@manablox/db 0.2.0 → 0.4.0

package/dist/repositories-pz4NeWaF.js

@@ -0,0 +1,1928 @@
+import { A as assetUsages, D as users, E as sessions, F as publishedContents, I as spaces, M as assets, N as contentVersions, P as contents, R as idToLabel, S as accounts, T as roles, _ as contentApprovals, a as webhookDeliveries, b as menus, i as workflows, j as assetVariants, k as auditEntries, n as pushSubscriptions, o as webhooks, r as workflowRuns, t as schema_exports, v as notifications, w as memberships, x as contentTypes, y as menuItems } from "./schema-Dm3RcBst.js";
+import { drizzle } from "drizzle-orm/postgres-js";
+import postgres from "postgres";
+import { and, asc, desc, eq, getTableColumns, gt, gte, ilike, inArray, isNull, lt, lte, notInArray, or, sql } from "drizzle-orm";
+import { ManabloxError, currentActor, defineContentType, hashAuditEntry } from "@manablox/core";
+import { randomUUID } from "node:crypto";
+//#region src/bootstrap.ts
+/**
+* Extensions the schema depends on. Run before the generated migrations, which
+* reference `ltree` columns and `pg_trgm` operator classes.
+*/
+async function applyBootstrapSql(sql) {
+	await sql.unsafe(`
+    create extension if not exists "ltree";
+    create extension if not exists "pg_trgm";
+    create extension if not exists "btree_gin";
+  `);
+}
+//#endregion
+//#region src/client.ts
+function createDatabase(config, options = {}) {
+	const sql = postgres(config.url, {
+		max: config.max ?? 10,
+		...options.onQuery ? { debug: (_c, query) => options.onQuery?.(query) } : {},
+		...config.ssl ? { ssl: "require" } : {},
+		onnotice: () => {}
+	});
+	return {
+		db: drizzle(sql, {
+			schema: schema_exports,
+			casing: "snake_case"
+		}),
+		sql,
+		close: () => sql.end({ timeout: 5 })
+	};
+}
+//#endregion
+//#region src/pagination.ts
+/**
+* One page of a table plus the total, in one round trip: a window `count(*) over ()`
+* rides along with the rows. A page past the end comes back empty and so carries no
+* count; only then is the total asked for separately, so a caller paging by `total`
+* still learns the true size.
+*/
+async function paginate(db, table, options) {
+	const orderBy = Array.isArray(options.orderBy) ? options.orderBy : [options.orderBy];
+	const rows = await db.select({
+		...getTableColumns(table),
+		total: sql`count(*) over ()::int`
+	}).from(table).where(options.where).orderBy(...orderBy).limit(options.pagination.limit).offset(options.pagination.offset);
+	let total = rows[0]?.total ?? 0;
+	if (rows.length === 0 && options.pagination.offset > 0) total = (await db.select({ count: sql`count(*)::int` }).from(table).where(options.where))[0]?.count ?? 0;
+	return {
+		items: rows.map(({ total: _total, ...row }) => row),
+		total,
+		limit: options.pagination.limit,
+		offset: options.pagination.offset
+	};
+}
+//#endregion
+//#region src/query.ts
+const SORT_COLUMNS$1 = {
+	position: "position",
+	title: "title",
+	createdAt: "created_at",
+	updatedAt: "updated_at",
+	publishedAt: "published_at",
+	slug: "slug"
+};
+/**
+* Translates a filter into SQL. Every field predicate is checked against the field
+* type's declared `filters` list first: an unsupported operator is a 400, and every
+* supported one has an index behind it.
+*/
+function buildContentWhere(table, filter, registry) {
+	const conditions = [];
+	if (filter.spaceId) conditions.push(eq(table.spaceId, filter.spaceId));
+	if (filter.locale) conditions.push(eq(table.locale, filter.locale));
+	if (filter.status) conditions.push(eq(table.status, filter.status));
+	if (filter.localizationId) conditions.push(eq(table.localizationId, filter.localizationId));
+	if (filter.slug) conditions.push(eq(table.slug, filter.slug));
+	if (filter.permalink !== void 0) conditions.push(eq(table.permalink, filter.permalink));
+	if (filter.typeIds?.length) conditions.push(inArray(table.typeId, filter.typeIds));
+	if (filter.ids?.length) conditions.push(inArray(table.id, filter.ids));
+	if (filter.parentId !== void 0) conditions.push(filter.parentId === null ? isNull(table.parentId) : eq(table.parentId, filter.parentId));
+	if (filter.under) conditions.push(sql`${table.path} <@ (select path from ${table} where id = ${filter.under}::uuid)`);
+	if (filter.search) conditions.push(sql`${table.search} @@ websearch_to_tsquery('simple', ${filter.search})`);
+	for (const fieldFilter of filter.fields ?? []) conditions.push(buildFieldCondition(table, fieldFilter, filter.typeIds ?? [], registry));
+	return conditions.length > 0 ? and(...conditions) : void 0;
+}
+function buildFieldCondition(table, filter, typeIds, registry) {
+	assertOperatorAllowed(filter, typeIds, registry);
+	const path = sql`${table.fields} -> ${filter.name}`;
+	const text = sql`${table.fields} ->> ${filter.name}`;
+	switch (filter.op) {
+		case "eq": return sql`${table.fields} @> jsonb_build_object(${filter.name}::text, ${JSON.stringify(filter.value ?? null)}::jsonb)`;
+		case "neq": return sql`not (${table.fields} @> jsonb_build_object(${filter.name}::text, ${JSON.stringify(filter.value ?? null)}::jsonb))`;
+		case "in": return sql`${text} = any(${sql.param(asStringArray(filter.value))}::text[])`;
+		case "notIn": return sql`${text} <> all(${sql.param(asStringArray(filter.value))}::text[])`;
+		case "lt": return sql`(${text})::numeric < ${asNumber(filter.value)}`;
+		case "lte": return sql`(${text})::numeric <= ${asNumber(filter.value)}`;
+		case "gt": return sql`(${text})::numeric > ${asNumber(filter.value)}`;
+		case "gte": return sql`(${text})::numeric >= ${asNumber(filter.value)}`;
+		case "contains": return sql`${text} ilike ${`%${escapeLike$1(String(filter.value ?? ""))}%`}`;
+		case "startsWith": return sql`${text} ilike ${`${escapeLike$1(String(filter.value ?? ""))}%`}`;
+		case "endsWith": return sql`${text} ilike ${`%${escapeLike$1(String(filter.value ?? ""))}`}`;
+		case "isNull": return sql`(${path} is null or ${path} = 'null'::jsonb)`;
+		case "isNotNull": return sql`(${path} is not null and ${path} <> 'null'::jsonb)`;
+		default: {
+			const exhaustive = filter.op;
+			throw ManabloxError.badRequest("query.operator.unsupported", { op: exhaustive });
+		}
+	}
+}
+/**
+* A field predicate is only accepted when *every* candidate content type declares a
+* field of that name whose field type supports the operator.
+*/
+function assertOperatorAllowed(filter, typeIds, registry) {
+	const matching = (typeIds.length > 0 ? typeIds.map((id) => registry.get(id)) : registry.contentTypes).map((type) => type.fields.find((field) => field.name === filter.name)).filter((field) => field !== void 0);
+	if (matching.length === 0) throw ManabloxError.badRequest("query.field.unknown", { field: filter.name });
+	for (const field of matching) if (!registry.fieldTypes.tryGet(field.type)?.filters.includes(filter.op)) throw ManabloxError.badRequest("query.operator.unsupported", {
+		field: filter.name,
+		fieldType: field.type,
+		op: filter.op
+	});
+}
+function buildOrderBy(sorts) {
+	if (sorts.length === 0) return sql`${sql.identifier("position")} asc, ${sql.identifier("created_at")} asc`;
+	return sorts.map((sort) => {
+		const column = SORT_COLUMNS$1[sort.by];
+		if (!column) throw ManabloxError.badRequest("query.sort.unsupported", { by: sort.by });
+		return sql`${sql.identifier(column)} ${sql.raw(sort.direction === "desc" ? "desc" : "asc")}`;
+	}).reduce((acc, part) => sql`${acc}, ${part}`);
+}
+const escapeLike$1 = (value) => value.replace(/[%_\\]/g, (c) => `\\${c}`);
+function asStringArray(value) {
+	if (!Array.isArray(value)) throw ManabloxError.badRequest("query.value.expectedArray");
+	return value.map((entry) => String(entry));
+}
+function asNumber(value) {
+	const parsed = Number(value);
+	if (Number.isNaN(parsed)) throw ManabloxError.badRequest("query.value.expectedNumber");
+	return parsed;
+}
+//#endregion
+//#region src/repositories/asset.ts
+var AssetRepository = class {
+	db;
+	constructor(db) {
+		this.db = db;
+	}
+	async findById(id) {
+		return (await this.db.select().from(assets).where(eq(assets.id, id)).limit(1))[0] ?? null;
+	}
+	/**
+	* `spaceId` is not an optimisation. On the public instance an asset id is the only
+	* thing a caller supplies, and without this predicate any id resolves — including one
+	* belonging to another tenant sharing the process.
