferenceValue(item))) {
+      out[k] = v.map(
+        (item) => `${item.collectionId}/${item.slug}`
+      );
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+async function resolveReferenceFieldsFromFrontmatter(event, collectionId, fm) {
+  const fields = await getCollectionFields(event, collectionId);
+  for (const [fieldName, fieldDef] of Object.entries(fields)) {
+    if (fieldDef.type !== "reference" || !fieldDef.reference) continue;
+    const refOpts = fieldDef.reference;
+    const multiple = refOpts.multiple === true;
+    const value = fm[fieldName];
+    if (value == null) continue;
+    const resolveString = async (str) => {
+      if (!REFERENCE_PATH_RE.test(str)) return null;
+      const slashIdx = str.indexOf("/");
+      const refCollectionId = str.slice(0, slashIdx);
+      const refSlug = str.slice(slashIdx + 1);
+      return fetchEntryRef(event, refCollectionId, refSlug);
+    };
+    if (multiple) {
+      const items = Array.isArray(value) ? value : [value];
+      const resolved = [];
+      for (const item of items) {
+        if (typeof item === "string") {
+          const r = await resolveString(item);
+          if (r) resolved.push(r);
+        } else if (isReferenceValue(item)) {
+          resolved.push(item);
+        }
+      }
+      if (resolved.length > 0) fm[fieldName] = resolved;
+    } else if (typeof value === "string" && REFERENCE_PATH_RE.test(value)) {
+      const r = await resolveString(value);
+      if (r) fm[fieldName] = r;
+    }
+  }
+}
+function runCMSBackgroundTask(event, task) {
+  const ctx = event?.context?.cloudflare?.context || event?.node?.req?.context?.cloudflare?.context || event?.context?.waitUntil;
+  if (ctx && typeof ctx.waitUntil === "function") {
+    ctx.waitUntil(
+      task.catch((err) => console.warn("[qarpeo:cms:cache] Background task error:", err))
+    );
+  } else if (typeof ctx === "function") {
+    ctx(task.catch((err) => console.warn("[qarpeo:cms:cache] Background task error:", err)));
+  } else {
+    task.catch(() => {
+    });
+  }
+}
+async function getCachedEntry(event, collectionId, slugOrId) {
+  const config = getCMSConfig(event);
+  if (!config.cache) return null;
+  try {
+    const kv = getKVBinding(event);
+    const tenantPrefix = getCMSTenantPrefix(event);
+    const cached = await kv.get(`${tenantPrefix}cms:entry:${collectionId}:${slugOrId}`, {
+      type: "json"
+    });
+    return cached;
+  } catch {
+    return null;
+  }
+}
+async function setCachedEntry(event, collectionId, slugOrId, entry) {
+  const config = getCMSConfig(event);
+  if (!config.cache) return;
+  const tenantPrefix = getCMSTenantPrefix(event);
+  const task = (async () => {
+    try {
+      const kv = getKVBinding(event);
+      await kv.put(`${tenantPrefix}cms:entry:${collectionId}:${slugOrId}`, JSON.stringify(entry), {
+        expirationTtl: 60
+      });
+    } catch {
+    }
+  })();
+  runCMSBackgroundTask(event, task);
+}
+async function getCachedList(event, key) {
+  const config = getCMSConfig(event);
+  if (!config.cache) return null;
+  try {
+    const kv = getKVBinding(event);
+    const tenantPrefix = getCMSTenantPrefix(event);
+    const cached = await kv.get(`${tenantPrefix}${key}`, { type: "json" });
+    return cached;
+  } catch {
+    return null;
+  }
+}
+async function setCachedList(event, key, data) {
+  const config = getCMSConfig(event);
+  if (!config.cache) return;
+  const tenantPrefix = getCMSTenantPrefix(event);
+  const task = (async () => {
+    try {
+      const kv = getKVBinding(event);
+      await kv.put(`${tenantPrefix}${key}`, JSON.stringify(data), { expirationTtl: 30 });
+    } catch {
+    }
+  })();
+  runCMSBackgroundTask(event, task);
+}
+export async function invalidateCMSEntryCache(event, collectionId, slug) {
+  const config = getCMSConfig(event);
+  if (!config.cache) return;
+  const tenantPrefix = getCMSTenantPrefix(event);
+  const task = (async () => {
+    try {
+      const kv = getKVBinding(event);
+      if (slug) {
+        await kv.delete(`${tenantPrefix}cms:entry:${collectionId}:${slug}`);
+      }
+      const listRes = await kv.list({ prefix: `${tenantPrefix}cms:list:${collectionId}:` });
+      if (listRes?.keys?.length) {
+        await Promise.all(listRes.keys.map((k) => kv.delete(k.name)));
+      }
+    } catch {
+    }
+  })();
+  runCMSBackgroundTask(event, task);
+}
+export async function verifyGitHubSignature(rawBody, signatureHeader, secret) {
+  if (!signatureHeader || !secret) return false;
+  const cleanSig = signatureHeader.replace(/^sha256=/, "").trim();
+  try {
+    const key = await crypto.subtle.importKey(
+      "raw",
+      new TextEncoder().encode(secret),
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["sign"]
+    );
+    const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(rawBody));
+    const expected = Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
+    if (expected.length !== cleanSig.length) return false;
+    let diff = 0;
+    for (let i = 0; i < expected.length; i++) {
+      diff |= expected.charCodeAt(i) ^ cleanSig.charCodeAt(i);
+    }
+    return diff === 0;
+  } catch {
+    return false;
+  }
+}
+export async function queryCMSEntries(event, collectionId, opts = {}) {
+  const status = opts.status || "published";
+  const isCacheable = status === "published";
+  const listCacheKey = isCacheable && !opts.populate ? `cms:list:${collectionId}:${opts.page || 1}:${opts.limit || 10}:${opts.sort || ""}:${opts.tag || ""}:${opts.where ? JSON.stringify(opts.where) : ""}` : null;
+  if (listCacheKey) {
+    const cached = await getCachedList(event, listCacheKey);
+    if (cached) return cached;
+  }
+  const db = getCMSDb(event);
+  const page = Math.max(1, opts.page || 1);
+  const limit = Math.min(100, opts.limit || 10);
+  const offset = (page - 1) * limit;
+  const conditions = ["collection_id = ?"];
+  const binds = [collectionId];
+  const tenantId = getCMSTenantId(event);
+  if (tenantId) {
+    conditions.push("(tenant_id = ? OR tenant_id IS NULL)");
+    binds.push(tenantId);
+  }
+  if (status !== "all") {
+    conditions.push("status = ?");
+    binds.push(status);
+  }
+  if (opts.tag) {
+    conditions.push("(tags LIKE ? OR tags LIKE ? OR tags LIKE ? OR tags = ?)");
+    binds.push(`${opts.tag},%`, `%,${opts.tag},%`, `%,${opts.tag}`, opts.tag);
+  }
+  if (opts.where && typeof opts.where === "object") {
+    for (const [key, value] of Object.entries(opts.where)) {
+      if (value === void 0 || !/^[a-zA-Z0-9_]+$/.test(key)) continue;
+      const jsonPath = `$.${key}`;
+      if (value === null) {
+        conditions.push("json_extract(metadata_json, ?) IS NULL");
+        binds.push(jsonPath);
+      } else if (typeof value === "boolean") {
+        conditions.push("json_extract(metadata_json, ?) = ?");
+        binds.push(jsonPath, value ? 1 : 0);
+      } else {
+        conditions.push("json_extract(metadata_json, ?) = ?");
+        binds.push(jsonPath, value);
+      }
+    }
+  }
+  const where = `WHERE ${conditions.join(" AND ")}`;
+  const [sortField, sortDir] = (opts.sort || "published_at:desc").split(":");
+  const safeSortField = ["published_at", "created_at", "updated_at", "title", "order"].includes(
+    sortField
+  ) ? sortField : "published_at";
+  const safeDir = sortDir === "asc" ? "ASC" : "DESC";
+  const [countResult, dataResult] = await Promise.all([
+    db.prepare(`SELECT COUNT(*) as total FROM _qarpeo_cms_entries ${where}`).bind(...binds).first(),
+    db.prepare(
+      `SELECT * FROM _qarpeo_cms_entries ${where} ORDER BY ${safeSortField} ${safeDir} LIMIT ? OFFSET ?`
+    ).bind(...binds, limit, offset).all()
+  ]);
+  const total = countResult?.total ?? 0;
+  const entries = (dataResult.results || []).map(
+    rowToEntry
+  );
+  const populatedEntries = opts.populate ? await Promise.all(entries.map((e) => populateReferenceFields(event, e, opts.populate))) : entries;
+  const result = { entries: populatedEntries, total, page, limit };
+  if (listCacheKey) {
+    await setCachedList(event, listCacheKey, result);
+  }
+  return result;
+}
+export async function getCMSEntry(event, collectionId, slugOrId, opts = {}) {
+  const db = getCMSDb(event);
+  let allowDraft = false;
+  const previewCookie = event ? getCookie(event, "qarpeo_preview") : null;
+  let cookieObj = null;
+  if (previewCookie) {
+    try {
+      cookieObj = typeof previewCookie === "string" ? JSON.parse(previewCookie) : previewCookie;
+    } catch {
+    }
+  }
+  const isPreviewRequested = opts.preview || Boolean(cookieObj);
+  if (isPreviewRequested) {
+    const auth = await getAuthContext(event).catch(() => null);
+    const config = getCMSConfig(event);
+    if (auth?.user && config.roles.some((r) => r === auth.role || auth.isAdmin)) {
+      allowDraft = true;
+    }
+    if (!allowDraft) {
+      const token = opts.previewToken || cookieObj?.token;
+      const expires = opts.previewExpires || cookieObj?.expires;
+      if (token && expires) {
+        allowDraft = await verifyPreviewToken(
+          event,
+          collectionId,
+          slugOrId,
+          token,
+          expires
+        );
+      }
+    }
+  }
+  if (!allowDraft) {
+    const cached = await getCachedEntry(event, collectionId, slugOrId);
+    if (cached) return cached;
+  }
+  const statusClause = allowDraft ? "AND status IN ('draft', 'published', 'scheduled')" : "AND status = 'published'";
+  const statusOrder = allowDraft ? "ORDER BY CASE WHEN status = 'draft' THEN 1 WHEN status = 'scheduled' THEN 2 ELSE 3 END" : "";
+  const tenantId = getCMSTenantId(event);
+  const tenantClause = tenantId ? "AND (tenant_id = ? OR tenant_id IS NULL)" : "";
+  const binds = tenantId ? [collectionId, slugOrId, slugOrId, tenantId] : [collectionId, slugOrId, slugOrId];
+  const row = await db.prepare(
+    `SELECT * FROM _qarpeo_cms_entries WHERE collection_id = ? AND (slug = ? OR id = ?) ${statusClause} ${tenantClause} ${statusOrder} LIMIT 1`
+  ).bind(...binds).first();
+  const entry = row ? rowToEntry(row) : null;
+  if (entry && (!entry.body || !Array.isArray(entry.body.nodes)) && entry.contentMd) {
+    const ast = await parseMarkdownAST(entry.contentMd, event);
+    entry.body = {
+      ...ast,
+      value: entry.contentMd,
+      content: entry.contentMd,
+      toc: entry.toc || { links: [] }
+    };
+  }
+  if (entry && !allowDraft) {
+    await setCachedEntry(event, collectionId, slugOrId, entry);
+    if (entry.slug && entry.slug !== slugOrId) {
+      await setCachedEntry(event, collectionId, entry.slug, entry);
+    }
+  }
+  if (entry && opts.populate) {
+    return populateReferenceFields(event, entry, opts.populate);
+  }
+  return entry;
+}
+export async function createCMSEntry(event, collectionId, data) {
+  const db = getCMSDb(event);
+  const cmsConfig = getCMSConfig(event);
+  const isSingleton = cmsConfig.collections?.[collectionId]?.singleton;
+  if (isSingleton) {
+    const existing = await db.prepare("SELECT COUNT(*) as total FROM _qarpeo_cms_entries WHERE collection_id = ?").bind(collectionId).first();
+    if (existing && existing.total > 0) {
+      throw createError({
+        statusCode: 409,
+        message: `Collection '${collectionId}' is a singleton and already has an entry.`
+      });
+    }
+  }
+  const id = nanoid();
+  const now = Date.now();
+  const { ast, html: contentHtml } = await processMarkdown(data.contentMd);
+  const metadata = data.metadata || {};
+  if (ast) {
+    ;
+    metadata._ast = ast;
+  }
+  await validateAndNormalizeReferenceFields(event, collectionId, metadata);
+  await validateAndNormalizeComponentFields(event, collectionId, metadata);
+  const metadataJson = JSON.stringify(metadata);
+  const publishedAt = data.status === "published" ? data.publishedAt ?? now : data.status === "scheduled" && data.publishedAt ? data.publishedAt : data.publishedAt ?? null;
