globalThis.process ??= {};
globalThis.process.env ??= {};
import { l as jsonError } from "./crypto_CY2zBtG3.mjs";
import { n as getFullDb } from "./db_DZJ1iBSP.mjs";
import { at as isFieldValidationError, h as defineFieldGroup, it as isFieldStoreError, nt as isFieldAuthorizationError, rt as isFieldGroupConflictError } from "./dist_C9SfSFSK.mjs";
//#region src/lib/fields.ts
/** Fields db handle — reuses the host full-db client typed to FieldsSchema. */
function getFieldsDb(env) {
	return getFullDb(env).db;
}
/** Generic post-enhancement fields shipped with mod-cms (distro-safe — not platform taxonomy). */
var DEFAULT_CONTENT_FIELD_GROUP = defineFieldGroup({
	key: "content_attrs",
	label: "Attributes",
	location: { entityType: "content" },
	fields: [
		{
			key: "subtitle",
			type: "text",
			label: "Subtitle"
		},
		{
			key: "featured_image",
			type: "media",
			label: "Featured image"
		},
		{
			key: "seo_description",
			type: "textarea",
			label: "SEO description"
		}
	]
});
/** Derive fields capability from role — editors edit values; only admins manage groups. */
function fieldsActorFromPrincipal(principal) {
	const roles = principal.roles ?? [];
	return {
		id: principal.userId,
		canEditFields: roles.includes("admin") || roles.includes("editor"),
		canManageGroups: roles.includes("admin")
	};
}
/**
* Content actor for the §8.1 IDOR gate on field-value writes. Admins may edit any entry's fields;
* editors may edit field values only on entries they author (no canEditAny — unlike general content
* routes where editors can edit all posts).
*/
function contentActorForFields(principal) {
	const roles = principal.roles ?? [];
	return {
		id: principal.userId,
		canEditAny: roles.includes("admin")
	};
}
function fieldErrorMessage(error) {
	if (error instanceof Error) return error.message;
	return "Field request failed.";
}
function mapFieldError(error) {
	if (isFieldAuthorizationError(error)) return jsonError(403, "forbidden", fieldErrorMessage(error));
	if (isFieldValidationError(error)) return jsonError(400, "validation_error", fieldErrorMessage(error));
	if (isFieldGroupConflictError(error)) return jsonError(409, "conflict", fieldErrorMessage(error));
	if (isFieldStoreError(error)) return jsonError(500, "internal_error", fieldErrorMessage(error));
	return jsonError(500, "internal_error", "internal error");
}
//#endregion
export { mapFieldError as a, getFieldsDb as i, contentActorForFields as n, fieldsActorFromPrincipal as r, DEFAULT_CONTENT_FIELD_GROUP as t };