+	*/
+	async findManyByIds(ids, spaceId) {
+		if (ids.length === 0) return [];
+		const where = spaceId ? and(inArray(assets.id, ids), eq(assets.spaceId, spaceId)) : inArray(assets.id, ids);
+		return this.db.select().from(assets).where(where);
+	}
+	async findByChecksum(spaceId, checksum) {
+		return (await this.db.select().from(assets).where(and(eq(assets.spaceId, spaceId), eq(assets.checksum, checksum))).limit(1))[0] ?? null;
+	}
+	async list(filter, pagination) {
+		const conditions = [eq(assets.spaceId, filter.spaceId)];
+		if (filter.mimeType) conditions.push(sql`${assets.mimeType} like ${`${filter.mimeType}%`}`);
+		if (filter.search) conditions.push(sql`(${assets.name} ilike ${`%${filter.search}%`} or ${assets.filename} ilike ${`%${filter.search}%`})`);
+		return paginate(this.db, assets, {
+			where: and(...conditions),
+			orderBy: desc(assets.createdAt),
+			pagination
+		});
+	}
+	async create(data) {
+		const [row] = await this.db.insert(assets).values({
+			...data.id ? { id: data.id } : {},
+			spaceId: data.spaceId,
+			driver: data.driver,
+			key: data.key,
+			filename: data.filename,
+			name: data.name,
+			mimeType: data.mimeType,
+			size: data.size,
+			width: data.width ?? null,
+			height: data.height ?? null,
+			duration: data.duration ?? null,
+			checksum: data.checksum ?? null,
+			alt: data.alt ?? null,
+			title: data.title ?? null,
+			meta: data.meta ?? {},
+			createdBy: data.actorId ?? null
+		}).returning();
+		if (!row) throw new ManabloxError("asset.create.failed");
+		return row;
+	}
+	async update(id, data) {
+		const [row] = await this.db.update(assets).set({
+			...data,
+			updatedAt: /* @__PURE__ */ new Date()
+		}).where(eq(assets.id, id)).returning();
+		if (!row) throw ManabloxError.notFound("asset.notFound", { id });
+		return row;
+	}
+	async delete(id) {
+		const [row] = await this.db.delete(assets).where(eq(assets.id, id)).returning();
+		return row ?? null;
+	}
+	/** Timestamps an import carries over; `create()` can only stamp the moment of import. */
+	async restoreTimestamps(id, createdAt, updatedAt) {
+		await this.db.update(assets).set({
+			createdAt,
+			updatedAt
+		}).where(eq(assets.id, id));
+	}
+	async variants(assetIds) {
+		if (assetIds.length === 0) return [];
+		return this.db.select().from(assetVariants).where(inArray(assetVariants.assetId, assetIds));
+	}
+	async findVariant(assetId, preset, format) {
+		return (await this.db.select().from(assetVariants).where(and(eq(assetVariants.assetId, assetId), eq(assetVariants.preset, preset), eq(assetVariants.format, format))).limit(1))[0] ?? null;
+	}
+	/** Drops every variant row; the caller removes the files. */
+	async deleteVariants(assetId) {
+		await this.db.delete(assetVariants).where(eq(assetVariants.assetId, assetId));
+	}
+	async addVariant(data) {
+		const [row] = await this.db.insert(assetVariants).values({
+			assetId: data.assetId,
+			preset: data.preset,
+			format: data.format,
+			key: data.key,
+			width: data.width ?? null,
+			height: data.height ?? null,
+			size: data.size
+		}).onConflictDoUpdate({
+			target: [
+				assetVariants.assetId,
+				assetVariants.preset,
+				assetVariants.format
+			],
+			set: {
+				key: data.key,
+				size: data.size
+			}
+		}).returning();
+		if (!row) throw new ManabloxError("assetVariant.create.failed");
+		return row;
+	}
+};
+//#endregion
+//#region src/repositories/asset-usage.ts
+/**
+* The asset → document reachability index.
+*
+* `published` tracks the *published projection*, not the draft: a draft that adds an
+* image does not make that image public, and a draft that removes one does not make it
+* private until the change is published. Every method below preserves that distinction,
+* which is why the column exists rather than the table simply holding published rows.
+*/
+var AssetUsageRepository = class {
+	db;
+	constructor(db) {
+		this.db = db;
+	}
+	/** The subset of `assetIds` reachable from at least one published document. */
+	async filterPublished(assetIds) {
+		if (assetIds.length === 0) return /* @__PURE__ */ new Set();
+		const rows = await this.db.selectDistinct({ assetId: assetUsages.assetId }).from(assetUsages).where(and(inArray(assetUsages.assetId, assetIds), eq(assetUsages.published, true)));
+		return new Set(rows.map((row) => row.assetId));
+	}
+	async forContent(contentId) {
+		return this.db.select({
+			assetId: assetUsages.assetId,
+			published: assetUsages.published
+		}).from(assetUsages).where(eq(assetUsages.contentId, contentId));
+	}
+	/**
+	* Records what a *draft* references.
+	*
+	* Rows the draft dropped are removed only if they are not currently published —
+	* otherwise editing a draft would silently revoke access to an image the live page is
+	* still showing.
+	*/
+	async recordDraft(contentId, spaceId, assetIds) {
+		const unique = [...new Set(assetIds)];
+		await this.db.transaction(async (tx) => {
+			await tx.delete(assetUsages).where(and(eq(assetUsages.contentId, contentId), eq(assetUsages.published, false), ...unique.length > 0 ? [notInArray(assetUsages.assetId, unique)] : []));
+			if (unique.length === 0) return;
+			await tx.insert(assetUsages).values(unique.map((assetId) => ({
+				assetId,
+				contentId,
+				spaceId,
+				published: false,
+				updatedAt: /* @__PURE__ */ new Date()
+			}))).onConflictDoNothing();
+		});
+	}
+	/**
+	* Records what the published projection references.
+	*
+	* Assets the new revision no longer uses lose their published flag but keep their row
+	* when the draft still references them, so the admin's "where is this used" view stays
+	* complete.
+	*/
+	async recordPublished(contentId, spaceId, assetIds) {
+		const unique = [...new Set(assetIds)];
+		await this.db.transaction(async (tx) => {
+			await tx.update(assetUsages).set({
+				published: false,
+				updatedAt: /* @__PURE__ */ new Date()
+			}).where(and(eq(assetUsages.contentId, contentId), ...unique.length > 0 ? [notInArray(assetUsages.assetId, unique)] : []));
+			if (unique.length === 0) return;
+			await tx.insert(assetUsages).values(unique.map((assetId) => ({
+				assetId,
+				contentId,
+				spaceId,
+				published: true,
+				updatedAt: /* @__PURE__ */ new Date()
+			}))).onConflictDoUpdate({
+				target: [assetUsages.assetId, assetUsages.contentId],
+				set: {
+					published: true,
+					updatedAt: /* @__PURE__ */ new Date()
+				}
+			});
+		});
+	}
+	/** Unpublishing revokes every asset this document was keeping public. */
+	async clearPublished(contentId) {
+		await this.db.update(assetUsages).set({
+			published: false,
+			updatedAt: /* @__PURE__ */ new Date()
+		}).where(eq(assetUsages.contentId, contentId));
+	}
+	async deleteForContent(contentId) {
+		await this.db.delete(assetUsages).where(eq(assetUsages.contentId, contentId));
+	}
+	async count() {
+		return (await this.db.select({ count: sql`count(*)::int` }).from(assetUsages))[0]?.count ?? 0;
+	}
+	/**
+	* Every document with its draft and published field values, for the backfill.
+	*
+	* References are derived from field-type definitions rather than stored, so the
+	* backfill cannot be a SQL migration — it has to run inside the application.
+	*/
+	async backfillSource() {
+		return (await this.db.select({
+			id: contents.id,
+			spaceId: contents.spaceId,
+			typeId: contents.typeId,
+			draftFields: contents.fields,
+			publishedFields: publishedContents.fields
+		}).from(contents).leftJoin(publishedContents, eq(publishedContents.id, contents.id))).map((row) => ({
+			id: row.id,
+			spaceId: row.spaceId,
+			typeId: row.typeId,
+			draftFields: row.draftFields,
+			publishedFields: row.publishedFields ?? null
+		}));
+	}
+};
+//#endregion
+//#region src/repositories/audit.ts
+const SORT_COLUMNS = {
+	at: auditEntries.at,
+	action: auditEntries.action,
+	actorLabel: auditEntries.actorLabel,
+	targetKind: auditEntries.targetKind,
+	targetLabel: auditEntries.targetLabel
+};
+const escapeLike = (value) => value.replace(/[%_\\]/g, (c) => `\\${c}`);
+/**
+* Appends to and reads the audit log. There is no update and no delete: the table
+* refuses both, so this class offers neither.
+*/
+var AuditRepository = class {
+	db;
+	options;
+	constructor(db, options = {}) {
+		this.db = db;
+		this.options = options;
+	}
+	/**
+	* Writes one entry, chained to the last. Writers are serialised on a transaction-level
+	* advisory lock, so two entries can never both claim the same predecessor; the lock
+	* is held for one read and one insert.
+	*/
+	async append(input) {
+		const row = await this.write(input);
+		if (this.options.onAppended) try {
+			this.options.onAppended(row);
+		} catch (error) {
+			this.options.onError?.(error, input);
+		}
+		return row;
+	}
+	async write(input) {
+		const actor = input.actor ?? currentActor();
+		const at = input.at ?? /* @__PURE__ */ new Date();
+		const changes = input.changes ?? [];
+		const meta = input.meta ?? null;
+		const actorDetail = actor.detail ?? null;
+		return this.db.transaction(async (tx) => {
+			await tx.execute(sql`select pg_advisory_xact_lock(hashtext('audit_entries'))`);
+			const [last] = await tx.select({ hash: auditEntries.hash }).from(auditEntries).orderBy(desc(auditEntries.seq)).limit(1);
+			const prevHash = last?.hash ?? null;
+			const content = {
+				at,
+				spaceId: input.spaceId ?? null,
+				actorKind: actor.kind,
+				actorId: actor.id,
+				actorLabel: actor.label,
+				actorDetail,
+				action: input.action,
+				targetKind: input.targetKind,
+				targetId: input.targetId ?? null,
+				targetLabel: input.targetLabel ?? null,
+				changes,
+				meta,
+				prevHash
+			};
+			const [row] = await tx.insert(auditEntries).values({
+				...content,
+				hash: hashAuditEntry(content)
+			}).returning();
+			if (!row) throw new ManabloxError("audit.append.failed");
+			return row;
+		});
+	}
+	/**
+	* `append` that never throws. The write it describes has already happened; failing
+	* the request now would report an error for something that succeeded, so the failure
+	* is reported to `onError` (the host logs it) and the caller carries on.
+	*/
+	async record(input) {
+		try {
+			return await this.append(input);
+		} catch (error) {
+			this.options.onError?.(error, input);
+			return null;
+		}
+	}
+	async findById(id) {
+		return (await this.db.select().from(auditEntries).where(eq(auditEntries.id, id)).limit(1))[0] ?? null;
+	}
+	list(filter, sort = {
+		by: "at",
+		direction: "desc"
+	}, pagination = {
+		limit: 50,
+		offset: 0
+	}) {
+		const column = SORT_COLUMNS[sort.by];
+		const primary = sort.direction === "asc" ? asc(column) : desc(column);
+		const tiebreak = sort.direction === "asc" ? asc(auditEntries.seq) : desc(auditEntries.seq);
+		return paginate(this.db, auditEntries, {
+			where: buildWhere(filter),
+			orderBy: [primary, tiebreak],
+			pagination
+		});
+	}
+	/** The entries about one thing, oldest first: a document's history. */
+	forTarget(targetKind, targetId, limit = 100) {
+		return this.db.select().from(auditEntries).where(and(eq(auditEntries.targetKind, targetKind), eq(auditEntries.targetId, targetId))).orderBy(desc(auditEntries.seq)).limit(limit);
+	}
+	/**
+	* Recomputes every hash from the first entry on and checks each link to its
+	* predecessor. The chain is one across the instance, so this walks all of it, in
+	* batches; on a large log it takes a while and that is the point.
