Class CmsApi

List the immediate children of one node. path is / for a backend root. Reads are gated on the context-derived actor (source → wizard, content → author); throws CmsError('denied') otherwise.

Takes no actor argument by design — the acting principal is resolved from the execution context (getActingAuthor), never from a caller-supplied value, so a privileged-Avatar reference can't be substituted for the gate's subject.

Read the editable body of one leaf. Content → pretty-printed JSON of template.data + templateMeta; source → raw file bytes + a language hint. Read-gated on the context-derived actor. Throws CmsError('not-found') / ('invalid') for missing/folder targets; lets SourceTreeSandboxError propagate.

Lightweight existence/kind probe (no body); read-gated.

Author one leaf — save-is-authoritative. The acting principal is derived from context (never passed); gates verbatim from WriteController (source → wizard, content → write-permission), persists, then runs the per-backend go-live step. Throws CmsError('denied') on access denial, ('not-found') for an absent content template, ('invalid') for malformed JSON; lets SourceTreeSandboxError propagate.