+  const tenantId = getCMSTenantId(event);
+  await db.prepare(
+    `INSERT INTO _qarpeo_cms_entries
+        (id, collection_id, slug, title, description, cover_image, tags, "order", content_md, content_html, metadata_json, status, source, author_id, published_at, created_at, updated_at, tenant_id)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'db', ?, ?, ?, ?, ?)`
+  ).bind(
+    id,
+    collectionId,
+    data.slug,
+    data.title,
+    data.description ?? null,
+    data.coverImage ?? null,
+    data.tags ?? null,
+    data.order ?? 0,
+    data.contentMd,
+    contentHtml,
+    metadataJson,
+    data.status || "draft",
+    data.authorId ?? null,
+    publishedAt,
+    now,
+    now,
+    tenantId
+  ).run();
+  const entry = {
+    id,
+    collectionId,
+    slug: data.slug,
+    title: data.title,
+    description: data.description ?? null,
+    coverImage: data.coverImage ?? null,
+    tags: data.tags ?? null,
+    order: data.order ?? 0,
+    contentMd: data.contentMd,
+    contentHtml,
+    metadataJson,
+    metadata,
+    body: ast ? { ...ast, value: data.contentMd, content: data.contentMd } : void 0,
+    status: data.status || "draft",
+    source: "db",
+    filePath: null,
+    contentHash: null,
+    authorId: data.authorId ?? null,
+    publishedAt,
+    tenantId: tenantId ?? null,
+    createdAt: now,
+    updatedAt: now
+  };
+  const gitResult = await syncEntryToGit(event, collectionId, entry, "create");
+  if (gitResult?.filePath) {
+    entry.filePath = gitResult.filePath;
+    entry.contentHash = gitResult.contentHash || null;
+    entry.source = "file";
+  }
+  await invalidateCMSEntryCache(event, collectionId, data.slug);
+  fireCMSWebhooks(getCMSConfig(event), collectionId, "create", entry).catch(console.warn);
+  return entry;
+}
+export async function updateCMSEntry(event, entryId, data) {
+  const db = getCMSDb(event);
+  const now = Date.now();
+  const existing = await db.prepare("SELECT * FROM _qarpeo_cms_entries WHERE id = ?").bind(entryId).first();
+  if (!existing) throw createError({ statusCode: 404, message: "Entry not found" });
+  const tenantId = getCMSTenantId(event);
+  if (tenantId && existing.tenant_id && existing.tenant_id !== tenantId) {
+    throw createError({
+      statusCode: 403,
+      message: "Forbidden: Cannot modify an entry belonging to another tenant"
+    });
+  }
+  const contentMd = data.contentMd ?? existing.content_md;
+  let contentHtml = existing.content_html;
+  let newAst = null;
+  if (data.contentMd) {
+    const res = await processMarkdown(data.contentMd);
+    contentHtml = res.html;
+    newAst = res.ast;
+  }
+  let metadataObj = data.metadata;
+  if (!metadataObj && existing.metadata_json) {
+    try {
+      metadataObj = JSON.parse(existing.metadata_json);
+    } catch {
+    }
+  }
+  if (metadataObj && newAst) {
+    ;
+    metadataObj._ast = newAst;
+  }
+  if (metadataObj && data.metadata) {
+    await validateAndNormalizeReferenceFields(event, existing.collection_id, metadataObj);
+    await validateAndNormalizeComponentFields(event, existing.collection_id, metadataObj);
+  }
+  const metadataJson = metadataObj ? JSON.stringify(metadataObj) : existing.metadata_json;
+  const status = data.status ?? existing.status;
+  let publishedAt;
+  if (data.publishedAt !== void 0) {
+    publishedAt = data.publishedAt;
+  } else if (status === "published") {
+    publishedAt = existing.published_at ?? now;
+  } else if (status === "scheduled") {
+    publishedAt = existing.published_at ?? now;
+  } else {
+    publishedAt = existing.published_at;
+  }
+  await db.prepare(
+    "INSERT INTO _qarpeo_cms_revisions (id, entry_id, title, content_md, metadata_json, author_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)"
+  ).bind(
+    nanoid(),
+    entryId,
+    existing.title,
+    existing.content_md,
+    existing.metadata_json,
+    existing.author_id,
+    now
+  ).run();
+  await db.prepare(
+    `UPDATE _qarpeo_cms_entries SET
+        slug = COALESCE(?, slug), title = COALESCE(?, title),
+        description = COALESCE(?, description), cover_image = COALESCE(?, cover_image),
+        tags = COALESCE(?, tags), "order" = COALESCE(?, "order"),
+        content_md = ?, content_html = ?, metadata_json = ?,
+        status = ?, source = 'db', published_at = ?, updated_at = ?
+       WHERE id = ?`
+  ).bind(
+    data.slug ?? null,
+    data.title ?? null,
+    data.description ?? null,
+    data.coverImage ?? null,
+    data.tags ?? null,
+    data.order ?? null,
+    contentMd,
+    contentHtml,
+    metadataJson,
+    status,
+    publishedAt,
+    now,
+    entryId
+  ).run();
+  const config = getCMSConfig(event);
+  const maxRevisions = typeof config.revisions === "object" ? config.revisions.max ?? 10 : 10;
+  await pruneRevisions(event, entryId, maxRevisions);
+  const updated = await db.prepare("SELECT * FROM _qarpeo_cms_entries WHERE id = ?").bind(entryId).first();
+  const updatedEntry = rowToEntry(updated);
+  const gitResult = await syncEntryToGit(event, updatedEntry.collectionId, updatedEntry, "update");
+  if (gitResult?.filePath) {
+    updatedEntry.filePath = gitResult.filePath;
+    updatedEntry.contentHash = gitResult.contentHash || null;
+    updatedEntry.source = "file";
+  }
+  await invalidateCMSEntryCache(event, updatedEntry.collectionId, updatedEntry.slug);
+  fireCMSWebhooks(getCMSConfig(event), updatedEntry.collectionId, "update", updatedEntry).catch(
+    console.warn
+  );
+  return updatedEntry;
+}
+async function nullifyOrphanedReferences(event, deletedEntryId) {
+  const db = getCMSDb(event);
+  try {
+    const tenantId = getCMSTenantId(event);
+    const tenantClause = tenantId ? " AND (tenant_id = ? OR tenant_id IS NULL)" : "";
+    const binds = tenantId ? [`%"id":"${deletedEntryId}"%`, tenantId] : [`%"id":"${deletedEntryId}"%`];
+    const rows = (await db.prepare(
+      `SELECT id, collection_id, slug, metadata_json FROM _qarpeo_cms_entries
+           WHERE json_extract(metadata_json, '$') IS NOT NULL
+             AND metadata_json LIKE ?${tenantClause}`
+    ).bind(...binds).all()).results;
+    for (const row of rows) {
+      let meta;
+      try {
+        meta = JSON.parse(row.metadata_json);
+      } catch {
+        continue;
+      }
+      let changed = false;
+      for (const [key, value] of Object.entries(meta)) {
+        if (isReferenceValue(value) && value.id === deletedEntryId) {
+          meta[key] = null;
+          changed = true;
+        } else if (Array.isArray(value)) {
+          const filtered = value.filter(
+            (item) => !(isReferenceValue(item) && item.id === deletedEntryId)
+          );
+          if (filtered.length !== value.length) {
+            meta[key] = filtered;
+            changed = true;
+          }
+        }
+      }
+      if (changed) {
+        await db.prepare("UPDATE _qarpeo_cms_entries SET metadata_json = ? WHERE id = ?").bind(JSON.stringify(meta), row.id).run();
+        await invalidateCMSEntryCache(event, row.collection_id, row.slug);
+      }
+    }
+  } catch (err) {
+    console.warn("[qarpeo:cms] nullifyOrphanedReferences failed:", err);
+  }
+}
+export async function deleteCMSEntry(event, entryId) {
+  const db = getCMSDb(event);
+  const existing = await db.prepare("SELECT * FROM _qarpeo_cms_entries WHERE id = ?").bind(entryId).first();
+  if (!existing) throw createError({ statusCode: 404, message: "Entry not found" });
+  const tenantId = getCMSTenantId(event);
+  if (tenantId && existing.tenant_id && existing.tenant_id !== tenantId) {
+    throw createError({
+      statusCode: 403,
+      message: "Forbidden: Cannot delete an entry belonging to another tenant"
+    });
+  }
+  await db.batch([
+    db.prepare("DELETE FROM _qarpeo_cms_revisions WHERE entry_id = ?").bind(entryId),
+    db.prepare("DELETE FROM _qarpeo_cms_entries WHERE id = ?").bind(entryId)
+  ]);
+  if (existing) {
+    await nullifyOrphanedReferences(event, entryId);
+    await invalidateCMSEntryCache(event, existing.collection_id, existing.slug);
+    await syncEntryToGit(event, existing.collection_id, rowToEntry(existing), "delete");
+    fireCMSWebhooks(
+      getCMSConfig(event),
+      existing.collection_id,
+      "delete",
+      rowToEntry(existing)
+    ).catch(console.warn);
+  }
+}
+export async function publishCMSEntry(event, entryId, targetStatus, targetPublishedAt) {
+  const db = getCMSDb(event);
+  const now = Date.now();
+  const existing = await db.prepare("SELECT * FROM _qarpeo_cms_entries WHERE id = ?").bind(entryId).first();
+  if (!existing) {
+    throw createError({ statusCode: 404, message: "Entry not found" });
+  }
+  const tenantId = getCMSTenantId(event);
+  if (tenantId && existing.tenant_id && existing.tenant_id !== tenantId) {
+    throw createError({
+      statusCode: 403,
+      message: "Forbidden: Cannot publish an entry belonging to another tenant"
+    });
+  }
+  const publishedAt = targetStatus === "published" ? targetPublishedAt ?? existing.published_at ?? now : targetStatus === "scheduled" ? targetPublishedAt ?? existing.published_at ?? now : null;
+  const collectionId = existing.collection_id;
+  const config = getCMSConfig(event);
+  const colConfig = config.collections[collectionId] || {};
+  const approval = resolveCollectionApproval(colConfig, config.approval);
+  let metadataJson = existing.metadata_json || "{}";
+  if ((targetStatus === "published" || targetStatus === "scheduled") && approval) {
+    const auth = await getAuthContext(event);
+    const userRole = auth?.role || "user";
+    const isAuthorized = auth?.isAdmin || approval.roles?.includes(userRole);
+    if (!isAuthorized) {
+      throw createError({
+        statusCode: 403,
+        message: `${targetStatus === "scheduled" ? "Scheduling" : "Publishing"} in "${collectionId}" requires one of the following approver roles: ${approval.roles?.join(", ")}.`
+      });
+    }
+    if (!approval.allowSelfApproval && existing.author_id && auth?.user?.id === existing.author_id) {
+      throw createError({
+        statusCode: 403,
+        message: `Self-approval is disabled for "${collectionId}". Another team member must approve this entry.`
+      });
+    }
+    let metaObj = {};
+    try {
+      metaObj = JSON.parse(metadataJson);
+    } catch {
+    }
+    metaObj._approval = {
+      ...metaObj._approval || {},
+      approvedBy: auth?.user?.id || null,
+      approvedByName: auth?.user?.name || auth?.user?.email || "Admin",
+      approvedAt: now
+    };
+    metadataJson = JSON.stringify(metaObj);
+  }
+  await db.prepare(
+    "UPDATE _qarpeo_cms_entries SET status = ?, published_at = ?, metadata_json = ?, updated_at = ? WHERE id = ?"
+  ).bind(targetStatus, publishedAt, metadataJson, now, entryId).run();
+  const updatedRow = await db.prepare("SELECT * FROM _qarpeo_cms_entries WHERE id = ?").bind(entryId).first();
+  if (updatedRow) {
+    const updated = rowToEntry(updatedRow);
+    await syncEntryToGit(
+      event,
+      updated.collectionId,
+      updated,
+      targetStatus === "published" ? "publish" : "update"
+    );
+    const webhookEvent = targetStatus === "published" ? "publish" : targetStatus === "scheduled" ? "update" : "unpublish";
+    fireCMSWebhooks(config, updated.collectionId, webhookEvent, updated).catch(console.warn);
+    if (targetStatus === "published" || targetStatus === "draft") {
+      fireCMSDeployTrigger(
+        config,
+        updated.collectionId,
+        targetStatus === "published" ? "publish" : "unpublish"
+      ).catch(console.warn);
+    }
+  }
+}
+export async function publishDueScheduledEntries(event) {
+  const db = getCMSDb(event);
+  const now = Date.now();
+  const config = getCMSConfig(event);
+  const rows = await db.prepare(
+    "SELECT * FROM _qarpeo_cms_entries WHERE status = 'scheduled' AND published_at IS NOT NULL AND published_at <= ?"