+	*/
+	async verify(batchSize = 500) {
+		let prevHash = null;
+		let afterSeq = 0;
+		let checked = 0;
+		for (;;) {
+			const rows = await this.db.select().from(auditEntries).where(gt(auditEntries.seq, afterSeq)).orderBy(asc(auditEntries.seq)).limit(batchSize);
+			if (rows.length === 0) break;
+			for (const row of rows) {
+				checked++;
+				if (row.prevHash !== prevHash) return {
+					ok: false,
+					checked,
+					brokenAt: {
+						seq: row.seq,
+						id: row.id,
+						reason: "link"
+					}
+				};
+				if (hashAuditEntry({
+					at: row.at,
+					spaceId: row.spaceId,
+					actorKind: row.actorKind,
+					actorId: row.actorId,
+					actorLabel: row.actorLabel,
+					actorDetail: row.actorDetail,
+					action: row.action,
+					targetKind: row.targetKind,
+					targetId: row.targetId,
+					targetLabel: row.targetLabel,
+					changes: row.changes,
+					meta: row.meta,
+					prevHash: row.prevHash
+				}) !== row.hash) return {
+					ok: false,
+					checked,
+					brokenAt: {
+						seq: row.seq,
+						id: row.id,
+						reason: "hash"
+					}
+				};
+				prevHash = row.hash;
+				afterSeq = row.seq;
+			}
+		}
+		return {
+			ok: true,
+			checked,
+			brokenAt: null
+		};
+	}
+	async count(filter = {}) {
+		const [row] = await this.db.select({ count: sql`count(*)::int` }).from(auditEntries).where(buildWhere(filter));
+		return row?.count ?? 0;
+	}
+};
+function buildWhere(filter) {
+	const conditions = [];
+	if (filter.spaceId === null) conditions.push(isNull(auditEntries.spaceId));
+	else if (filter.spaceId) conditions.push(eq(auditEntries.spaceId, filter.spaceId));
+	if (filter.actorKind) conditions.push(eq(auditEntries.actorKind, filter.actorKind));
+	if (filter.actorId) conditions.push(eq(auditEntries.actorId, filter.actorId));
+	if (filter.actions?.length) conditions.push(inArray(auditEntries.action, filter.actions));
+	if (filter.targetKind) conditions.push(eq(auditEntries.targetKind, filter.targetKind));
+	if (filter.targetId) conditions.push(eq(auditEntries.targetId, filter.targetId));
+	if (filter.from) conditions.push(gte(auditEntries.at, filter.from));
+	if (filter.to) conditions.push(lte(auditEntries.at, filter.to));
+	if (filter.search?.trim()) {
+		const term = `%${escapeLike(filter.search.trim())}%`;
+		const match = or(ilike(auditEntries.actorLabel, term), ilike(auditEntries.targetLabel, term), ilike(auditEntries.action, term));
+		if (match) conditions.push(match);
+	}
+	return conditions.length ? and(...conditions) : void 0;
+}
+//#endregion
+//#region src/repositories/content.ts
+/**
+* The columns `publish()` copies from the draft into the projection: every column the
+* two tables share, in the projection's order, derived from the schema so a new column
+* cannot be forgotten on one side. `source_version` exists only on the projection and
+* is filled from `version`.
+*/
+const PROJECTION_COLUMNS = (() => {
+	const columnNames = (table) => Object.values(getTableColumns(table)).filter((column) => column.generated === void 0).map((column) => column.name.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`));
+	const draft = new Set(columnNames(contents));
+	return columnNames(publishedContents).filter((name) => draft.has(name) || name === "source_version");
+})();
+/** Columns that identify the row and are never rewritten on a republish. */
+const PROJECTION_IDENTITY = /* @__PURE__ */ new Set([
+	"id",
+	"space_id",
+	"localization_id",
+	"created_at",
+	"created_by"
+]);
+var ContentRepository = class {
+	db;
+	registry;
+	constructor(db, registry) {
+		this.db = db;
+		this.registry = registry;
+	}
+	async findById(id, published = false) {
+		const table = published ? publishedContents : contents;
+		return (await this.db.select().from(table).where(eq(table.id, id)).limit(1))[0] ?? null;
+	}
+	/**
+	* `spaceId` bounds a lookup by id to one tenant.
+	*
+	* The delivery API takes ids straight from the caller, so without it a public instance
+	* pinned to one space still answers for any other space's published documents.
+	*/
+	async findManyByIds(ids, published = false, spaceId) {
+		if (ids.length === 0) return [];
+		const table = published ? publishedContents : contents;
+		const where = spaceId ? and(inArray(table.id, ids), eq(table.spaceId, spaceId)) : inArray(table.id, ids);
+		return this.db.select().from(table).where(where);
+	}
+	/** Children of many parents in one query, for the tree loader. */
+	async findChildrenOf(parentIds, published = false, spaceId) {
+		if (parentIds.length === 0) return [];
+		const table = published ? publishedContents : contents;
+		const where = spaceId ? and(inArray(table.parentId, parentIds), eq(table.spaceId, spaceId)) : inArray(table.parentId, parentIds);
+		return this.db.select().from(table).where(where).orderBy(sql`${table.position} asc, ${table.title} asc`);
+	}
+	async findByPermalink(spaceId, locale, permalink, published = true) {
+		if (permalink === "") return this.findHome(spaceId, locale, published);
+		const table = published ? publishedContents : contents;
+		return (await this.db.select().from(table).where(and(eq(table.spaceId, spaceId), eq(table.locale, locale), eq(table.permalink, permalink))).limit(1))[0] ?? null;
+	}
+	/**
+	* The document a space nominates as its home, in one locale.
+	*
+	* `settings.homeContentId` names a single row, which belongs to one locale. Every
+	* translation of that document shares its `localizationId`, so the requested locale is
+	* resolved through that rather than by pinning one row per language.
+	*/
+	async findHome(spaceId, locale, published = true) {
+		const [space] = await this.db.select({ settings: spaces.settings }).from(spaces).where(eq(spaces.id, spaceId)).limit(1);
+		const homeId = space?.settings?.homeContentId;
+		if (typeof homeId !== "string") return null;
+		const [nominated] = await this.db.select({ localizationId: contents.localizationId }).from(contents).where(and(eq(contents.id, homeId), eq(contents.spaceId, spaceId))).limit(1);
+		if (!nominated) return null;
+		const table = published ? publishedContents : contents;
+		return (await this.db.select().from(table).where(and(eq(table.spaceId, spaceId), eq(table.locale, locale), eq(table.localizationId, nominated.localizationId))).limit(1))[0] ?? null;
+	}
+	/**
+	* Every other row in a document's localization group — its translations.
+	*/
+	/**
+	* One document per localization group, for checking that several groups exist in a
+	* space at once — a menu's entries, say. The locale returned is whichever sorts first;
+	* a caller that needs a particular one asks `localizationSiblings` for that group.
+	*/
+	async findByLocalizationIds(spaceId, localizationIds) {
+		if (localizationIds.length === 0) return [];
+		const rows = await this.db.select().from(contents).where(and(eq(contents.spaceId, spaceId), inArray(contents.localizationId, localizationIds))).orderBy(contents.localizationId, contents.locale);
+		const seen = /* @__PURE__ */ new Set();
+		return rows.filter((row) => {
+			if (seen.has(row.localizationId)) return false;
+			seen.add(row.localizationId);
+			return true;
+		});
+	}
+	async localizationSiblings(spaceId, localizationId, excludeId) {
+		const all = await this.db.select().from(contents).where(and(eq(contents.spaceId, spaceId), eq(contents.localizationId, localizationId)));
+		return excludeId ? all.filter((row) => row.id !== excludeId) : all;
+	}
+	/**
+	* Merges a few field values into rows without touching the rest of the document.
+	*
+	* Used to carry a non-localized field across a document's translations: a jsonb `||`
+	* so concurrent edits to *other* fields on those rows are not clobbered.
+	*/
+	async patchFields(ids, patch) {
+		if (ids.length === 0 || Object.keys(patch).length === 0) return;
+		await this.db.update(contents).set({
+			fields: sql`${contents.fields} || ${JSON.stringify(patch)}::jsonb`,
+			updatedAt: /* @__PURE__ */ new Date()
+		}).where(inArray(contents.id, ids));
+	}
+	async list(filter, pagination, sorts = [], published = false) {
+		const table = published ? publishedContents : contents;
+		const where = buildContentWhere(table, filter, this.registry);
+		return await paginate(this.db, table, {
+			where,
+			orderBy: buildOrderBy(sorts),
+			pagination
+		});
+	}
+	/**
+	* The whole tree below `rootId` in **one** query: a GiST-indexed `path <@ root`
+	* returns every descendant, and `nlevel()` gives the depth to rebuild the hierarchy.
+	*/
+	async tree(spaceId, locale, rootId = null, maxDepth = 32, published = false) {
+		const table = published ? publishedContents : contents;
+		const scope = rootId ? sql`and ${table.path} <@ (select path from ${table} where id = ${rootId}::uuid)
+             and ${table.id} <> ${rootId}::uuid` : sql``;
+		const depthLimit = rootId ? sql`and nlevel(${table.path}) <= (select nlevel(path) from ${table} where id = ${rootId}::uuid) + ${maxDepth}` : sql`and nlevel(${table.path}) <= ${maxDepth}`;
+		return buildTree$1(await this.db.select({
+			...getTableColumns(table),
+			depth: sql`nlevel(${table.path})::int`
+		}).from(table).where(sql`${table.spaceId} = ${spaceId}::uuid and ${table.locale} = ${locale} ${scope} ${depthLimit}`).orderBy(sql`nlevel(${table.path}) asc, ${table.position} asc, ${table.title} asc`), rootId);
+	}
+	/** Ancestors of a node, root first — read straight off the materialised path. */
+	async ancestors(id, published = false) {
+		const table = published ? publishedContents : contents;
+		return await this.db.select(getTableColumns(table)).from(table).where(sql`${table.path} @> (select path from ${table} where id = ${id}::uuid)
+            and ${table.id} <> ${id}::uuid`).orderBy(sql`nlevel(${table.path}) asc`);
+	}
+	async create(data) {
+		return this.db.transaction(async (tx) => {
+			const id = data.id ?? crypto.randomUUID();
+			const parentPath = await this.parentPath(tx, data.parentId ?? null);
+			const path = parentPath ? `${parentPath}.${idToLabel(id)}` : idToLabel(id);
+			const parentPrefix = await this.parentPermalinkPath(tx, data.parentId ?? null);
+			const segment = data.hasSlug ? data.slug : null;
+			const permalinkPath = joinSegment(parentPrefix, segment);
+			const permalink = segment === null ? null : permalinkPath;
+			const [row] = await tx.insert(contents).values({
+				id,
+				spaceId: data.spaceId,
+				typeId: data.typeId,
+				locale: data.locale,
+				localizationId: data.localizationId ?? crypto.randomUUID(),
+				parentId: data.parentId ?? null,
+				title: data.title,
+				slug: data.slug,
+				path,
+				permalink,
+				permalinkPath,
+				permalinkSegment: segment,
+				status: data.status ?? "draft",
+				position: data.position ?? 0,
+				fields: data.fields,
+				searchText: data.searchText ?? "",
+				version: 1,
+				createdBy: data.actorId ?? null,
+				updatedBy: data.actorId ?? null
+			}).returning();
+			if (!row) throw new ManabloxError("content.create.failed");
+			await this.snapshot(tx, row, data.actorId ?? null);
+			return row;
+		});
+	}
+	async update(id, data) {
+		return this.db.transaction(async (tx) => {
+			const current = await this.lockRow(tx, id);
+			if (data.expectedVersion !== void 0 && data.expectedVersion !== current.version) throw ManabloxError.conflict("content.version.conflict", {
+				expected: data.expectedVersion,
+				actual: current.version
+			});
+			const parentChanged = (data.parentId ?? null) !== current.parentId;
+			const segment = data.hasSlug ? data.slug : null;
+			const segmentChanged = segment !== current.permalinkSegment;
+			if (parentChanged) await this.assertNotOwnDescendant(tx, id, data.parentId ?? null);
+			const parentPath = await this.parentPath(tx, data.parentId ?? null);
+			const newPath = parentPath ? `${parentPath}.${idToLabel(id)}` : idToLabel(id);
+			const [row] = await tx.update(contents).set({
+				typeId: data.typeId,
+				locale: data.locale,
+				parentId: data.parentId ?? null,
+				title: data.title,
+				slug: data.slug,
+				path: newPath,
+				permalinkSegment: segment,
+				fields: data.fields,
+				searchText: data.searchText ?? "",
+				position: data.position ?? current.position,
+				version: current.version + 1,
+				updatedAt: /* @__PURE__ */ new Date(),
+				updatedBy: data.actorId ?? null
+			}).where(eq(contents.id, id)).returning();
+			if (!row) throw ManabloxError.notFound("content.notFound", { id });
+			if (parentChanged) await this.moveSubtree(tx, id, current.path, newPath);
+			if (parentChanged || segmentChanged) await this.recomputePermalinks(tx, contents, id);
+			const fresh = await this.findRow(tx, id) ?? row;
+			await this.snapshot(tx, fresh, data.actorId ?? null);
+			return fresh;
+		});
+	}
+	/**
+	* Reparents a subtree with one statement. `subpath(path, nlevel(:oldPath))` is the part
+	* of each descendant's path *below* the moved node; prefixing it with the node's new
+	* path rebases the whole subtree.
+	*/
+	/**
+	* Reparents and reorders a node in one transaction.
+	*
+	* Separate from `update` because a drag is a structural change, not an edit: it writes
+	* no field values, takes no version bump and records no snapshot, so an editor open on
+	* the document does not hit a version conflict because someone reordered the tree.
+	*
+	* `position` is the index among the destination's children, clamped to the ends.
+	* Siblings on both sides are renumbered densely afterwards, so positions never drift
+	* into ties that the tree's `position asc, title asc` ordering would resolve by name.
+	*/
+	async move(id, parentId, position) {
+		return this.db.transaction(async (tx) => {
+			const db = tx;
+			const current = await this.findRow(db, id);
+			if (!current) throw ManabloxError.notFound("content.notFound", { id });
+			await this.assertNotOwnDescendant(db, id, parentId);
+			const parentPath = await this.parentPath(db, parentId);
+			const newPath = parentPath ? `${parentPath}.${idToLabel(id)}` : idToLabel(id);
+			const parentChanged = parentId !== current.parentId;
+			const order = (await db.select({ id: contents.id }).from(contents).where(and(eq(contents.spaceId, current.spaceId), eq(contents.locale, current.locale), parentId === null ? sql`${contents.parentId} is null` : eq(contents.parentId, parentId))).orderBy(sql`${contents.position} asc, ${contents.title} asc`)).map((row) => row.id).filter((sibling) => sibling !== id);
+			const index = Math.max(0, Math.min(position, order.length));
+			order.splice(index, 0, id);
+			await tx.update(contents).set({
+				parentId,
+				path: newPath,
+				updatedAt: /* @__PURE__ */ new Date()
+			}).where(eq(contents.id, id));
+			await this.renumber(db, order);
+			if (parentChanged) {
+				await this.moveSubtree(db, id, current.path, newPath);
+				await this.recomputePermalinks(db, contents, id);
+				const former = await db.select({ id: contents.id }).from(contents).where(and(eq(contents.spaceId, current.spaceId), eq(contents.locale, current.locale), current.parentId === null ? sql`${contents.parentId} is null` : eq(contents.parentId, current.parentId))).orderBy(sql`${contents.position} asc, ${contents.title} asc`);
+				await this.renumber(db, former.map((row) => row.id));
+			}
+			const fresh = await this.findRow(db, id);
+			if (!fresh) throw ManabloxError.notFound("content.notFound", { id });
+			return fresh;
+		});
+	}
+	/**
+	* Writes `position = index` for a whole sibling list in one statement: the ids and
+	* their new positions travel as two arrays and are joined by `unnest`, so a drag in a
+	* forty-child section costs one round trip rather than forty. Rows already in place
+	* are left untouched, so their `updated_at` and version do not move either.
+	*/
+	async renumber(db, ids) {
+		if (ids.length === 0) return;
+		const idList = sql.join(ids.map((id) => sql`${id}::uuid`), sql`, `);
+		const positions = sql.join(ids.map((_, index) => sql`${index}::int`), sql`, `);
+		await db.execute(sql`
+      update contents
+      set position = v.pos
+      from (select unnest(array[${idList}]) as id, unnest(array[${positions}]) as pos) v
+      where contents.id = v.id and contents.position is distinct from v.pos
+    `);
+	}
+	async moveSubtree(db, id, oldPath, newPath) {
+		await db.execute(sql`
+      update contents
+      set path = ${newPath}::ltree || subpath(path, nlevel(${oldPath}::ltree)),
+          updated_at = now()
+      where path <@ ${oldPath}::ltree and id <> ${id}::uuid
+    `);
+	}
+	/**
+	* Recomputes permalinks for a node and everything beneath it in one recursive CTE.
+	* Each level derives from *its own* parent's freshly computed value (`t.pl`), and
+	* `concat_ws` drops NULL segments so a type without a slug is transparent in the path.
+	*/
+	async recomputePermalinks(db, table, rootId) {
+		const tableName = table === contents ? sql`contents` : sql`published_contents`;
+		await db.execute(sql`
+      with recursive t as (
+        select c.id,
+               c.permalink_segment,
+               concat_ws('/',
+                 nullif(coalesce(
+                   (select p.permalink_path from ${tableName} p where p.id = c.parent_id), ''), ''),
+                 c.permalink_segment
+               ) as prefix
+        from ${tableName} c
+        where c.id = ${rootId}::uuid
+
+        union all
+
+        select ch.id,
+               ch.permalink_segment,
+               concat_ws('/', nullif(t.prefix, ''), ch.permalink_segment) as prefix
+        from ${tableName} ch
+        join t on ch.parent_id = t.id
+      )
+      update ${tableName} target
+      set permalink_path = t.prefix,
+          permalink = case when t.permalink_segment is null then null else nullif(t.prefix, '') end,
+          updated_at = now()
+      from t
+      where target.id = t.id
+        and (target.permalink_path is distinct from t.prefix
+             or target.permalink is distinct from
+                (case when t.permalink_segment is null then null else nullif(t.prefix, '') end))
+    `);
+	}
+	/** Deletes a node and its whole subtree, in both the draft and published tables. */
+	async delete(id) {
+		return this.db.transaction(async (tx) => {
+			const current = await this.findRow(tx, id);
+			if (!current) throw ManabloxError.notFound("content.notFound", { id });
+			await tx.execute(sql`
+        delete from published_contents
+        where path <@ (select path from contents where id = ${id}::uuid)
+      `);
+			return (await tx.delete(contents).where(sql`${contents.path} <@ ${current.path}::ltree`).returning({ id: contents.id })).length;
+		});
+	}
+	/**
+	* Copies a draft into the delivery projection inside one transaction, so a reader
+	* never observes a partially published tree.