+  ).bind(now).all();
+  const entriesToPublish = rows.results || [];
+  const publishedEntries = [];
+  for (const row of entriesToPublish) {
+    const entryId = row.id;
+    const collectionId = row.collection_id;
+    await db.prepare("UPDATE _qarpeo_cms_entries SET status = 'published', updated_at = ? WHERE id = ?").bind(now, entryId).run();
+    const updatedRow = await db.prepare("SELECT * FROM _qarpeo_cms_entries WHERE id = ?").bind(entryId).first();
+    if (updatedRow) {
+      const entry = rowToEntry(updatedRow);
+      publishedEntries.push(entry);
+      await syncEntryToGit(event, collectionId, entry, "publish").catch(console.warn);
+      fireCMSWebhooks(config, collectionId, "publish", entry).catch(console.warn);
+      fireCMSDeployTrigger(config, collectionId, "publish").catch(console.warn);
+    }
+  }
+  return publishedEntries;
+}
+export async function submitCMSEntryForReview(event, entryId, note) {
+  const db = getCMSDb(event);
+  const now = Date.now();
+  const existing = await db.prepare("SELECT * FROM _qarpeo_cms_entries WHERE id = ?").bind(entryId).first();
+  if (!existing) throw createError({ statusCode: 404, message: "Entry not found" });
+  const tenantId = getCMSTenantId(event);
+  if (tenantId && existing.tenant_id && existing.tenant_id !== tenantId) {
+    throw createError({
+      statusCode: 403,
+      message: "Forbidden: Cannot modify an entry belonging to another tenant"
+    });
+  }
+  const auth = await getAuthContext(event);
+  let metaObj = {};
+  try {
+    metaObj = JSON.parse(existing.metadata_json || "{}");
+  } catch {
+  }
+  metaObj._approval = {
+    ...metaObj._approval || {},
+    submittedBy: auth?.user?.id || null,
+    submittedByName: auth?.user?.name || auth?.user?.email || "Editor",
+    submittedAt: now,
+    submissionNote: note || null
+  };
+  const metadataJson = JSON.stringify(metaObj);
+  await db.prepare(
+    "INSERT INTO _qarpeo_cms_revisions (id, entry_id, title, content_md, metadata_json, author_id, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)"
+  ).bind(
+    nanoid(),
+    entryId,
+    existing.title,
+    existing.content_md,
+    metadataJson,
+    auth?.user?.id || existing.author_id,
+    now
+  ).run();
+  await db.prepare(
+    "UPDATE _qarpeo_cms_entries SET status = 'pending_review', metadata_json = ?, updated_at = ? WHERE id = ?"
+  ).bind(metadataJson, now, entryId).run();
+  const updated = await db.prepare("SELECT * FROM _qarpeo_cms_entries WHERE id = ?").bind(entryId).first();
+  return rowToEntry(updated);
+}
+export async function rejectCMSEntryReview(event, entryId, reason) {
+  const db = getCMSDb(event);
+  const now = Date.now();
+  const existing = await db.prepare("SELECT * FROM _qarpeo_cms_entries WHERE id = ?").bind(entryId).first();
+  if (!existing) throw createError({ statusCode: 404, message: "Entry not found" });
+  const tenantId = getCMSTenantId(event);
+  if (tenantId && existing.tenant_id && existing.tenant_id !== tenantId) {
+    throw createError({
+      statusCode: 403,
+      message: "Forbidden: Cannot modify an entry belonging to another tenant"
+    });
+  }
+  const collectionId = existing.collection_id;
+  const config = getCMSConfig(event);
+  const colConfig = config.collections[collectionId] || {};
+  const approval = resolveCollectionApproval(colConfig, config.approval);
+  const auth = await getAuthContext(event);
+  if (approval) {
+    const userRole = auth?.role || "user";
+    const isAuthorized = auth?.isAdmin || approval.roles?.includes(userRole);
+    if (!isAuthorized) {
+      throw createError({
+        statusCode: 403,
+        message: `Only reviewers with roles [${approval.roles?.join(", ")}] can request changes on entries in "${collectionId}".`
+      });
+    }
+  }
+  let metaObj = {};
+  try {
+    metaObj = JSON.parse(existing.metadata_json || "{}");
+  } catch {
+  }
+  metaObj._approval = {
+    ...metaObj._approval || {},
+    rejectedBy: auth?.user?.id || null,
+    rejectedByName: auth?.user?.name || auth?.user?.email || "Reviewer",
+    rejectedAt: now,
+    rejectionReason: reason || null
+  };
+  const metadataJson = JSON.stringify(metaObj);
+  await db.prepare(
+    "UPDATE _qarpeo_cms_entries SET status = 'draft', metadata_json = ?, updated_at = ? WHERE id = ?"
+  ).bind(metadataJson, now, entryId).run();
+  const updated = await db.prepare("SELECT * FROM _qarpeo_cms_entries WHERE id = ?").bind(entryId).first();
+  return rowToEntry(updated);
+}
+export async function pruneRevisions(event, entryId, max) {
+  const db = getCMSDb(event);
+  await db.prepare(
+    `DELETE FROM _qarpeo_cms_revisions WHERE entry_id = ? AND id NOT IN (
+         SELECT id FROM _qarpeo_cms_revisions WHERE entry_id = ? ORDER BY created_at DESC LIMIT ?
+       )`
+  ).bind(entryId, entryId, max).run();
+}
+async function getCMSSecret(event) {
+  const rc = useRuntimeConfig(event);
+  const secret = rc.appSecret || rc.qarpeo?.sessionPassword || rc.sessionPassword || rc.session?.password || globalThis.process?.env?.NUXT_APP_SECRET || globalThis.process?.env?.NUXT_SESSION_PASSWORD || "qarpeo-cms-preview-secret";
+  const enc = new TextEncoder();
+  return crypto.subtle.importKey(
+    "raw",
+    enc.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign", "verify"]
+  );
+}
+export async function generatePreviewToken(event, collection, slugOrId, ttlMs = 24 * 60 * 60 * 1e3) {
+  const expires = Date.now() + ttlMs;
+  const key = await getCMSSecret(event);
+  const msg = new TextEncoder().encode(`${collection}:${slugOrId}:${expires}`);
+  const sig = await crypto.subtle.sign("HMAC", key, msg);
+  const token = btoa(String.fromCharCode(...new Uint8Array(sig)));
+  return { token, expires };
+}
+export async function verifyPreviewToken(event, collection, slugOrId, token, expiresStr) {
+  try {
+    const expires = typeof expiresStr === "number" ? expiresStr : parseInt(String(expiresStr), 10);
+    if (Number.isNaN(expires) || Date.now() > expires) return false;
+    const key = await getCMSSecret(event);
+    const sigBytes = Uint8Array.from(atob(token), (c) => c.charCodeAt(0));
+    const msg = new TextEncoder().encode(`${collection}:${slugOrId}:${expires}`);
+    const isValid = await crypto.subtle.verify("HMAC", key, sigBytes, msg);
+    if (isValid) return true;
+    try {
+      const db = getCMSDb(event);
+      const row = await db.prepare(
+        "SELECT id, slug FROM _qarpeo_cms_entries WHERE collection_id = ? AND (id = ? OR slug = ?) LIMIT 1"
+      ).bind(collection, slugOrId, slugOrId).first();
+      if (row) {
+        const alt = row.id === slugOrId ? row.slug : row.id;
+        if (alt) {
+          const altMsg = new TextEncoder().encode(`${collection}:${alt}:${expires}`);
+          return await crypto.subtle.verify("HMAC", key, sigBytes, altMsg);
+        }
+      }
+    } catch {
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
+export async function ensureCMSTables(event) {
+  const db = getCMSDb(event);
+  const statements = [
+    `CREATE TABLE IF NOT EXISTS _qarpeo_cms_collections (id TEXT PRIMARY KEY, tenant_id TEXT, name TEXT NOT NULL, description TEXT, schema_json TEXT NOT NULL DEFAULT '{}', source TEXT NOT NULL DEFAULT 'db', "order" INTEGER NOT NULL DEFAULT 0, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL);`,
+    `CREATE TABLE IF NOT EXISTS _qarpeo_cms_entries (id TEXT PRIMARY KEY, tenant_id TEXT, collection_id TEXT NOT NULL, slug TEXT NOT NULL, title TEXT NOT NULL, description TEXT, cover_image TEXT, tags TEXT, "order" INTEGER NOT NULL DEFAULT 0, content_md TEXT NOT NULL DEFAULT '', content_html TEXT NOT NULL DEFAULT '', metadata_json TEXT DEFAULT '{}', status TEXT NOT NULL DEFAULT 'draft', source TEXT NOT NULL DEFAULT 'db', path TEXT, file_path TEXT, content_hash TEXT, author_id TEXT, locale TEXT NOT NULL DEFAULT 'en', version TEXT NOT NULL DEFAULT 'latest', published_at INTEGER, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL);`,
+    `CREATE TABLE IF NOT EXISTS _qarpeo_cms_revisions (id TEXT PRIMARY KEY, entry_id TEXT NOT NULL, title TEXT NOT NULL, content_md TEXT NOT NULL, metadata_json TEXT DEFAULT '{}', author_id TEXT, created_at INTEGER NOT NULL);`,
+    // Matching Drizzle schema indexes
+    `CREATE INDEX IF NOT EXISTS _qarpeo_cms_entries_collection_idx ON _qarpeo_cms_entries(collection_id);`,
+    `CREATE INDEX IF NOT EXISTS _qarpeo_cms_entries_tenant_idx ON _qarpeo_cms_entries(tenant_id, collection_id);`,
+    `CREATE INDEX IF NOT EXISTS _qarpeo_cms_entries_slug_idx ON _qarpeo_cms_entries(collection_id, slug);`,
+    `CREATE INDEX IF NOT EXISTS _qarpeo_cms_entries_status_idx ON _qarpeo_cms_entries(status);`,
+    `CREATE INDEX IF NOT EXISTS _qarpeo_cms_entries_order_idx ON _qarpeo_cms_entries(collection_id, "order");`,
+    `CREATE INDEX IF NOT EXISTS _qarpeo_cms_entries_path_idx ON _qarpeo_cms_entries(collection_id, path);`,
+    `CREATE INDEX IF NOT EXISTS _qarpeo_cms_entries_locale_idx ON _qarpeo_cms_entries(collection_id, locale);`,
+    `CREATE INDEX IF NOT EXISTS _qarpeo_cms_entries_path_locale_idx ON _qarpeo_cms_entries(path, locale);`,
+    `CREATE INDEX IF NOT EXISTS _qarpeo_cms_entries_version_idx ON _qarpeo_cms_entries(collection_id, version);`,
+    `CREATE INDEX IF NOT EXISTS _qarpeo_cms_entries_path_version_idx ON _qarpeo_cms_entries(path, version);`,
+    `CREATE INDEX IF NOT EXISTS _qarpeo_cms_entries_published_at_idx ON _qarpeo_cms_entries(published_at);`,
+    `CREATE INDEX IF NOT EXISTS _qarpeo_cms_entries_list_idx ON _qarpeo_cms_entries(collection_id, status, published_at);`,
+    `CREATE INDEX IF NOT EXISTS _qarpeo_cms_revisions_entry_idx ON _qarpeo_cms_revisions(entry_id, created_at);`
+  ];
+  for (const sql of statements) {
+    try {
+      await db.exec(sql);
+    } catch (err) {
+      console.warn("[qarpeo:cms] ensureCMSTables warning on statement:", sql, err);
+    }
+  }
+  try {
+    await db.exec("ALTER TABLE _qarpeo_cms_entries ADD COLUMN path TEXT;");
+  } catch {
+  }
+  try {
+    await db.exec(
+      'ALTER TABLE _qarpeo_cms_collections ADD COLUMN "order" INTEGER NOT NULL DEFAULT 0;'
+    );
+  } catch {
+  }
+  try {
+    await db.exec('ALTER TABLE _qarpeo_cms_entries ADD COLUMN "order" INTEGER NOT NULL DEFAULT 0;');
+  } catch {
+  }
+  try {
+    await db.exec("ALTER TABLE _qarpeo_cms_entries ADD COLUMN tenant_id TEXT;");
+  } catch {
+  }
+  try {
+    await db.exec("ALTER TABLE _qarpeo_cms_collections ADD COLUMN tenant_id TEXT;");
+  } catch {
+  }
+  try {
+    await db.exec("ALTER TABLE _qarpeo_cms_entries ADD COLUMN locale TEXT NOT NULL DEFAULT 'en';");
+  } catch {
+  }
+  try {
+    await db.exec("ALTER TABLE _qarpeo_cms_entries ADD COLUMN version TEXT NOT NULL DEFAULT 'latest';");
+  } catch {
+  }
+  try {
+    await db.exec(
+      "CREATE VIRTUAL TABLE IF NOT EXISTS _qarpeo_cms_entries_fts USING fts5(id UNINDEXED, slug, title, description, content_md, tags, tokenize = 'unicode61');"
+    );
+  } catch (err) {
+    console.warn("[qarpeo:cms] ensureCMSTables FTS virtual table notice:", err);
+  }
+  try {
+    await db.exec(