+	*/
+	async publish(id, actorId = null) {
+		return this.db.transaction(async (tx) => {
+			const row = await this.findRow(tx, id);
+			if (!row) throw ManabloxError.notFound("content.notFound", { id });
+			const previous = (await tx.select({ permalinkPath: publishedContents.permalinkPath }).from(publishedContents).where(eq(publishedContents.id, id)).limit(1))[0];
+			const publishedAt = /* @__PURE__ */ new Date();
+			const publishedAtIso = publishedAt.toISOString();
+			const overrides = {
+				status: sql`'published'`,
+				source_version: sql`version`,
+				updated_at: sql`now()`,
+				updated_by: sql`${actorId}::uuid`,
+				published_at: sql`${publishedAtIso}::timestamptz`
+			};
+			const columns = PROJECTION_COLUMNS.map((name) => sql.identifier(name));
+			const values = PROJECTION_COLUMNS.map((name) => overrides[name] ?? sql.identifier(name));
+			const updates = PROJECTION_COLUMNS.filter((name) => !PROJECTION_IDENTITY.has(name)).map((name) => sql`${sql.identifier(name)} = excluded.${sql.identifier(name)}`);
+			await tx.execute(sql`
+        insert into published_contents (${sql.join(columns, sql`, `)})
+        select ${sql.join(values, sql`, `)}
+        from contents where id = ${id}::uuid
+        on conflict (id) do update set ${sql.join(updates, sql`, `)}
+      `);
+			if (previous?.permalinkPath !== row.permalinkPath) await this.recomputePermalinks(tx, publishedContents, id);
+			const [updated] = await tx.update(contents).set({
+				status: "published",
+				publishedAt,
+				updatedBy: actorId
+			}).where(eq(contents.id, id)).returning();
+			return updated;
+		});
+	}
+	async unpublish(id) {
+		await this.db.transaction(async (tx) => {
+			await tx.execute(sql`
+        delete from published_contents
+        where path <@ (select path from contents where id = ${id}::uuid)
+      `);
+			await tx.update(contents).set({
+				status: "draft",
+				publishedAt: null
+			}).where(eq(contents.id, id));
+		});
+	}
+	async versions(contentId, limit = 50) {
+		return await this.db.select({
+			version: contentVersions.version,
+			createdAt: contentVersions.createdAt,
+			createdBy: contentVersions.createdBy,
+			label: contentVersions.label
+		}).from(contentVersions).where(eq(contentVersions.contentId, contentId)).orderBy(sql`version desc`).limit(limit);
+	}
+	/** The row exactly as it was at that version — `snapshot()` stores the whole row. */
+	async versionSnapshot(contentId, version) {
+		return (await this.db.select({ snapshot: contentVersions.snapshot }).from(contentVersions).where(and(eq(contentVersions.contentId, contentId), eq(contentVersions.version, version))).limit(1))[0]?.snapshot ?? null;
+	}
+	/** Every stored version of these documents, oldest first, for a space export. */
+	async history(contentIds) {
+		if (contentIds.length === 0) return [];
+		return this.db.select().from(contentVersions).where(inArray(contentVersions.contentId, contentIds)).orderBy(contentVersions.contentId, contentVersions.version);
+	}
+	/**
+	* Puts an imported document back the way its source had it: the version counter and
+	* timestamps `create()` had to invent, and the version history in place of the single
+	* snapshot `create()` wrote. The row's own columns are left alone otherwise.
+	*/
+	async restoreHistory(id, data) {
+		await this.db.transaction(async (tx) => {
+			await tx.update(contents).set({
+				version: data.version,
+				createdAt: data.createdAt,
+				updatedAt: data.updatedAt
+			}).where(eq(contents.id, id));
+			if (data.versions.length === 0) return;
+			await tx.delete(contentVersions).where(eq(contentVersions.contentId, id));
+			await tx.insert(contentVersions).values(data.versions.map((version) => ({
+				...version,
+				contentId: id
+			})));
+		});
+	}
+	async snapshot(db, row, actorId) {
+		await db.insert(contentVersions).values({
+			contentId: row.id,
+			version: row.version,
+			snapshot: row,
+			createdBy: actorId
+		}).onConflictDoNothing();
+	}
+	async findRow(db, id) {
+		return (await db.select().from(contents).where(eq(contents.id, id)).limit(1))[0] ?? null;
+	}
+	async lockRow(db, id) {
+		const row = (await db.select().from(contents).where(eq(contents.id, id)).limit(1).for("update"))[0];
+		if (!row) throw ManabloxError.notFound("content.notFound", { id });
+		return row;
+	}
+	async parentPath(db, parentId) {
+		if (!parentId) return null;
+		const path = (await db.select({ path: contents.path }).from(contents).where(eq(contents.id, parentId)).limit(1))[0]?.path;
+		if (!path) throw ManabloxError.notFound("content.parent.notFound", { id: parentId });
+		return path;
+	}
+	async parentPermalinkPath(db, parentId) {
+		if (!parentId) return "";
+		return (await db.select({ permalinkPath: contents.permalinkPath }).from(contents).where(eq(contents.id, parentId)).limit(1))[0]?.permalinkPath ?? "";
+	}
+	/** Guards against making a node its own ancestor, which would orphan the subtree. */
+	async assertNotOwnDescendant(db, id, parentId) {
+		if (!parentId) return;
+		if (parentId === id) throw ManabloxError.badRequest("content.parent.self");
+		if ((await db.select({ cycle: sql`exists (
+          select 1 from contents p
+          where p.id = ${parentId}::uuid
+            and p.path <@ (select path from contents where id = ${id}::uuid)
+        )` }).from(sql`(select 1) as _`))[0]?.cycle) throw ManabloxError.badRequest("content.parent.cycle", {
+			id,
+			parentId
+		});
+	}
+};
+function buildTree$1(rows, rootId) {
+	const nodes = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const { depth, ...content } = row;
+		nodes.set(row.id, {
+			content,
+			depth,
+			children: []
+		});
+	}
+	const roots = [];
+	for (const node of nodes.values()) {
+		const parentId = node.content.parentId;
+		const parent = parentId ? nodes.get(parentId) : void 0;
+		if (parent && parentId !== rootId) parent.children.push(node);
+		else if (parentId === rootId || !parent) roots.push(node);
+	}
+	return roots;
+}
+function joinSegment(prefix, segment) {
+	if (segment === null) return prefix;
+	return prefix ? `${prefix}/${segment}` : segment;
+}
+//#endregion
+//#region src/repositories/content-approval.ts
+/**
+* The approval history of documents. Rows are appended when someone asks and closed
+* when someone decides; the "one pending per document" rule is the service's, this
+* only offers the reads it needs to keep it.
+*/
+var ContentApprovalRepository = class {
+	db;
+	constructor(db) {
+		this.db = db;
+	}
+	async findById(id) {
+		return (await this.db.select().from(contentApprovals).where(eq(contentApprovals.id, id)).limit(1))[0] ?? null;
+	}
+	/** The open request on a document, if there is one. */
+	async pendingFor(contentId) {
+		return (await this.db.select().from(contentApprovals).where(and(eq(contentApprovals.contentId, contentId), eq(contentApprovals.status, "pending"))).orderBy(desc(contentApprovals.requestedAt)).limit(1))[0] ?? null;
+	}
+	/** The most recent request on a document, whatever became of it. */
+	async latestFor(contentId) {
+		return (await this.db.select().from(contentApprovals).where(eq(contentApprovals.contentId, contentId)).orderBy(desc(contentApprovals.requestedAt)).limit(1))[0] ?? null;
+	}
+	historyFor(contentId, limit = 20) {
+		return this.db.select().from(contentApprovals).where(eq(contentApprovals.contentId, contentId)).orderBy(desc(contentApprovals.requestedAt)).limit(limit);
+	}
+	/**
+	* Every open request in a space, oldest first, with the document beside it. Narrowed
+	* to `typeIds` when the reader may only publish some types; `null` means every type.
+	*/
+	async pendingInSpace(spaceId, typeIds = null) {
+		if (typeIds && typeIds.length === 0) return [];
+		const conditions = [eq(contentApprovals.spaceId, spaceId), eq(contentApprovals.status, "pending")];
+		if (typeIds) conditions.push(inArray(contentApprovals.typeId, typeIds));
+		return (await this.db.select({
+			approval: contentApprovals,
+			content: {
+				id: contents.id,
+				title: contents.title,
+				locale: contents.locale,
+				typeId: contents.typeId,
+				updatedAt: contents.updatedAt
+			}
+		}).from(contentApprovals).innerJoin(contents, eq(contents.id, contentApprovals.contentId)).where(and(...conditions)).orderBy(contentApprovals.requestedAt)).map((row) => ({
+			...row.approval,
+			content: row.content
+		}));
+	}
+	async request(data) {
+		const [row] = await this.db.insert(contentApprovals).values({
+			spaceId: data.spaceId,
+			contentId: data.contentId,
+			typeId: data.typeId,
+			requestedBy: data.requestedBy,
+			requestedByLabel: data.requestedByLabel,
+			requestNote: data.requestNote ?? null,
+			contentVersion: data.contentVersion ?? null
+		}).returning();
+		if (!row) throw new ManabloxError("content.approval.create.failed");
+		return row;
+	}
+	async decide(id, data) {
+		const [row] = await this.db.update(contentApprovals).set({
+			status: data.status,
+			decidedBy: data.decidedBy,
+			decidedByLabel: data.decidedByLabel,
+			decisionNote: data.decisionNote ?? null,
+			decidedAt: /* @__PURE__ */ new Date()
+		}).where(eq(contentApprovals.id, id)).returning();
+		if (!row) throw ManabloxError.notFound("content.approval.notPending", { id });
+		return row;
+	}
+};
+//#endregion
+//#region src/repositories/content-type.ts
+/**
+* Persistence for *runtime-defined* content types only. Code-defined types come from
+* `manablox.config.ts` and are never written here — the registry merges both into one
+* shape, and `source` tells the admin which are read-only.