+      "CREATE TRIGGER IF NOT EXISTS _qarpeo_cms_entries_fts_ai AFTER INSERT ON _qarpeo_cms_entries BEGIN INSERT INTO _qarpeo_cms_entries_fts(id, slug, title, description, content_md, tags) VALUES (new.id, new.slug, new.title, coalesce(new.description, ''), new.content_md, coalesce(new.tags, '')); END;"
+    );
+  } catch {
+  }
+  try {
+    await db.exec(
+      "CREATE TRIGGER IF NOT EXISTS _qarpeo_cms_entries_fts_ad AFTER DELETE ON _qarpeo_cms_entries BEGIN DELETE FROM _qarpeo_cms_entries_fts WHERE id = old.id; END;"
+    );
+  } catch {
+  }
+  try {
+    await db.exec(
+      "CREATE TRIGGER IF NOT EXISTS _qarpeo_cms_entries_fts_au AFTER UPDATE ON _qarpeo_cms_entries BEGIN DELETE FROM _qarpeo_cms_entries_fts WHERE id = old.id; INSERT INTO _qarpeo_cms_entries_fts(id, slug, title, description, content_md, tags) VALUES (new.id, new.slug, new.title, coalesce(new.description, ''), new.content_md, coalesce(new.tags, '')); END;"
+    );
+  } catch {
+  }
+  try {
+    await db.exec(
+      "INSERT INTO _qarpeo_cms_entries_fts(id, slug, title, description, content_md, tags) SELECT e.id, e.slug, e.title, coalesce(e.description, ''), e.content_md, coalesce(e.tags, '') FROM _qarpeo_cms_entries e WHERE NOT EXISTS (SELECT 1 FROM _qarpeo_cms_entries_fts fts WHERE fts.id = e.id);"
+    );
+  } catch {
+  }
+}
+let lastSyncTime = 0;
+let syncPromise = null;
+let hasInitialSynced = false;
+async function _runCMSSync(event) {
+  try {
+    if (!globalThis.__QARPEO_DEV_ENV__) {
+      try {
+        const { getOrInitDevProxy } = await import("./dev-proxy.mjs");
+        const proxy = await getOrInitDevProxy();
+        if (proxy?.env) {
+          ;
+          globalThis.__QARPEO_DEV_ENV__ = proxy.env;
+        }
+      } catch (proxyErr) {
+        console.warn("[qarpeo:cms] Could not init dev proxy in ensureCMSSynced:", proxyErr);
+      }
+    }
+    await ensureCMSTables(event);
+    const config = getCMSConfig(event);
+    await seedCollectionsFromConfig(event, config.collections);
+    await syncLocalContentFiles(
+      event,
+      config.contentDir,
+      config.collections,
+      config.sources
+    );
+  } catch (err) {
+    console.error("[qarpeo:cms] Auto-sync failed:", err);
+  }
+}
+let prodTablesChecked = false;
+export async function ensureCMSSynced(event) {
+  if (process.env.NODE_ENV !== "production" || import.meta.dev) {
+    if (!hasInitialSynced) {
+      if (!syncPromise) {
+        syncPromise = _runCMSSync(event).finally(() => {
+          hasInitialSynced = true;
+          lastSyncTime = Date.now();
+          syncPromise = null;
+        });
+      }
+      await syncPromise;
+      return;
+    }
+    if (syncPromise) {
+      await syncPromise;
+      return;
+    }
+    const now = Date.now();
+    if (now - lastSyncTime > 3e4) {
+      lastSyncTime = now;
+      syncPromise = _runCMSSync(event).finally(() => {
+        syncPromise = null;
+      });
+      await syncPromise;
+    }
+  } else {
+    if (!prodTablesChecked) {
+      prodTablesChecked = true;
+      try {
+        await ensureCMSTables(event);
+      } catch (err) {
+        console.warn("[qarpeo:cms] Production ensureCMSTables check failed:", err);
+      }
+    }
+  }
+}
+export async function seedCollectionsFromConfig(event, collectionsConfig) {
+  const db = getCMSDb(event);
+  const now = Date.now();
+  for (const [id, cfg] of Object.entries(collectionsConfig)) {
+    const schemaJson = JSON.stringify(cfg.fields || {});
+    const colName = cfg.name || id.charAt(0).toUpperCase() + id.slice(1).replace(/-/g, " ");
+    const existing = await db.prepare("SELECT id, source, schema_json FROM _qarpeo_cms_collections WHERE id = ?").bind(id).first();
+    if (!existing) {
+      await db.prepare(
+        "INSERT INTO _qarpeo_cms_collections (id, name, description, schema_json, source, created_at, updated_at) VALUES (?, ?, ?, ?, 'config', ?, ?)"
+      ).bind(id, colName, cfg.description ?? null, schemaJson, now, now).run();
+    } else if (existing.source === "config" && existing.schema_json !== schemaJson) {
+      await db.prepare(
+        "UPDATE _qarpeo_cms_collections SET name = ?, description = ?, schema_json = ?, updated_at = ? WHERE id = ?"
+      ).bind(colName, cfg.description ?? null, schemaJson, now, id).run();
+      try {
+        const kv = getKVBinding(event);
+        const tenantPrefix = getCMSTenantPrefix(event);
+        await kv.delete(`${tenantPrefix}cms:schema:${id}`);
+      } catch {
+      }
+    }
+  }
+}
+import { matchesSourceFilters, matchesGlobFilter } from "./cms-filter.mjs";
+export { matchesSourceFilters, matchesGlobFilter };
+export async function syncLocalContentFiles(event, contentDir, collectionsConfig = {}, sources = []) {
+  let readdir, readFile, existsSync;
+  try {
+    const fs = await import("node:fs/promises");
+    const fsSync = await import("node:fs");
+    readdir = (dir) => fs.readdir(dir, { withFileTypes: true });
+    readFile = (p) => fs.readFile(p, "utf8");
+    existsSync = fsSync.existsSync;
+  } catch {
+    return { synced: 0, skipped: 0, inserted: 0 };
+  }
+  async function readNavJson(dir) {
+    const navJsonPath = `${dir}/.navigation.json`;
+    if (existsSync(navJsonPath)) {
+      try {
+        const raw = await readFile(navJsonPath);
+        const clean = raw.charCodeAt(0) === 65279 ? raw.slice(1) : raw;
+        return JSON.parse(clean);
+      } catch {
+      }
+    }
+    const navYmlPath = `${dir}/.navigation.yml`;
+    if (existsSync(navYmlPath)) {
+      try {
+        const raw = await readFile(navYmlPath);
+        const { parse: parseYaml2 } = await import("yaml");
+        return parseYaml2(raw) || {};
+      } catch {
+      }
+    }
+    return {};
+  }
+  async function readSchemaJson(dir) {
+    const schemaPath = `${dir}/.schema.json`;
+    if (existsSync(schemaPath)) {
+      try {
+        const raw = await readFile(schemaPath);
+        const clean = raw.charCodeAt(0) === 65279 ? raw.slice(1) : raw;
+        const parsed = JSON.parse(clean);
+        return {
+          scope: parsed.scope || "cascade",
+          fields: parsed.fields || {}
+        };
+      } catch {
+      }
+    }
+    return null;
+  }
+  const db = getCMSDb(event);
+  const cmsConfig = getCMSConfig(event);
+  let synced = 0, skipped = 0, inserted = 0;
+  const now = Date.now();
+  try {
+    const existingFileRows = await db.prepare("SELECT id, file_path FROM _qarpeo_cms_entries WHERE source = 'file'").all();
+    for (const r of existingFileRows?.results || []) {
+      if (r.file_path && !existsSync(r.file_path)) {
+        await db.prepare("DELETE FROM _qarpeo_cms_entries WHERE id = ?").bind(r.id).run();
+      }
+    }
+  } catch {
+  }
+  async function syncSource(source) {
+    if (!source?.resolvedDir || !existsSync(source.resolvedDir)) return;
+    let orderCounter = 0;
+    const processDir = async (dir, relBase, sectionNavMeta) => {
+      let entries;
+      try {
+        entries = await readdir(dir);
+      } catch {
+        return;
+      }
+      entries.sort((a, b) => a.name.localeCompare(b.name, void 0, { numeric: true }));
+      let navMeta = await readNavJson(dir);
+      if (navMeta.private === true || navMeta.draft === true || navMeta.exclude === true) {
+        return;
+      }
+      const isTopLevelSection = Boolean(relBase && !relBase.includes("/"));
+      const currentSectionNavMeta = sectionNavMeta || (isTopLevelSection ? {
+        title: navMeta.title || stripOrderPrefix(relBase).charAt(0).toUpperCase() + stripOrderPrefix(relBase).slice(1).replace(/-/g, " "),
+        icon: navMeta.icon,
+        order: navMeta.order ?? extractOrderPrefix(relBase),
+        navigation: navMeta.navigation,
+        hidden: navMeta.hidden
+      } : void 0);
+      for (const entry of entries) {
+        if (entry.name.startsWith(".") || entry.name.startsWith("_")) continue;
+        const subRel = relBase ? `${relBase}/${entry.name}` : entry.name;
+        if (entry.isDirectory()) {
+          await processDir(`${dir}/${entry.name}`, subRel, currentSectionNavMeta);
+        } else if (entry.isFile() && entry.name.endsWith(".md")) {
+          const combinedExclude = [
+            ...Array.isArray(cmsConfig?.exclude) ? cmsConfig.exclude : cmsConfig?.exclude ? [cmsConfig.exclude] : [],
+            ...Array.isArray(source.exclude) ? source.exclude : source.exclude ? [source.exclude] : []
+          ];
+          if (!matchesSourceFilters(subRel, source.include, combinedExclude)) continue;
+          const filePath = `${dir}/${entry.name}`;
+          const rawContent = await readFile(filePath);
+          const fileHash = await computeContentHash(rawContent);
+          const { data: fm, content: body } = parseFrontmatter(rawContent);
+          const rawRelSegments = subRel.replace(/\.md$/, "").split("/").filter(Boolean);
+          const isReadme = entry.name.toLowerCase() === "readme.md";
+          const isIndex = entry.name.replace(/\.md$/, "") === "index" || entry.name.replace(/\.md$/, "") === "01.index" || isReadme;
+          const groupSegment = rawRelSegments.slice(0, -1).find(isGroupSegment);
+          let groupMeta;
+          if (groupSegment) {
+            const groupOrder = extractOrderPrefix(groupSegment);
+            const defaultGroupTitle = extractGroupTitle(groupSegment);
+            const groupKey = stripOrderPrefix(groupSegment).replace(/^\(|\)$/g, "");
+            const currentDirName = dir.replace(/\\/g, "/").split("/").filter(Boolean).pop();
+            const isGroupDir = currentDirName === groupSegment;
+            groupMeta = {
+              key: groupKey,
+              title: isGroupDir && navMeta.title ? navMeta.title : defaultGroupTitle,
+              icon: isGroupDir && navMeta.icon ? navMeta.icon : void 0,
+              order: groupOrder
+            };
+          }
+          const cleanedRelSegments = rawRelSegments.filter((seg) => !isGroupSegment(seg)).map(stripOrderPrefix).filter(Boolean);
+          if (isIndex && cleanedRelSegments.length > 0) {
+            cleanedRelSegments.pop();
+          }
+          const prefixSegments = (source.normalizedPrefix || "/").split("/").filter(Boolean);
+          const combinedSegments = [...prefixSegments, ...cleanedRelSegments];
+          const entryPath = "/" + combinedSegments.join("/");
+          const defaultCollectionId = prefixSegments[0] || "content";
+          const collectionId = resolveCollectionForPath(
+            entryPath,
+            collectionsConfig,
+            defaultCollectionId
+          );
+          const slug = fm.slug || cleanedRelSegments[cleanedRelSegments.length - 1] || prefixSegments[prefixSegments.length - 1] || "index";
+          const title = fm.title || slug;
+          const srcOrder = typeof source.order === "number" ? source.order : 0;
+          const existingCol = await db.prepare("SELECT id FROM _qarpeo_cms_collections WHERE id = ?").bind(collectionId).first();
+          if (!existingCol) {
+            const colName = collectionId.charAt(0).toUpperCase() + collectionId.slice(1).replace(/-/g, " ");
+            await db.prepare(
+              `INSERT INTO _qarpeo_cms_collections (id, name, description, schema_json, source, "order", created_at, updated_at) VALUES (?, ?, ?, '{}', 'file', ?, ?, ?)`
+            ).bind(
+              collectionId,
+              colName,
+              `Auto-discovered ${colName} collection`,
+              srcOrder,
+              now,
+              now
+            ).run();
+          }
+          const toc = extractTOC(body);
+          const { ast, html: contentHtml } = await processMarkdown(body);
+          const description = fm.description || null;
+          const coverImage = fm.coverImage || fm.cover_image || null;
+          const tags = Array.isArray(fm.tags) ? fm.tags.join(",") : fm.tags || null;
+          const folderNum = rawRelSegments.length > 1 ? extractOrderPrefix(rawRelSegments[0]) : void 0;
+          const effectiveFolderNum = folderNum ?? (typeof currentSectionNavMeta?.order === "number" ? currentSectionNavMeta.order : void 0);
+          const folderOrder = effectiveFolderNum != null ? effectiveFolderNum * 1e3 : 5e4;
+          let subfolderOffset = 0;
+          if (rawRelSegments.length > 2) {
+            const subDir = rawRelSegments[1];
+            const subDirNum = extractOrderPrefix(subDir);
+            const subOrder = subDirNum ?? (typeof groupMeta?.order === "number" ? groupMeta.order : typeof navMeta?.order === "number" ? navMeta.order : void 0);
+            subfolderOffset = 500 + (subOrder != null ? subOrder * 50 : 100);
+          }
+          const fileNum = extractOrderPrefix(entry.name);
+          const itemOrder = typeof fm.order === "number" ? fm.order : isIndex ? 0 : fileNum ?? (subfolderOffset > 0 ? 10 + orderCounter++ : 100 + orderCounter++);
+          const order = srcOrder * 1e5 + folderOrder + subfolderOffset + itemOrder;
+          const itemTitle = fm.navigation?.title || fm.title || slug;
+          const {
+            slug: _s,
+            title: _t,
+            description: _d,
+            coverImage: _ci,
+            tags: _ta,
+            order: _o,
+            ...rest
+          } = fm;
+          void _s;
+          void _t;
+          void _d;
+          void _ci;
+          void _ta;
+          void _o;
+          const effectiveSection = currentSectionNavMeta?.title ? { title: currentSectionNavMeta.title, icon: currentSectionNavMeta.icon } : navMeta.title ? { title: navMeta.title, icon: navMeta.icon } : void 0;
+          const isDraft = Boolean(
+            fm.draft === true || fm.private === true || fm.status === "draft" || navMeta.draft === true || navMeta.private === true
+          );
+          const entryStatus = isDraft ? "draft" : "published";
+          const resolvedRest = { ...rest };
+          try {
+            await resolveReferenceFieldsFromFrontmatter(event, collectionId, resolvedRest);
+          } catch {
+          }
+          const metadataJson = JSON.stringify({
+            ...resolvedRest,
+            navigation: fm.navigation,
+            hidden: fm.hidden,
+            draft: isDraft,
+            _ast: ast,
+            _toc: { links: toc },
+            _nav: navMeta,
+            _section: effectiveSection,
+            _sectionOrder: effectiveFolderNum,
+            _group: groupMeta,
+            _itemTitle: itemTitle,
+            _isIndex: isIndex,
+            _source: source.from || "unknown",
+            _sourceLabel: source.label || source.from || "source",
+            _sourcePriority: source.priority ?? 0,
+            _sourceOrder: source.order ?? srcOrder
+          });
+          const existing = await db.prepare(
+            "SELECT id, source, content_hash, metadata_json, file_path, status FROM _qarpeo_cms_entries WHERE collection_id = ? AND path = ?"
+          ).bind(collectionId, entryPath).first();
+          if (!existing) {
+            const id = nanoid();
+            await db.prepare(
+              `INSERT INTO _qarpeo_cms_entries
+                  (id, collection_id, slug, path, title, description, cover_image, tags, "order", content_md, content_html, metadata_json, status, source, file_path, content_hash, published_at, created_at, updated_at)
+                 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'file', ?, ?, ?, ?, ?)`
+            ).bind(
+              id,
+              collectionId,
+              slug,
+              entryPath,
+              title,
+              description,
+              coverImage,
+              tags,
+              order,
+              body,
+              contentHtml,
+              metadataJson,
+              entryStatus,
+              filePath,
+              fileHash,
+              isDraft ? null : now,
+              now,
+              now
+            ).run();
+            inserted++;
+          } else if (existing.source === "file" && (existing.content_hash !== fileHash || existing.metadata_json !== metadataJson || existing.file_path !== filePath || existing.status !== entryStatus)) {
+            await db.prepare(
+              `UPDATE _qarpeo_cms_entries SET
+                  status = ?, slug = ?, path = ?, title = ?, description = ?, cover_image = ?, tags = ?, "order" = ?,
+                  content_md = ?, content_html = ?, metadata_json = ?,
+                  file_path = ?, content_hash = ?, source = 'file', updated_at = ?
+                 WHERE id = ?`
+            ).bind(
+              entryStatus,
+              slug,
+              entryPath,
+              title,
+              description,
+              coverImage,
+              tags,
+              order,
+              body,
+              contentHtml,
+              metadataJson,
+              filePath,
+              fileHash,
+              now,
+              existing.id
+            ).run();
+            synced++;
+          } else {
+            skipped++;
+          }
+        }
+      }
+    };
+    await processDir(source.resolvedDir, "");
+  }
+  const lowPrioritySources = (sources || []).filter((s) => (s.priority ?? 0) < 10);
+  const highPrioritySources = (sources || []).filter((s) => (s.priority ?? 0) >= 10);
+  for (const src of lowPrioritySources) {
+    await syncSource(src);
+  }
+  const targetCollections = {};
+  for (const [id, cfg] of Object.entries(collectionsConfig)) {
+    targetCollections[id] = {
+      directory: cfg.directory || `${contentDir}/${id}`,
+      name: cfg.name,
+      type: cfg.type || "content",
+      order: typeof cfg.order === "number" ? cfg.order : 0
+    };
+  }
+  const rootMdFiles = [];
+  try {
+    const rootItems = await readdir(contentDir);
+    for (const item of rootItems) {
+      if (item.isDirectory()) {
+        const colId = stripOrderPrefix(item.name).toLowerCase();
+        if (!targetCollections[colId]) {
+          targetCollections[colId] = {
+            directory: `${contentDir}/${item.name}`,
+            name: item.name.charAt(0).toUpperCase() + item.name.slice(1).replace(/-/g, " "),
+            type: "content",
+            order: extractOrderPrefix(item.name) ?? 0
+          };
+        }
+      } else if (item.isFile() && (item.name.endsWith(".md") || item.name.endsWith(".json") || item.name.endsWith(".yml") || item.name.endsWith(".yaml"))) {
+        if (item.name.endsWith(".md")) {
+          rootMdFiles.push(item);
+        } else {
+          const colId = item.name.replace(/\.(json|ya?ml)$/, "").toLowerCase();
+          if (!targetCollections[colId]) {
+            targetCollections[colId] = {
+              directory: `${contentDir}/${item.name}`,
+              name: colId.charAt(0).toUpperCase() + colId.slice(1).replace(/-/g, " "),
+              type: "content",
+              order: 0,
+              isSingleDataFile: true
+            };
+          }
+        }
+      }
+    }
+  } catch {
+    return { synced: 0, skipped: 0, inserted: 0 };
+  }
+  if (rootMdFiles.length > 0 && !targetCollections["content"]) {
+    targetCollections["content"] = {
+      directory: contentDir,
+      name: "Content",
+      type: "page",
+      order: 100
+    };
+  }
+  for (const [collectionId, meta] of Object.entries(targetCollections)) {
+    const isPageType = meta.type === "page";
+    const folderSchema = await readSchemaJson(meta.directory);
+    const initialFields = folderSchema?.fields ? JSON.stringify(folderSchema.fields) : "{}";
+    const existingCol = await db.prepare("SELECT id, source, schema_json FROM _qarpeo_cms_collections WHERE id = ?").bind(collectionId).first();
+    if (!existingCol) {
+      const colName = meta.name || collectionId.charAt(0).toUpperCase() + collectionId.slice(1).replace(/-/g, " ");
+      await db.prepare(
+        `INSERT INTO _qarpeo_cms_collections (id, name, description, schema_json, source, "order", created_at, updated_at) VALUES (?, ?, ?, ?, 'file', ?, ?, ?)`
+      ).bind(
+        collectionId,
+        colName,
+        `Auto-discovered ${colName} collection`,
+        initialFields,
+        meta.order,
+        now,
+        now
+      ).run();
+    } else if (folderSchema?.fields && existingCol.schema_json !== initialFields && existingCol.source === "file") {
+      await db.prepare("UPDATE _qarpeo_cms_collections SET schema_json = ?, updated_at = ? WHERE id = ?").bind(initialFields, now, collectionId).run();
+    }
+    if (meta.isSingleDataFile) {
+      const filePath = meta.directory;
+      let rawContent = "";
+      try {
+        rawContent = await readFile(filePath);
+      } catch {
+        continue;
+      }
+      const fileHash = await computeContentHash(rawContent);
+      let parsed = {};
+      if (filePath.endsWith(".json")) {
+        try {
+          parsed = JSON.parse(rawContent);
+        } catch {
+        }
+      } else {
+        try {
+          const { parse: parseYaml2 } = await import("yaml");
+          parsed = parseYaml2(rawContent) || {};
+        } catch {
+        }
+      }
+      const slug = parsed.slug || collectionId;
+      const title = parsed.title || slug;
+      const description = parsed.description || null;
+      const entryPath = `/${collectionId}`;
+      const metadataJson = JSON.stringify(parsed);
+      const existing = await db.prepare(
+        "SELECT id, source, content_hash, metadata_json, file_path FROM _qarpeo_cms_entries WHERE collection_id = ? AND slug = ?"
+      ).bind(collectionId, slug).first();
+      if (!existing) {
+        const id = nanoid();
+        await db.prepare(
+          `INSERT INTO _qarpeo_cms_entries
+              (id, collection_id, slug, path, title, description, cover_image, tags, "order", content_md, content_html, metadata_json, status, source, file_path, content_hash, published_at, created_at, updated_at)
+             VALUES (?, ?, ?, ?, ?, ?, ?, ?, 0, '', '', ?, 'published', 'file', ?, ?, ?, ?, ?)`
+        ).bind(
+          id,
+          collectionId,
+          slug,
+          entryPath,
+          title,
+          description,
+          null,
+          null,
+          metadataJson,
+          filePath,
+          fileHash,
+          now,
+          now,
+          now
+        ).run();
+        inserted++;
+      } else if (existing.source === "file" && (existing.content_hash !== fileHash || existing.metadata_json !== metadataJson)) {
+        await db.prepare(
+          `UPDATE _qarpeo_cms_entries SET
+              slug = ?, path = ?, title = ?, description = ?,
+              metadata_json = ?, file_path = ?, content_hash = ?, source = 'file', updated_at = ?