+*/
+var ContentTypeRepository = class {
+	db;
+	constructor(db) {
+		this.db = db;
+	}
+	async all() {
+		return (await this.db.select().from(contentTypes)).map(toDefinition);
+	}
+	async findById(id) {
+		const rows = await this.db.select().from(contentTypes).where(eq(contentTypes.id, id)).limit(1);
+		return rows[0] ? toDefinition(rows[0]) : null;
+	}
+	async create(input) {
+		const definition = defineContentType(input);
+		const [row] = await this.db.insert(contentTypes).values({
+			id: definition.id,
+			spaceId: definition.spaceId,
+			name: definition.name,
+			label: definition.label,
+			description: definition.description ?? null,
+			icon: definition.icon ?? null,
+			kind: definition.kind,
+			hasSlug: definition.hasSlug,
+			isPublishable: definition.isPublishable,
+			isVisibleInTree: definition.isVisibleInTree,
+			canBeVisibleInMenu: definition.canBeVisibleInMenu,
+			requiresApproval: definition.requiresApproval,
+			fields: definition.fields
+		}).returning();
+		if (!row) throw new ManabloxError("contentType.create.failed");
+		return toDefinition(row);
+	}
+	async update(id, input) {
+		const existing = await this.findById(id);
+		if (!existing) throw ManabloxError.notFound("contentType.notFound", { id });
+		const definition = defineContentType({
+			...input,
+			id
+		});
+		for (const field of definition.fields) {
+			const previous = existing.fields.find((candidate) => candidate.id === field.id);
+			if (previous && previous.name !== field.name) throw ManabloxError.badRequest("contentType.field.name.immutable", {
+				from: previous.name,
+				to: field.name
+			});
+		}
+		const [row] = await this.db.update(contentTypes).set({
+			name: definition.name,
+			label: definition.label,
+			description: definition.description ?? null,
+			icon: definition.icon ?? null,
+			hasSlug: definition.hasSlug,
+			isPublishable: definition.isPublishable,
+			isVisibleInTree: definition.isVisibleInTree,
+			canBeVisibleInMenu: definition.canBeVisibleInMenu,
+			requiresApproval: definition.requiresApproval,
+			fields: definition.fields,
+			updatedAt: /* @__PURE__ */ new Date()
+		}).where(eq(contentTypes.id, id)).returning();
+		if (!row) throw ManabloxError.notFound("contentType.notFound", { id });
+		return toDefinition(row);
+	}
+	async delete(id) {
+		await this.db.delete(contentTypes).where(eq(contentTypes.id, id));
+	}
+};
+function toDefinition(row) {
+	return {
+		id: row.id,
+		name: row.name,
+		label: row.label,
+		...row.description !== null ? { description: row.description } : {},
+		...row.icon !== null ? { icon: row.icon } : {},
+		kind: row.kind,
+		spaceId: row.spaceId,
+		hasSlug: row.hasSlug,
+		isPublishable: row.isPublishable,
+		isVisibleInTree: row.isVisibleInTree,
+		canBeVisibleInMenu: row.canBeVisibleInMenu,
+		requiresApproval: row.requiresApproval,
+		fields: row.fields,
+		source: "runtime"
+	};
+}
+//#endregion
+//#region src/repositories/menu.ts
+var MenuRepository = class {
+	db;
+	constructor(db) {
+		this.db = db;
+	}
+	async listBySpace(spaceId) {
+		return this.db.select().from(menus).where(eq(menus.spaceId, spaceId)).orderBy(menus.name);
+	}
+	async findById(id) {
+		return (await this.db.select().from(menus).where(eq(menus.id, id)).limit(1))[0] ?? null;
+	}
+	async findByMachineName(spaceId, machineName) {
+		return (await this.db.select().from(menus).where(and(eq(menus.spaceId, spaceId), eq(menus.machineName, machineName))).limit(1))[0] ?? null;
+	}
+	async create(data) {
+		const [row] = await this.db.insert(menus).values({
+			...data.id ? { id: data.id } : {},
+			spaceId: data.spaceId,
+			name: data.name,
+			machineName: data.machineName,
+			description: data.description ?? null
+		}).returning();
+		if (!row) throw new ManabloxError("menu.create.failed");
+		return row;
+	}
+	async update(id, data) {
+		const [row] = await this.db.update(menus).set({
+			...data.name !== void 0 ? { name: data.name } : {},
+			...data.machineName !== void 0 ? { machineName: data.machineName } : {},
+			...data.description !== void 0 ? { description: data.description } : {},
+			updatedAt: /* @__PURE__ */ new Date()
+		}).where(eq(menus.id, id)).returning();
+		if (!row) throw ManabloxError.notFound("menu.notFound", { id });
+		return row;
+	}
+	async delete(id) {
+		await this.db.delete(menus).where(eq(menus.id, id));
+	}
+	/** Every entry of a menu, flat, in tree order within each level. */
+	async items(menuId) {
+		return this.db.select().from(menuItems).where(eq(menuItems.menuId, menuId)).orderBy(asc(menuItems.position), asc(menuItems.id));
+	}
+	async tree(menuId) {
+		return buildTree(await this.items(menuId));
+	}
+	/**
+	* Replaces the whole entry tree in one transaction.
+	*
+	* A menu is edited as one document and saved as one, so this is simpler and safer than
+	* a per-entry API whose partial failures would leave a half-reordered menu behind.
+	*/
+	async setItems(menuId, tree) {
+		const rows = [];
+		const flatten = (nodes, parentId) => {
+			nodes.forEach((node, position) => {
+				const id = node.id ?? randomUUID();
+				rows.push({
+					id,
+					menuId,
+					parentId,
+					position,
+					localizationId: node.localizationId ?? null,
+					label: node.label ?? null,
+					url: node.url ?? null
+				});
+				flatten(node.children ?? [], id);
+			});
+		};
+		flatten(tree, null);
+		return this.db.transaction(async (tx) => {
+			await tx.delete(menuItems).where(eq(menuItems.menuId, menuId));
+			if (rows.length) await tx.insert(menuItems).values(rows);
+			await tx.update(menus).set({ updatedAt: /* @__PURE__ */ new Date() }).where(eq(menus.id, menuId));
+			return buildTree(rows.map((row) => ({
+				...row,
+				position: row.position ?? 0
+			})));
+		});
+	}
+	/** Menus that carry the document, for the editor's "used in" hint. */
+	async menusReferencing(spaceId, localizationId) {
+		return this.db.selectDistinct({
+			id: menus.id,
+			spaceId: menus.spaceId,
+			name: menus.name,
+			machineName: menus.machineName,
+			description: menus.description,
+			createdAt: menus.createdAt,
+			updatedAt: menus.updatedAt
+		}).from(menuItems).innerJoin(menus, eq(menuItems.menuId, menus.id)).where(and(eq(menus.spaceId, spaceId), eq(menuItems.localizationId, localizationId))).orderBy(menus.name);
+	}
+	/** Drops every entry pointing at a document, in every menu; sub-entries cascade. */
+	async removeContent(localizationId) {
+		return (await this.db.delete(menuItems).where(eq(menuItems.localizationId, localizationId)).returning({ id: menuItems.id })).length;
+	}
+	/**
+	* The tree with each content entry's document for one locale. A content entry whose
+	* document has no row in that locale — or, on the published table, no published one —
+	* comes back with `content: null`; the caller decides whether to show or drop it.
+	*/
+	async resolve(menu, locale, published = false) {
+		const items = await this.items(menu.id);
+		const localizationIds = [...new Set(items.flatMap((item) => item.localizationId ? [item.localizationId] : []))];
+		const table = published ? publishedContents : contents;
+		const rows = localizationIds.length ? await this.db.select().from(table).where(and(eq(table.spaceId, menu.spaceId), eq(table.locale, locale), inArray(table.localizationId, localizationIds))) : [];
+		const byLocalization = new Map(rows.map((row) => [row.localizationId, row]));
+		const toResolved = (node) => ({
+			id: node.item.id,
+			label: node.item.label,
+			url: node.item.url,
+			localizationId: node.item.localizationId,
+			content: node.item.localizationId ? byLocalization.get(node.item.localizationId) ?? null : null,
+			children: node.children.map(toResolved)
+		});
+		return buildTree(items).map(toResolved);
+	}
+};
+function buildTree(rows) {
+	const nodes = /* @__PURE__ */ new Map();
+	for (const row of rows) nodes.set(row.id, {
+		item: row,
+		children: []
+	});
+	const roots = [];
+	for (const node of nodes.values()) {
+		const parent = node.item.parentId ? nodes.get(node.item.parentId) : void 0;
+		(parent ? parent.children : roots).push(node);
+	}
+	const byPosition = (a, b) => a.item.position - b.item.position;
+	const sort = (list) => {
+		list.sort(byPosition);
+		for (const node of list) sort(node.children);
+	};
+	sort(roots);
+	return roots;
+}
+//#endregion
+//#region src/repositories/notification.ts
+/**
+* One person's inbox. Every method is scoped to a `userId`, so a row id from another
+* account is inert: there is no way to read or change what is not yours.
+*/
+var NotificationRepository = class {
+	db;
+	constructor(db) {
+		this.db = db;
+	}
+	/** Inserts one row per recipient in one statement; an empty list writes nothing. */
+	async insertMany(rows) {
+		if (rows.length === 0) return [];
+		return this.db.insert(notifications).values(rows.map((row) => ({
+			userId: row.userId,
+			spaceId: row.spaceId ?? null,
+			kind: row.kind,
+			title: row.title,
+			body: row.body ?? "",
+			url: row.url ?? null,
+			targetKind: row.targetKind ?? null,
+			targetId: row.targetId ?? null,
+			actorId: row.actorId ?? null,
+			actorLabel: row.actorLabel ?? null,
+			meta: row.meta ?? null
+		}))).returning();
+	}
+	list(userId, filter = {}, pagination = {
+		limit: 25,
+		offset: 0
+	}) {
+		const conditions = [eq(notifications.userId, userId)];
+		if (filter.unreadOnly) conditions.push(isNull(notifications.readAt));
+		if (filter.kinds?.length) conditions.push(inArray(notifications.kind, filter.kinds));
+		if (filter.spaceId === null) conditions.push(isNull(notifications.spaceId));
+		else if (filter.spaceId) conditions.push(eq(notifications.spaceId, filter.spaceId));
+		return paginate(this.db, notifications, {
+			where: and(...conditions),
+			orderBy: [desc(notifications.createdAt), desc(notifications.id)],
+			pagination
+		});
+	}
+	async findById(userId, id) {
+		return (await this.db.select().from(notifications).where(and(eq(notifications.userId, userId), eq(notifications.id, id))).limit(1))[0] ?? null;
+	}
+	async countUnread(userId) {
+		return (await this.db.select({ count: sql`count(*)::int` }).from(notifications).where(and(eq(notifications.userId, userId), isNull(notifications.readAt))))[0]?.count ?? 0;
+	}
+	/** Marks the named rows read; rows already read keep their original time. Returns how many changed. */
+	async markRead(userId, ids) {
+		if (ids.length === 0) return 0;
+		return (await this.db.update(notifications).set({ readAt: /* @__PURE__ */ new Date() }).where(and(eq(notifications.userId, userId), inArray(notifications.id, ids), isNull(notifications.readAt))).returning({ id: notifications.id })).length;
+	}
+	async markUnread(userId, ids) {
+		if (ids.length === 0) return 0;
+		return (await this.db.update(notifications).set({ readAt: null }).where(and(eq(notifications.userId, userId), inArray(notifications.id, ids))).returning({ id: notifications.id })).length;
+	}
+	async markAllRead(userId) {
+		return (await this.db.update(notifications).set({ readAt: /* @__PURE__ */ new Date() }).where(and(eq(notifications.userId, userId), isNull(notifications.readAt))).returning({ id: notifications.id })).length;
+	}
+	async delete(userId, ids) {
+		if (ids.length === 0) return 0;
+		return (await this.db.delete(notifications).where(and(eq(notifications.userId, userId), inArray(notifications.id, ids))).returning({ id: notifications.id })).length;
+	}
+	async deleteRead(userId) {
+		return (await this.db.delete(notifications).where(and(eq(notifications.userId, userId), sql`${notifications.readAt} is not null`)).returning({ id: notifications.id })).length;
+	}
+};
+//#endregion
+//#region src/repositories/role.ts
+var RoleRepository = class {
+	db;
+	constructor(db) {
+		this.db = db;
+	}
+	async listBySpace(spaceId) {
+		return this.db.select().from(roles).where(eq(roles.spaceId, spaceId)).orderBy(roles.name);
+	}
+	async findById(id) {
+		return (await this.db.select().from(roles).where(eq(roles.id, id)).limit(1))[0] ?? null;
+	}
+	async findByMachineName(spaceId, machineName) {
+		return (await this.db.select().from(roles).where(and(eq(roles.spaceId, spaceId), eq(roles.machineName, machineName))).limit(1))[0] ?? null;
+	}
+	async create(spaceId, data) {
+		const [row] = await this.db.insert(roles).values({
+			spaceId,
+			...data
+		}).returning();
+		if (!row) throw new ManabloxError("role.create.failed");
+		return row;
+	}
+	async update(id, data) {
+		const [row] = await this.db.update(roles).set({
+			...data,
+			updatedAt: /* @__PURE__ */ new Date()
+		}).where(eq(roles.id, id)).returning();
+		if (!row) throw ManabloxError.notFound("role.notFound", { id });
+		return row;
+	}
+	async delete(id) {
+		await this.db.delete(roles).where(eq(roles.id, id));
+	}
+	/** How many members of the role's space hold it, by name. */
+	async countMembers(spaceId, machineName) {
+		return (await this.db.select({ count: sql`count(*)::int` }).from(memberships).where(and(eq(memberships.spaceId, spaceId), eq(memberships.role, machineName))))[0]?.count ?? 0;
+	}
+	/**
+	* Drops every grant narrowed to a content type from every role, once the type is
+	* gone. Grants are a JSON array, so this is one statement across the roles that carry
+	* such a grant rather than a read-modify-write per role.
+	*/
+	async pruneContentType(typeId) {
+		const suffix = `:${typeId}`;
+		await this.db.update(roles).set({
+			permissions: sql`(
+          select coalesce(jsonb_agg(value), '[]'::jsonb)
+          from jsonb_array_elements_text(${roles.permissions}) as value
+          where value not like ${`%${suffix}`}
+        )`,
+			updatedAt: /* @__PURE__ */ new Date()
+		}).where(sql`${roles.permissions}::text like ${`%${suffix}%`}`);
+	}
+};
+//#endregion
+//#region src/repositories/space.ts
+var SpaceRepository = class {
+	db;
+	constructor(db) {
+		this.db = db;
+	}
+	async all() {
+		return this.db.select().from(spaces).orderBy(spaces.name);
+	}
+	async findManyByIds(ids) {
+		if (ids.length === 0) return [];
+		return this.db.select().from(spaces).where(inArray(spaces.id, ids)).orderBy(spaces.name);
+	}
+	async findById(id) {
+		return (await this.db.select().from(spaces).where(eq(spaces.id, id)).limit(1))[0] ?? null;
+	}
+	async findByMachineName(machineName) {
+		return (await this.db.select().from(spaces).where(eq(spaces.machineName, machineName)).limit(1))[0] ?? null;
+	}
+	async create(data) {
+		const [row] = await this.db.insert(spaces).values({
+			...data.id ? { id: data.id } : {},
+			name: data.name,
+			machineName: data.machineName,
+			description: data.description ?? null,
+			url: data.url,
+			defaultLocale: data.defaultLocale ?? "en",
+			locales: data.locales ?? [data.defaultLocale ?? "en"],
+			settings: data.settings ?? {}
+		}).returning();
+		if (!row) throw new ManabloxError("space.create.failed");
+		return row;
+	}
+	async update(id, data) {
+		const [row] = await this.db.update(spaces).set({
+			...data.name !== void 0 ? { name: data.name } : {},
+			...data.machineName !== void 0 ? { machineName: data.machineName } : {},
+			...data.description !== void 0 ? { description: data.description } : {},
+			...data.url !== void 0 ? { url: data.url } : {},
+			...data.defaultLocale !== void 0 ? { defaultLocale: data.defaultLocale } : {},
+			...data.locales !== void 0 ? { locales: data.locales } : {},
+			...data.settings !== void 0 ? { settings: data.settings } : {},
+			updatedAt: /* @__PURE__ */ new Date()
+		}).where(eq(spaces.id, id)).returning();
+		if (!row) throw ManabloxError.notFound("space.notFound", { id });
+		return row;
+	}
+	async delete(id) {
+		await this.db.delete(spaces).where(eq(spaces.id, id));
+	}
+};
+//#endregion
+//#region src/repositories/user.ts
+/**
+* How better-auth 1.7 identifies an email + password credential: sign-in looks for an
+* account with this provider *and* this issuer, so a row missing either is invisible to
+* it and the account can never sign in.
+*/
+const CREDENTIAL_PROVIDER = "credential";
+const CREDENTIAL_ISSUER = "local:credential";
+var UserRepository = class {
+	db;
+	constructor(db) {
+		this.db = db;
+	}
+	async findById(id) {
+		return (await this.db.select().from(users).where(eq(users.id, id)).limit(1))[0] ?? null;
+	}
+	async findManyByIds(ids) {
+		if (ids.length === 0) return [];
+		return this.db.select().from(users).where(inArray(users.id, ids));
+	}
+	/** Every account holding an instance role, for a fan-out to the superadmins. */
+	async findByRole(role) {
+		return this.db.select().from(users).where(eq(users.role, role));
+	}
+	async findByEmail(email) {
+		return (await this.db.select().from(users).where(eq(users.email, email)).limit(1))[0] ?? null;
+	}
+	async list(pagination, search) {
+		const where = search ? sql`${users.email} ilike ${`%${search}%`} or ${users.name} ilike ${`%${search}%`}` : void 0;
+		return paginate(this.db, users, {
+			where,
+			orderBy: desc(users.createdAt),
+			pagination
+		});
+	}
+	/**
+	* Users who are not members of a space, matching a search, newest first: the
+	* add-member picker's candidates, decided in SQL rather than by loading a page of
+	* users and filtering it here.
+	*/
+	async candidates(spaceId, search, limit) {
+		const notMember = sql`not exists (select 1 from ${memberships} where ${memberships.userId} = ${users.id} and ${memberships.spaceId} = ${spaceId})`;
+		const where = search ? and(notMember, sql`(${users.email} ilike ${`%${search}%`} or ${users.name} ilike ${`%${search}%`})`) : notMember;
+		return this.db.select().from(users).where(where).orderBy(desc(users.createdAt)).limit(limit);
+	}
+	async count() {
+		return (await this.db.select({ count: sql`count(*)::int` }).from(users))[0]?.count ?? 0;
+	}
+	/**
+	* Inserts the user and its password credential together, so a failure on the second
+	* row cannot leave an account nobody can sign in to. The account row is shaped the way
+	* better-auth writes it on sign-up, so a sign-in later finds it as its own.
+	*/
+	async create(data) {
+		return this.db.transaction(async (tx) => {
+			const [user] = await tx.insert(users).values({
+				name: data.name,
+				email: data.email,
+				role: data.role
+			}).returning();
+			if (!user) throw new ManabloxError("user.create.failed");
+			await tx.insert(accounts).values({
+				userId: user.id,
+				accountId: user.id,
+				providerId: CREDENTIAL_PROVIDER,
+				issuer: CREDENTIAL_ISSUER,
+				password: data.passwordHash
+			});
+			return user;
+		});
+	}
+	async update(id, data) {
+		const [row] = await this.db.update(users).set({
+			...data,
+			updatedAt: /* @__PURE__ */ new Date()
+		}).where(eq(users.id, id)).returning();
+		if (!row) throw ManabloxError.notFound("user.notFound", { id });
+		return row;
+	}
+	async delete(id) {
+		await this.db.delete(users).where(eq(users.id, id));
+	}
+	async setBanned(id, banned, reason) {
+		const [row] = await this.db.update(users).set({
+			banned,
+			banReason: banned ? reason : null,
+			updatedAt: /* @__PURE__ */ new Date()
+		}).where(eq(users.id, id)).returning();
+		if (!row) throw ManabloxError.notFound("user.notFound", { id });
+		return row;
+	}
+	/**
+	* Replaces the password credential, creating it for an account that only ever signed
+	* in through another provider.
+	*/
+	async setPasswordHash(userId, passwordHash) {
+		if ((await this.db.update(accounts).set({
+			password: passwordHash,
+			updatedAt: /* @__PURE__ */ new Date()
+		}).where(and(eq(accounts.userId, userId), eq(accounts.providerId, CREDENTIAL_PROVIDER), eq(accounts.issuer, CREDENTIAL_ISSUER))).returning({ id: accounts.id })).length) return;
+		await this.db.insert(accounts).values({
+			userId,
+			accountId: userId,
+			providerId: CREDENTIAL_PROVIDER,
+			issuer: CREDENTIAL_ISSUER,
+			password: passwordHash
+		});
+	}
+	/** Signs the user out everywhere. */
+	async revokeSessions(userId) {
+		await this.db.delete(sessions).where(eq(sessions.userId, userId));
+	}
+	async countByRole(role) {
+		return (await this.db.select({ count: sql`count(*)::int` }).from(users).where(eq(users.role, role)))[0]?.count ?? 0;
+	}
+	async setNotificationPreferences(id, preferences) {
+		const [row] = await this.db.update(users).set({
+			notificationPreferences: preferences,
+			updatedAt: /* @__PURE__ */ new Date()
+		}).where(eq(users.id, id)).returning();
+		if (!row) throw ManabloxError.notFound("user.notFound", { id });
+		return row;
+	}
+	/** The stored hash of the password credential, or `null` for an account without one. */
+	async passwordHash(userId) {
+		return (await this.db.select({ password: accounts.password }).from(accounts).where(and(eq(accounts.userId, userId), eq(accounts.providerId, CREDENTIAL_PROVIDER), eq(accounts.issuer, CREDENTIAL_ISSUER))).limit(1))[0]?.password ?? null;
+	}
+	async setRole(id, role) {
+		const [row] = await this.db.update(users).set({
+			role,
+			updatedAt: /* @__PURE__ */ new Date()
+		}).where(eq(users.id, id)).returning();
+		if (!row) throw ManabloxError.notFound("user.notFound", { id });
+		return row;
+	}
+	/**
+	* Authoritative role plus space memberships in one query.