+             WHERE id = ?`
+        ).bind(
+          slug,
+          entryPath,
+          title,
+          description,
+          metadataJson,
+          filePath,
+          fileHash,
+          now,
+          existing.id
+        ).run();
+        synced++;
+      } else {
+        skipped++;
+      }
+      continue;
+    }
+    if (isPageType) {
+      let orderCounter = 0;
+      const processDir = async (dir, relBase) => {
+        let entries;
+        try {
+          entries = await readdir(dir);
+        } catch {
+          return;
+        }
+        entries.sort((a, b) => a.name.localeCompare(b.name, void 0, { numeric: true }));
+        for (const entry of entries) {
+          if (entry.name.startsWith(".")) continue;
+          if (entry.isDirectory()) {
+            if (collectionId === "content") continue;
+            await processDir(`${dir}/${entry.name}`, `${relBase}/${entry.name}`);
+          } else if (entry.isFile() && entry.name.endsWith(".md")) {
+            const filePath = `${dir}/${entry.name}`;
+            const rawContent = await readFile(filePath);
+            const fileHash = await computeContentHash(rawContent);
+            const { data: fm, content: body } = parseFrontmatter(rawContent);
+            const relFilePath = `${relBase}/${entry.name}`.replace(/^\//, "");
+            const slug = fm.slug || stripOrderPrefix(entry.name.replace(/\.md$/, ""));
+            const title = fm.title || slug;
+            const navJson = await readNavJson(dir);
+            const navMeta = {
+              title: navJson.title,
+              icon: navJson.icon
+            };
+            const rawRelSegments = relFilePath.replace(/\.md$/, "").split("/").filter(Boolean);
+            const groupSegment = rawRelSegments.slice(0, -1).find(isGroupSegment);
+            let groupMeta;
+            if (groupSegment) {
+              const groupOrder = extractOrderPrefix(groupSegment);
+              const defaultGroupTitle = extractGroupTitle(groupSegment);
+              const groupKey = stripOrderPrefix(groupSegment).replace(/^\(|\)$/g, "");
+              const currentDirName = dir.replace(/\\/g, "/").split("/").filter(Boolean).pop();
+              const isGroupDir = currentDirName === groupSegment;
+              groupMeta = {
+                key: groupKey,
+                title: isGroupDir && navMeta.title ? navMeta.title : defaultGroupTitle,
+                icon: isGroupDir && navMeta.icon ? navMeta.icon : void 0,
+                order: groupOrder
+              };
+            }
+            const entryPath = computeEntryPath(relFilePath, collectionId);
+            const targetCollectionId = resolveCollectionForPath(
+              entryPath,
+              collectionsConfig,
+              collectionId
+            );
+            const toc = extractTOC(body);
+            const { ast, html: contentHtml } = await processMarkdown(body);
+            const description = fm.description || null;
+            const coverImage = fm.coverImage || fm.cover_image || null;
+            const tags = Array.isArray(fm.tags) ? fm.tags.join(",") : fm.tags || null;
+            const order = fm.order ?? orderCounter++;
+            const isIndex = entry.name.replace(/\.md$/, "") === "01.index" || entry.name.replace(/\.md$/, "") === "index";
+            const itemTitle = fm.navigation?.title || fm.title || slug;
+            const {
+              slug: _s,
+              title: _t,
+              description: _d,
+              coverImage: _ci,
+              tags: _ta,
+              order: _o,
+              ...rest
+            } = fm;
+            void _s;
+            void _t;
+            void _d;
+            void _ci;
+            void _ta;
+            void _o;
+            const metadataJson = JSON.stringify({
+              ...rest,
+              _ast: ast,
+              _toc: { links: toc },
+              _nav: navMeta,
+              _section: navMeta.title ? { title: navMeta.title, icon: navMeta.icon } : void 0,
+              _group: groupMeta,
+              _itemTitle: itemTitle,
+              _isIndex: isIndex
+            });
+            const existing = await db.prepare(
+              "SELECT id, source, content_hash, metadata_json, file_path FROM _qarpeo_cms_entries WHERE collection_id = ? AND path = ?"
+            ).bind(targetCollectionId, entryPath).first();
+            if (!existing) {
+              const id = nanoid();
+              await db.prepare(
+                `INSERT INTO _qarpeo_cms_entries
+                    (id, collection_id, slug, path, title, description, cover_image, tags, "order", content_md, content_html, metadata_json, status, source, file_path, content_hash, published_at, created_at, updated_at)
+                   VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'published', 'file', ?, ?, ?, ?, ?)`
+              ).bind(
+                id,
+                targetCollectionId,
+                slug,
+                entryPath,
+                title,
+                description,
+                coverImage,
+                tags,
+                order,
+                body,
+                contentHtml,
+                metadataJson,
+                filePath,
+                fileHash,
+                now,
+                now,
+                now
+              ).run();
+              inserted++;
+            } else if (existing.source === "file" && (existing.content_hash !== fileHash || existing.metadata_json !== metadataJson || existing.file_path !== filePath)) {
+              await db.prepare(
+                `UPDATE _qarpeo_cms_entries SET
+                    slug = ?, path = ?, title = ?, description = ?, cover_image = ?, tags = ?, "order" = ?,
+                    content_md = ?, content_html = ?, metadata_json = ?,
+                    file_path = ?, content_hash = ?, source = 'file', updated_at = ?
+                   WHERE id = ?`
+              ).bind(
+                slug,
+                entryPath,
+                title,
+                description,
+                coverImage,
+                tags,
+                order,
+                body,
+                contentHtml,
+                metadataJson,
+                filePath,
+                fileHash,
+                now,
+                existing.id
+              ).run();
+              synced++;
+            } else {
+              skipped++;
+            }
+          }
+        }
+      };
+      await processDir(meta.directory, "");
+    } else {
+      let entries;
+      try {
+        entries = await readdir(meta.directory);
+      } catch {
+        continue;
+      }
+      for (const entry of entries) {
+        if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
+        const filePath = `${meta.directory}/${entry.name}`;
+        const rawContent = await readFile(filePath);
+        const fileHash = await computeContentHash(rawContent);
+        const { data: fm, content: body } = parseFrontmatter(rawContent);
+        const slug = fm.slug || entry.name.replace(/\.md$/, "");
+        const title = fm.title || slug;
+        const { ast, html: contentHtml } = await processMarkdown(body);
+        const description = fm.description || null;
+        const coverImage = fm.coverImage || fm.cover_image || null;
+        const tags = Array.isArray(fm.tags) ? fm.tags.join(",") : fm.tags || null;
+        const order = fm.order || 0;
+        const {
+          slug: _s,
+          title: _t,
+          description: _d,
+          coverImage: _ci,
+          tags: _ta,
+          order: _o,
+          ...rest
+        } = fm;
+        void _s;
+        void _t;
+        void _d;
+        void _ci;
+        void _ta;
+        void _o;
+        const metadataJson = JSON.stringify({
+          ...rest,
+          _ast: ast,
+          _source: "local",
+          _sourceLabel: "content",
+          _sourcePriority: 10
+        });
+        const existing = await db.prepare(
+          "SELECT id, source, content_hash FROM _qarpeo_cms_entries WHERE collection_id = ? AND slug = ?"
+        ).bind(collectionId, slug).first();
+        if (!existing) {
+          const id = nanoid();
+          await db.prepare(
+            `INSERT INTO _qarpeo_cms_entries
+                (id, collection_id, slug, title, description, cover_image, tags, "order", content_md, content_html, metadata_json, status, source, file_path, content_hash, published_at, created_at, updated_at)
+               VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'published', 'file', ?, ?, ?, ?, ?)`
+          ).bind(
+            id,
+            collectionId,
+            slug,
+            title,
+            description,
+            coverImage,
+            tags,
+            order,
+            body,
+            contentHtml,
+            metadataJson,
+            filePath,
+            fileHash,
+            now,
+            now,
+            now
+          ).run();
+          inserted++;
+        } else if (existing.source === "file" && existing.content_hash !== fileHash) {
+          await db.prepare(
+            `UPDATE _qarpeo_cms_entries SET
+                title = ?, description = ?, cover_image = ?, tags = ?, "order" = ?,
+                content_md = ?, content_html = ?, metadata_json = ?,
+                file_path = ?, content_hash = ?, source = 'file', updated_at = ?
+               WHERE id = ?`
+          ).bind(
+            title,
+            description,
+            coverImage,
+            tags,
+            order,
+            body,
+            contentHtml,
+            metadataJson,
+            filePath,
+            fileHash,
+            now,
+            existing.id
+          ).run();
+          synced++;
+        } else {
+          skipped++;
+        }
+      }
+    }
+  }
+  for (const src of highPrioritySources) {
+    await syncSource(src);
+  }
+  return { synced, skipped, inserted };
+}
+export async function getCMSEntryByPath(event, collectionId, path, locale, options = {}) {
+  await ensureCMSSynced(event);
+  const db = getCMSDb(event);
+  const cleanPath = path.length > 1 && path.endsWith("/") ? path.slice(0, -1) : path;
+  const tenantId = getCMSTenantId(event);
+  const tenantClause = tenantId ? " AND (tenant_id = ? OR tenant_id IS NULL)" : "";
+  let allowDraft = false;
+  const previewCookie = event ? getCookie(event, "qarpeo_preview") : null;
+  let cookieObj = null;
+  if (previewCookie) {
+    try {
+      cookieObj = typeof previewCookie === "string" ? JSON.parse(previewCookie) : previewCookie;
+    } catch {
+    }
+  }
+  const isPreviewRequested = options.preview || Boolean(cookieObj);
+  if (isPreviewRequested) {
+    const auth = await getAuthContext(event).catch(() => null);
+    const config = getCMSConfig(event);
+    if (auth?.user && config.roles.some((r) => r === auth.role || auth.isAdmin)) {
+      allowDraft = true;
+    }
+    if (!allowDraft) {
+      const token = options.previewToken || cookieObj?.token;
+      const expires = options.previewExpires || cookieObj?.expires;
+      if (token && expires) {
+        const candidate = await db.prepare(
+          `SELECT id, slug, collection_id FROM _qarpeo_cms_entries WHERE (collection_id = ? OR ? = 'content') AND (path = ? OR path = ?) ${tenantClause} LIMIT 1`
+        ).bind(collectionId, collectionId, cleanPath, `${cleanPath}/`).first();
+        if (candidate) {
+          allowDraft = await verifyPreviewToken(
+            event,
+            candidate.collection_id,
+            candidate.id,
+            token,
+            expires
+          ) || await verifyPreviewToken(
+            event,
+            candidate.collection_id,
+            candidate.slug,
+            token,
+            expires
+          );
+        }
+      }
+    }
+  }
+  const statusFilter = allowDraft ? "status IN ('draft', 'published', 'scheduled')" : "status = 'published'";
+  const statusOrder = allowDraft ? "CASE WHEN status = 'draft' THEN 1 WHEN status = 'scheduled' THEN 2 ELSE 3 END," : "";
+  let row = null;
+  if (locale) {
+    const bindsLocale = tenantId ? [collectionId, cleanPath, `${cleanPath}/`, locale, tenantId] : [collectionId, cleanPath, `${cleanPath}/`, locale];
+    row = await db.prepare(
+      `SELECT * FROM _qarpeo_cms_entries WHERE collection_id = ? AND (path = ? OR path = ?) AND locale = ? AND ${statusFilter}${tenantClause} ORDER BY ${statusOrder} created_at DESC LIMIT 1`
+    ).bind(...bindsLocale).first();
+  }
+  const binds1 = tenantId ? [collectionId, cleanPath, `${cleanPath}/`, tenantId] : [collectionId, cleanPath, `${cleanPath}/`];
+  if (!row) {
+    row = await db.prepare(
+      `SELECT * FROM _qarpeo_cms_entries WHERE collection_id = ? AND (path = ? OR path = ?) AND ${statusFilter}${tenantClause} ORDER BY ${statusOrder} CASE WHEN locale = 'en' THEN 1 ELSE 2 END LIMIT 1`
+    ).bind(...binds1).first();
+  }
+  if (!row && cleanPath.startsWith(`/${collectionId}`)) {
+    const unPrefixed = cleanPath.slice(`/${collectionId}`.length) || "/";
+    const binds2 = tenantId ? [collectionId, unPrefixed, `${unPrefixed}/`, tenantId] : [collectionId, unPrefixed, `${unPrefixed}/`];
+    row = await db.prepare(
+      `SELECT * FROM _qarpeo_cms_entries WHERE collection_id = ? AND (path = ? OR path = ?) AND ${statusFilter}${tenantClause} ORDER BY ${statusOrder} created_at DESC LIMIT 1`
+    ).bind(...binds2).first();
+  }
+  if (!row) {
+    const binds3 = tenantId ? [cleanPath, `${cleanPath}/`, tenantId] : [cleanPath, `${cleanPath}/`];
+    row = await db.prepare(
+      `SELECT * FROM _qarpeo_cms_entries WHERE (path = ? OR path = ?) AND ${statusFilter}${tenantClause} ORDER BY ${statusOrder} created_at DESC LIMIT 1`
+    ).bind(...binds3).first();
+  }
+  if (!row) return null;
+  const entry = rowToEntry(row);
+  if ((!entry.body || !Array.isArray(entry.body.nodes)) && entry.contentMd) {
+    const ast = await parseMarkdownAST(entry.contentMd);
+    entry.body = {
+      ...ast,
+      value: entry.contentMd,
+      content: entry.contentMd,
+      toc: entry.toc || { links: [] }
+    };
+  }
+  return entry;
+}
+export async function getCMSEntrySurroundings(event, collectionId, path, fields = []) {
+  await ensureCMSSynced(event);
+  const db = getCMSDb(event);
+  const cleanPath = path.length > 1 && path.endsWith("/") ? path.slice(0, -1) : path;
+  const pick = (entry) => {
+    if (!entry) return null;
+    if (!fields.length) return entry;
+    const partial = { id: entry.id, slug: entry.slug, path: entry.path, title: entry.title };
+    for (const f of fields) {
+      if (f in entry) partial[f] = entry[f];
+    }
+    return partial;
+  };
+  try {
+    const navTree = await getCMSNavigationTree(event, collectionId);
+    const orderedPaths = [];
+    const seenPaths = /* @__PURE__ */ new Set();
+    const collectPaths = (items) => {
+      for (const item of items) {
+        if (item.path && item.type !== "group") {
+          const norm = item.path.length > 1 && item.path.endsWith("/") ? item.path.slice(0, -1) : item.path;
+          if (!seenPaths.has(norm)) {
+            seenPaths.add(norm);
+            orderedPaths.push(norm);
+          }
+        }
+        if (item.children?.length) {
+          collectPaths(item.children);
+        }
+      }
+    };
+    collectPaths(navTree);
+    let idx2 = orderedPaths.indexOf(cleanPath);
+    if (idx2 === -1) {
+      idx2 = orderedPaths.indexOf(`${cleanPath}/`);
+    }
+    if (idx2 !== -1) {
+      const prevPath = idx2 > 0 ? orderedPaths[idx2 - 1] : null;
+      const nextPath = idx2 < orderedPaths.length - 1 ? orderedPaths[idx2 + 1] : null;
+      const [prevEntry, nextEntry] = await Promise.all([
+        prevPath ? getCMSEntryByPath(event, collectionId, prevPath) : Promise.resolve(null),
+        nextPath ? getCMSEntryByPath(event, collectionId, nextPath) : Promise.resolve(null)
+      ]);
+      return [pick(prevEntry), pick(nextEntry)];
+    }
+  } catch (err) {
+    console.warn("[qarpeo:cms] getCMSEntrySurroundings navTree lookup failed:", err);
+  }
+  const tenantId = getCMSTenantId(event);
+  const tenantClause = tenantId ? " AND (tenant_id = ? OR tenant_id IS NULL)" : "";
+  const binds = tenantId ? [collectionId, tenantId] : [collectionId];
+  const all = await db.prepare(
+    `SELECT * FROM _qarpeo_cms_entries WHERE collection_id = ? AND status = 'published'${tenantClause} ORDER BY "order" ASC`
+  ).bind(...binds).all();
+  const rows = (all.results || []).map(rowToEntry);
+  const idx = rows.findIndex((e) => e.path === cleanPath || e.path === `${cleanPath}/`);
+  if (idx === -1) return [null, null];
+  return [pick(rows[idx - 1]), pick(rows[idx + 1])];
+}
+function pruneTreeLevels(items, currentLevel, maxLevel) {
+  if (currentLevel >= maxLevel) {
+    for (const item of items) {
+      delete item.children;
+    }
+    return items;
+  }
+  for (const item of items) {
+    if (item.children) {
+      pruneTreeLevels(item.children, currentLevel + 1, maxLevel);
+    }
+  }
+  return items;
+}
+const CMS_FIRST_CLASS_COLUMNS = /* @__PURE__ */ new Set([
+  "id",
+  "slug",
+  "path",
+  "title",
+  "description",
+  "tags",
+  "status",
+  "source"
+]);
+function matchesWhereFilter(row, meta, where) {
+  return Object.entries(where).every(([key, expected]) => {
+    if (CMS_FIRST_CLASS_COLUMNS.has(key)) {
+      const actual2 = row[key] ?? null;
+      return actual2 === expected;
+    }
+    const actual = meta[key] !== void 0 ? meta[key] : null;
+    return actual === expected;
+  });
+}
+export async function getCMSNavigationTree(event, collectionId, options) {
+  await ensureCMSSynced(event);
+  const db = getCMSDb(event);
+  if (collectionId === "content") {
+    const config = getCMSConfig(event);
+    const configuredKeys = Object.keys(config.collections || {});
+    const collections = await listCMSCollections(event);
+    const valid = collections.filter((c) => {
+      if (c.id.startsWith("_") || c.id === "content") return false;
+      const colConf = config.collections?.[c.id];
+      if (colConf && (colConf.navigation === false || colConf.hidden === true)) {
+        return false;
+      }
+      return true;
+    });
+    if (configuredKeys.length) {
+      valid.sort((a, b) => {
+        const ia = configuredKeys.indexOf(a.id);
+        const ib = configuredKeys.indexOf(b.id);
+        if (ia !== -1 && ib !== -1) return ia - ib;
+        if (ia !== -1) return -1;
+        if (ib !== -1) return 1;
+        return (a.order ?? 0) - (b.order ?? 0) || a.name.localeCompare(b.name);
+      });
+    } else {
+      valid.sort((a, b) => (a.order ?? 0) - (b.order ?? 0) || a.name.localeCompare(b.name));
+    }
+    let items = valid.map((c) => ({
+      title: c.name,
+      path: `/${c.id}`
+    }));
+    const targetStatus2 = options?.status || "published";
+    const navRootTenantId = getCMSTenantId(event);
+    let rootSql = `SELECT id, slug, path, title, "order", metadata_json, status FROM _qarpeo_cms_entries WHERE collection_id = 'content'`;
+    const rootBinds = [];
+    if (targetStatus2 !== "all") {
+      rootSql += " AND status = ?";
+      rootBinds.push(targetStatus2);
+    }
+    if (navRootTenantId) {
+      rootSql += " AND (tenant_id = ? OR tenant_id IS NULL)";
+      rootBinds.push(navRootTenantId);
+    }
+    rootSql += ' ORDER BY "order" ASC';
+    const rootEntries = await db.prepare(rootSql).bind(...rootBinds).all();
+    const rows2 = rootEntries.results || [];
+    for (const r of rows2) {
+      let meta = {};
+      try {
+        meta = JSON.parse(r.metadata_json || "{}");
+      } catch {
+      }
+      if (meta.navigation === false || meta.hidden === true || meta.navigation?.hidden === true || meta._nav?.navigation === false || meta._nav?.hidden === true) {
+        continue;
+      }
+      if (options?.where && !matchesWhereFilter(r, meta, options.where)) {
+        continue;
+      }
+      const entryPath = r.path || (r.slug === "index" ? "/" : `/${r.slug}`);
+      const title = meta.navigation?.title || meta._itemTitle || r.title;
+      const icon = meta.navigation?.icon || meta._nav?.icon;
+      items.push({
+        title,
+        path: entryPath,
+        to: entryPath,
+        icon
+      });
+    }
+    if (options?.skip != null || options?.limit != null) {
+      const skip = options?.skip ?? 0;
+      const limit = options?.limit ?? items.length;
+      items = items.slice(skip, skip + limit);
+    }
+    return items;
+  }
+  const targetStatus = options?.status || "published";
+  const navTenantId = getCMSTenantId(event);
+  let sql = 'SELECT id, slug, path, title, "order", metadata_json, status FROM _qarpeo_cms_entries WHERE collection_id = ?';
+  const binds = [collectionId];
+  if (targetStatus !== "all") {
+    sql += " AND status = ?";
+    binds.push(targetStatus);
+  }
+  if (navTenantId) {
+    sql += " AND (tenant_id = ? OR tenant_id IS NULL)";
+    binds.push(navTenantId);
+  }
+  if (options?.locale) {
+    sql += " AND (locale = ? OR locale = 'en' OR locale IS NULL)";
+    binds.push(options.locale);
+  }
+  if (options?.path) {
+    const searchPath = ("/" + options.path.replace(/\\/g, "/").replace(/^\/+/, "")).replace(
+      /\/+$/,
+      ""
+    );
+    sql += " AND (path = ? OR path LIKE ?)";
+    binds.push(searchPath, `${searchPath}/%`);
+  }
+  sql += ' ORDER BY "order" ASC';
+  const all = await db.prepare(sql).bind(...binds).all();
+  const rows = all.results || [];
+  const sectionsMap = /* @__PURE__ */ new Map();
+  for (const r of rows) {
+    let meta = {};
+    try {
+      meta = JSON.parse(r.metadata_json || "{}");
+    } catch {
+    }
+    const sectionMeta = meta._section || {};
+    const isHiddenFromNav = meta.navigation === false || meta.hidden === true || meta.navigation?.hidden === true || meta._nav?.navigation === false || meta._nav?.hidden === true || sectionMeta?.navigation === false || sectionMeta?.hidden === true;
+    if (isHiddenFromNav) {
+      continue;
+    }
+    if (options?.where && !matchesWhereFilter(r, meta, options.where)) {
+      continue;
+    }
+    const entryPath = r.path || `/${collectionId}/${r.slug}`;
+    const segments = entryPath.split("/").filter(Boolean);
+    const sectionPath = segments.length >= 2 ? `/${segments[0]}/${segments[1]}` : entryPath;
+    const defaultSectionTitle = segments.length >= 2 ? segments[1].charAt(0).toUpperCase() + segments[1].slice(1).replace(/-/g, " ") : r.title;
+    if (!sectionsMap.has(sectionPath)) {
+      sectionsMap.set(sectionPath, {
+        title: sectionMeta.title || defaultSectionTitle,
+        path: sectionPath,
+        icon: sectionMeta.icon,
+        children: [],
+        _order: meta._sectionOrder ?? (r.order ? Math.floor(r.order / 1e3) : 500)
+      });
+    }
+    const section = sectionsMap.get(sectionPath);
+    const itemTitle = meta._itemTitle || r.title;
+    if (sectionMeta.title) {
+      section.title = sectionMeta.title;
+      if (sectionMeta.icon) section.icon = sectionMeta.icon;
+    }
+    const isSubFeature = segments.length >= 4 && !meta._isIndex && segments[0] === "docs" && segments[1] === "features";
+    let targetParent = section;
+    if (isSubFeature) {
+      const subFeaturePath = `/${segments[0]}/${segments[1]}/${segments[2]}`;
+      let subFeatureNode = section.children?.find((c) => c.path === subFeaturePath);
+      if (!subFeatureNode) {
+        const subFeatureTitle = segments[2].charAt(0).toUpperCase() + segments[2].slice(1).replace(/-/g, " ");
+        const newNode = {
+          title: subFeatureTitle,
+          path: subFeaturePath,
+          children: []
+        };
+        newNode._groupOrder = 500;
+        section.children = section.children || [];
+        section.children.push(newNode);
+        subFeatureNode = newNode;
+      }
+      if (!subFeatureNode.children) {
+        subFeatureNode.children = [];
+      }
+      targetParent = subFeatureNode;
+    }
+    if (meta._group) {
+      const groupKey = meta._group.key;
+      let groupItem = targetParent.children?.find((c) => c._groupKey === groupKey);
+      if (!groupItem) {
+        groupItem = {
+          title: meta._group.title,
+          icon: meta._group.icon,
+          type: "group",
+          children: [],
+          _groupKey: groupKey,
+          _groupOrder: meta._group.order ?? 999
+        };
+        targetParent.children = targetParent.children || [];
+        targetParent.children.push(groupItem);
+      }
+      const gi = groupItem;
+      gi.children = gi.children || [];
+      gi.children.push({
+        title: itemTitle,
+        path: entryPath,
+        icon: meta.navigation?.icon || meta._nav?.icon
+      });
+      continue;
+    }
+    const minDirectLen = isSubFeature ? 4 : 3;
+    if (segments.length >= minDirectLen) {
+      if (segments.length === minDirectLen) {
+        targetParent.children = targetParent.children || [];
+        if (meta._isIndex && targetParent !== section) {
+          targetParent.title = itemTitle;
+          if (meta.navigation?.icon || meta._nav?.icon) {
+            targetParent.icon = meta.navigation?.icon || meta._nav?.icon;
+          }
+          continue;
+        }
+        targetParent.children.push({
+          title: itemTitle,
+          path: entryPath,
+          icon: meta.navigation?.icon || meta._nav?.icon
+        });
+      } else {
+        const subGroupKey = segments.slice(0, segments.length - 1).join("/");
+        let subGroup = targetParent.children?.find((c) => c._subGroupKey === subGroupKey);
+        if (!subGroup) {
+          const subTitle = meta._nav?.title || sectionMeta.title || segments[segments.length - 2].charAt(0).toUpperCase() + segments[segments.length - 2].slice(1);
+          const subOrder = typeof meta._nav?.order === "number" ? 10 + meta._nav.order : 800;
+          subGroup = {
+            title: subTitle,
+            icon: meta._nav?.icon || sectionMeta.icon,
+            type: "group",
+            children: [],
+            _subGroupKey: subGroupKey,
+            _groupOrder: subOrder
+          };
+          targetParent.children = targetParent.children || [];
+          targetParent.children.push(subGroup);
+        }
+        if (subGroup) {
+          subGroup.children = subGroup.children || [];
+          subGroup.children.push({
+            title: itemTitle,
+            path: entryPath,
+            icon: meta.navigation?.icon || meta._nav?.icon
+          });
+        }
+      }
+    } else {
+      targetParent.children = targetParent.children || [];
+      targetParent.children.unshift({
+        title: itemTitle,
+        path: entryPath,
+        icon: meta.navigation?.icon || meta._nav?.icon
+      });
+    }
+  }
+  function cleanAndSortNode(item) {
+    if (item.path && !item.to) {
+      item.to = item.path;
+    }
+    if (item.children) {
+      item.children.sort((a, b) => {
+        if (a.path === item.path) return -1;
+        if (b.path === item.path) return 1;
+        const orderA = a._groupOrder ?? 500;
+        const orderB = b._groupOrder ?? 500;
+        if (orderA !== orderB) return orderA - orderB;
+        return 0;
+      });
+      for (const c of item.children) {
+        if (c.path && !c.to) {
+          c.to = c.path;
+        }
+        delete c._groupKey;
+        delete c._groupOrder;
+        delete c._subGroupKey;
+        cleanAndSortNode(c);
+      }
+    }
+  }
+  for (const s of sectionsMap.values()) {
+    cleanAndSortNode(s);
+  }
+  const sectionsList = Array.from(sectionsMap.values());
+  sectionsList.sort((a, b) => {
+    const orderA = a._order ?? 500;
+    const orderB = b._order ?? 500;
+    if (orderA !== orderB) return orderA - orderB;
+    return a.title.localeCompare(b.title);
+  });
+  for (const s of sectionsList) {
+    if (s.path && !s.to) {
+      s.to = s.path;
+    }
+    delete s._order;
+  }
+  let result = sectionsList;
+  if (options?.unwrap) {
+    if (result.length === 1 && result[0].children?.length) {
+      result = result[0].children;
+    } else {
+      const collectionRoot = result.find((item) => item.path === `/${collectionId}`);
+      if (collectionRoot?.children?.length) {
+        result = collectionRoot.children;
+      }
+    }
+  }
+  if (options?.path) {
+    const searchPath = ("/" + options.path.replace(/\\/g, "/").replace(/^\/+/, "")).replace(
+      /\/+$/,
+      ""
+    );
+    const matchedSection = sectionsList.find((s) => s.path === searchPath);
+    if (matchedSection && matchedSection.children?.length) {
+      result = matchedSection.children;
+    } else {
+      const findNode = (items) => {
+        for (const item of items) {
+          if (item.path === searchPath) return item;
+          if (item.children) {
+            const found = findNode(item.children);
+            if (found) return found;
+          }
+        }
+      };
+      const deepNode = findNode(sectionsList);
+      if (deepNode) {
+        result = deepNode.children?.length ? deepNode.children : [deepNode];
+      }
+    }
+  }
+  if (options?.levels != null && options.levels > 0) {
+    pruneTreeLevels(result, 1, options.levels);
+  }
+  if (options?.skip != null || options?.limit != null) {
+    const skip = options?.skip ?? 0;
+    const limit = options?.limit ?? result.length;
+    result = result.slice(skip, skip + limit);
+  }
+  return result;
+}
+export function buildFtsQuery(query, operator = "AND") {
+  if (!query) return "";
+  const clean = query.replace(/[^\p{L}\p{N}_\s]/gu, " ").trim();
+  const rawTokens = clean.split(/\s+/).filter(Boolean);
+  if (!rawTokens.length) return "";
+  const reserved = /* @__PURE__ */ new Set(["and", "or", "not", "near"]);
+  const tokens = rawTokens.filter((t) => !reserved.has(t.toLowerCase()));
+  const effectiveTokens = tokens.length > 0 ? tokens : rawTokens;
+  return effectiveTokens.map((t) => `"${t.replace(/"/g, '""')}"*`).join(` ${operator} `);
+}
+export async function rebuildCMSFTS(event) {
+  const db = getCMSDb(event);
+  try {
+    await db.exec("DELETE FROM _qarpeo_cms_entries_fts;");
+    await db.exec(
+      "INSERT INTO _qarpeo_cms_entries_fts(id, slug, title, description, content_md, tags) SELECT id, slug, title, coalesce(description, ''), content_md, coalesce(tags, '') FROM _qarpeo_cms_entries;"
+    );
+    const res = await db.prepare("SELECT COUNT(*) as total FROM _qarpeo_cms_entries_fts").first();
+    return { total: Number(res?.total || 0) };
+  } catch (err) {
+    console.warn("[qarpeo:cms] rebuildCMSFTS failed:", err);
+    return { total: 0 };
+  }
+}
+export async function searchDocs(event, options = {}) {
+  await ensureCMSSynced(event);
+  const db = getCMSDb(event);
+  const q = (options.q || "").trim();
+  if (!q) {
+    return { results: [], total: 0, query: "", mode: "fts" };
+  }
+  const limit = Math.min(100, Math.max(1, options.limit || 20));
+  const locale = options.locale;
+  const tenantId = getCMSTenantId(event);
+  const words = q.toLowerCase().split(/\s+/).filter(Boolean);
+  let rows = [];
+  let modeUsed = "fts";
+  if (options.mode !== "like") {
+    try {
+      const ftsQuery = buildFtsQuery(q, "AND");
+      if (ftsQuery) {
+        let ftsSql = `
+          SELECT e.id, e.collection_id, e.slug, e.path, e.title, e.description, e.content_md, e.metadata_json, e.locale, fts.rank as fts_rank
+          FROM _qarpeo_cms_entries e
+          JOIN _qarpeo_cms_entries_fts fts ON e.id = fts.id
+          WHERE fts MATCH ? AND e.status = 'published'
+        `;
+        const ftsBinds = [ftsQuery];
+        if (tenantId) {
+          ftsSql += " AND (e.tenant_id = ? OR e.tenant_id IS NULL)";
+          ftsBinds.push(tenantId);
+        }
+        if (options.collection) {
+          ftsSql += " AND e.collection_id = ?";
+          ftsBinds.push(options.collection);
+        } else {
+          ftsSql += " AND (e.collection_id = 'docs' OR e.collection_id = 'content' OR e.path LIKE '/docs%' OR e.collection_id LIKE '%doc%')";
+        }
+        if (locale) {
+          ftsSql += " AND (e.locale = ? OR e.locale = 'en')";
+          ftsBinds.push(locale);
+        }
+        if (options.version && options.version !== "all") {
+          if (options.version === "latest") {
+            ftsSql += " AND (e.version = 'latest' OR e.version IS NULL OR e.path NOT LIKE '%/docs/v%')";
+          } else {
+            ftsSql += " AND (e.version = ? OR e.path LIKE ?)";
+            ftsBinds.push(options.version, `%/docs/${options.version}%`);
+          }
+        }
+        ftsSql += " ORDER BY fts.rank LIMIT 50";
+        const res = await db.prepare(ftsSql).bind(...ftsBinds).all();
+        rows = res.results || [];
+        if (rows.length === 0 && words.length > 1) {
+          const ftsOrQuery = buildFtsQuery(q, "OR");
+          if (ftsOrQuery && ftsOrQuery !== ftsQuery) {
+            const orBinds = [...ftsBinds];
+            orBinds[0] = ftsOrQuery;
+            const orRes = await db.prepare(ftsSql).bind(...orBinds).all();
+            rows = orRes.results || [];
+          }
+        }
+      }
+    } catch {
+      rows = [];
+    }
+  }
+  if (rows.length === 0) {
+    modeUsed = "like";
+    const searchPattern = `%${words.join("%")}%`;
+    let sql = `
+      SELECT id, collection_id, slug, path, title, description, content_md, metadata_json, locale
+      FROM _qarpeo_cms_entries
+      WHERE status = 'published'
+    `;
+    const binds = [];
+    if (tenantId) {
+      sql += " AND (tenant_id = ? OR tenant_id IS NULL)";
+      binds.push(tenantId);
+    }
+    if (options.collection) {
+      sql += " AND collection_id = ?";
+      binds.push(options.collection);
+    } else {
+      sql += " AND (collection_id = 'docs' OR collection_id = 'content' OR path LIKE '/docs%' OR collection_id LIKE '%doc%')";
+    }
+    if (locale) {
+      sql += " AND (locale = ? OR locale = 'en')";
+      binds.push(locale);
+    }
+    if (options.version && options.version !== "all") {
+      if (options.version === "latest") {
+        sql += " AND (version = 'latest' OR version IS NULL OR path NOT LIKE '%/docs/v%')";
+      } else {
+        sql += " AND (version = ? OR path LIKE ?)";
+        binds.push(options.version, `%/docs/${options.version}%`);
+      }
+    }
+    sql += " AND (LOWER(title) LIKE ? OR LOWER(description) LIKE ? OR LOWER(content_md) LIKE ? OR LOWER(tags) LIKE ?)";
+    binds.push(searchPattern, searchPattern, searchPattern, searchPattern);
+    sql += " LIMIT 50";
+    const res = await db.prepare(sql).bind(...binds).all();
+    rows = res.results || [];
+  }
+  const sections = [];
+  for (const row of rows) {
+    const pageTitle = row.title || "Documentation";
+    const docPath = row.path || `/${row.collection_id}/${row.slug}`;
+    const md = row.content_md || "";
+    const headingLines = md.split("\n");
+    const rawSections = [];
+    let currentSection = {
+      heading: pageTitle,
+      level: 1,
+      anchor: "",
+      lines: []
+    };
+    rawSections.push(currentSection);
+    for (const line of headingLines) {
+      const match = line.match(/^(#{1,4})\s+(.+)$/);
+      if (match) {
+        const level = match[1].length;
+        const headingText = match[2].trim().replace(/\s*\{#.*\}\s*$/, "");
+        const slugAnchor = headingText.toLowerCase().replace(/[^\w\s-]/g, "").replace(/\s+/g, "-");
+        currentSection = {
+          heading: headingText,
+          level,
+          anchor: `#${slugAnchor}`,
+          lines: []
+        };
+        rawSections.push(currentSection);
+      } else {
+        currentSection.lines.push(line);
+      }
+    }
+    for (const sec of rawSections) {
+      const rawText = sec.lines.join(" ");
+      const cleanContent = rawText.replace(/```[\s\S]*?```/g, " ").replace(/`([^`]+)`/g, "$1").replace(/\[([^\]]+)\]\([^)]+\)/g, "$1").replace(/[*_~#]/g, "").replace(/\s+/g, " ").trim();
+      const textLower = cleanContent.toLowerCase();
+      const headingLower = sec.heading.toLowerCase();
+      const pageTitleLower = pageTitle.toLowerCase();
+      let score = 0;
+      let matchIdx = -1;
+      for (const w of words) {
+        if (headingLower.includes(w)) {
+          score += 15;
+        }
+        if (pageTitleLower.includes(w)) {
+          score += 8;
+        }
+        const idx = textLower.indexOf(w);
+        if (idx !== -1) {
+          score += 5;
+          if (matchIdx === -1 || idx < matchIdx) {
+            matchIdx = idx;
+          }
+        }
+      }
+      if (score === 0 && row.fts_rank !== void 0 && sec === rawSections[0]) {
+        score = 10;
+      }
+      if (score > 0) {
+        let excerpt = "";
+        if (matchIdx !== -1) {
+          const start = Math.max(0, matchIdx - 40);
+          const end = Math.min(cleanContent.length, matchIdx + 110);
+          excerpt = (start > 0 ? "... " : "") + cleanContent.slice(start, end).trim() + (end < cleanContent.length ? " ..." : "");
+        } else {
+          excerpt = cleanContent.slice(0, 140) + (cleanContent.length > 140 ? " ..." : "");
+        }
+        const titles = sec.heading !== pageTitle ? [pageTitle, sec.heading] : [pageTitle];
+        sections.push({
+          id: `${docPath}${sec.anchor}`,
+          path: docPath,
+          title: sec.heading,
+          pageTitle,
+          titles,
+          content: excerpt || row.description || pageTitle,
+          section: sec.anchor || void 0,
+          locale: row.locale || "en",
+          level: sec.level || 1,
+          score
+        });
+      }
+    }
+  }
+  sections.sort((a, b) => b.score - a.score);
+  return {
+    results: sections.slice(0, limit),
+    total: sections.length,
+    query: q,
+    mode: modeUsed
+  };
+}