+	*
+	* Read on every authenticated request rather than trusting the role embedded in the
+	* session: better-auth caches the session payload (five minutes by default), so a
+	* promotion or demotion would otherwise not take effect until that cache expired.
+	*
+	* A membership naming a custom role joins that role's grants; one naming a built-in
+	* role has none here, and the auth package answers those from its own table.
+	*/
+	async principal(userId) {
+		const rows = await this.db.select({
+			role: users.role,
+			banned: users.banned,
+			spaceId: memberships.spaceId,
+			spaceRole: memberships.role,
+			grants: roles.permissions
+		}).from(users).leftJoin(memberships, eq(memberships.userId, users.id)).leftJoin(roles, and(eq(roles.spaceId, memberships.spaceId), eq(roles.machineName, memberships.role))).where(eq(users.id, userId));
+		const first = rows[0];
+		if (!first) return null;
+		const spaces = {};
+		const permissions = {};
+		for (const row of rows) {
+			if (!row.spaceId || !row.spaceRole) continue;
+			spaces[row.spaceId] = row.spaceRole;
+			if (row.grants) permissions[row.spaceId] = row.grants;
+		}
+		return {
+			role: first.role,
+			banned: first.banned,
+			spaces,
+			permissions
+		};
+	}
+	async memberships(userId) {
+		return this.db.select().from(memberships).where(eq(memberships.userId, userId));
+	}
+	/** The user's memberships with the space each one is in, for a per-user view. */
+	async membershipsWithSpaces(userId) {
+		return (await this.db.select({
+			membership: memberships,
+			space: spaces
+		}).from(memberships).innerJoin(spaces, eq(spaces.id, memberships.spaceId)).where(eq(memberships.userId, userId)).orderBy(spaces.name)).map((row) => ({
+			...row.membership,
+			space: row.space
+		}));
+	}
+	async membersOf(spaceId) {
+		return (await this.db.select({
+			membership: memberships,
+			user: users
+		}).from(memberships).innerJoin(users, eq(users.id, memberships.userId)).where(eq(memberships.spaceId, spaceId))).map((row) => ({
+			...row.membership,
+			user: row.user
+		}));
+	}
+	async roleIn(userId, spaceId) {
+		return (await this.db.select({ role: memberships.role }).from(memberships).where(and(eq(memberships.userId, userId), eq(memberships.spaceId, spaceId))).limit(1))[0]?.role ?? null;
+	}
+	async grant(userId, spaceId, role) {
+		await this.db.insert(memberships).values({
+			userId,
+			spaceId,
+			role
+		}).onConflictDoUpdate({
+			target: [memberships.userId, memberships.spaceId],
+			set: { role }
+		});
+	}
+	async revoke(userId, spaceId) {
+		await this.db.delete(memberships).where(and(eq(memberships.userId, userId), eq(memberships.spaceId, spaceId)));
+	}
+};
+//#endregion
+//#region src/repositories/webhook.ts
+/** The webhooks of a space and the log of what was sent to them. */
+var WebhookRepository = class {
+	db;
+	constructor(db) {
+		this.db = db;
+	}
+	async findById(id) {
+		return (await this.db.select().from(webhooks).where(eq(webhooks.id, id)).limit(1))[0] ?? null;
+	}
+	async listBySpace(spaceId) {
+		return this.db.select().from(webhooks).where(eq(webhooks.spaceId, spaceId)).orderBy(webhooks.name);
+	}
+	async create(data) {
+		const [row] = await this.db.insert(webhooks).values({
+			...data.id ? { id: data.id } : {},
+			spaceId: data.spaceId,
+			name: data.name,
+			url: data.url,
+			secret: data.secret ?? null,
+			events: data.events,
+			enabled: data.enabled ?? true
+		}).returning();
+		if (!row) throw new ManabloxError("webhook.create.failed");
+		return row;
+	}
+	/** The switched-on webhooks of a space, for fanning an event out. */
+	async findEnabled(spaceId) {
+		return this.db.select().from(webhooks).where(and(eq(webhooks.spaceId, spaceId), eq(webhooks.enabled, true)));
+	}
+	async recordDelivery(data) {
+		const [row] = await this.db.insert(webhookDeliveries).values(data).returning();
+		return row;
+	}
+	async deliveries(webhookId, limit = 50) {
+		return this.db.select().from(webhookDeliveries).where(eq(webhookDeliveries.webhookId, webhookId)).orderBy(webhookDeliveries.createdAt).limit(limit);
+	}
+};
+//#endregion
+//#region src/repositories/workflow.ts
+/** How many runs a workflow keeps; older ones are pruned as new ones are written. */
+const RUNS_KEPT_PER_WORKFLOW = 200;
+var WorkflowRepository = class {
+	db;
+	constructor(db) {
+		this.db = db;
+	}
+	async listBySpace(spaceId) {
+		return this.db.select().from(workflows).where(eq(workflows.spaceId, spaceId)).orderBy(workflows.name);
+	}
+	/** Every enabled workflow of a space, for the dispatcher; every enabled one at all for the scheduler. */
+	async listEnabled(spaceId) {
+		return this.db.select().from(workflows).where(spaceId ? and(eq(workflows.enabled, true), eq(workflows.spaceId, spaceId)) : eq(workflows.enabled, true));
+	}
+	async findById(id) {
+		return (await this.db.select().from(workflows).where(eq(workflows.id, id)).limit(1))[0] ?? null;
+	}
+	async create(data) {
+		const [row] = await this.db.insert(workflows).values({
+			...data.id ? { id: data.id } : {},
+			spaceId: data.spaceId,
+			name: data.name,
+			description: data.description ?? null,
+			enabled: data.enabled ?? false,
+			trigger: data.trigger,
+			steps: data.steps
+		}).returning();
+		if (!row) throw new ManabloxError("workflow.create.failed");
+		return row;
+	}
+	async update(id, data) {
+		const [row] = await this.db.update(workflows).set({
+			...data.name !== void 0 ? { name: data.name } : {},
+			...data.description !== void 0 ? { description: data.description } : {},
+			...data.enabled !== void 0 ? { enabled: data.enabled } : {},
+			...data.trigger !== void 0 ? { trigger: data.trigger } : {},
+			...data.steps !== void 0 ? { steps: data.steps } : {},
+			updatedAt: /* @__PURE__ */ new Date()
+		}).where(eq(workflows.id, id)).returning();
+		if (!row) throw ManabloxError.notFound("workflow.notFound", { id });
+		return row;
+	}
+	async delete(id) {
+		await this.db.delete(workflows).where(eq(workflows.id, id));
+	}
+	/**
+	* Claims a scheduled workflow for one minute. Returns false when another process got
+	* there first — the update matches nothing once `lastScheduledAt` is already `minute`.
+	*/
+	async claimSchedule(id, minute) {
+		return (await this.db.update(workflows).set({ lastScheduledAt: minute }).where(and(eq(workflows.id, id), or(isNull(workflows.lastScheduledAt), lt(workflows.lastScheduledAt, minute)))).returning({ id: workflows.id })).length > 0;
+	}
+	async touchRun(id, at) {
+		await this.db.update(workflows).set({ lastRunAt: at }).where(eq(workflows.id, id));
+	}
+	async createRun(data) {
+		const [row] = await this.db.insert(workflowRuns).values({
+			workflowId: data.workflowId,
+			spaceId: data.spaceId,
+			trigger: data.trigger,
+			context: data.context,
+			status: "queued"
+		}).returning();
+		if (!row) throw new ManabloxError("workflow.create.failed");
+		await this.pruneRuns(data.workflowId);
+		return row;
+	}
+	async findRun(id) {
+		return (await this.db.select().from(workflowRuns).where(eq(workflowRuns.id, id)).limit(1))[0] ?? null;
+	}
+	async listRuns(workflowId, limit = 50) {
+		return this.db.select().from(workflowRuns).where(eq(workflowRuns.workflowId, workflowId)).orderBy(desc(workflowRuns.createdAt)).limit(limit);
+	}
+	/**
+	* Moves a run from `queued` or `waiting` to `running`, or reports that it is not
+	* there to be moved. The status check in the predicate is what keeps two workers off
+	* the same run.
+	*/
+	async claimRun(id) {
+		return (await this.db.update(workflowRuns).set({
+			status: "running",
+			startedAt: sql`coalesce(${workflowRuns.startedAt}, now())`
+		}).where(and(eq(workflowRuns.id, id), inArray(workflowRuns.status, ["queued", "waiting"]))).returning())[0] ?? null;
+	}
+	/** Runs paused by a delay step whose time has come. */
+	async dueRuns(now, limit = 100) {
+		return this.db.select().from(workflowRuns).where(and(eq(workflowRuns.status, "waiting"), lte(workflowRuns.resumeAt, now))).orderBy(workflowRuns.resumeAt).limit(limit);
+	}
+	async saveRunProgress(id, data) {
+		await this.db.update(workflowRuns).set({
+			status: data.status,
+			cursor: data.cursor,
+			log: data.log,
+			error: data.error ?? null,
+			resumeAt: data.resumeAt ?? null,
+			...data.finished ? { finishedAt: /* @__PURE__ */ new Date() } : {}
+		}).where(eq(workflowRuns.id, id));
+	}
+	async pruneRuns(workflowId) {
+		await this.db.execute(sql`
+      delete from ${workflowRuns}
+      where ${workflowRuns.workflowId} = ${workflowId}
+        and ${workflowRuns.id} in (
+          select id from ${workflowRuns}
+          where ${workflowRuns.workflowId} = ${workflowId}
+          order by ${workflowRuns.createdAt} desc
+          offset ${200}
+        )
+    `);
+	}
+	/** The documents a scheduled workflow's selection names, newest change first. */
+	async selectDocuments(spaceId, selection, limit = 500) {
+		const predicates = [eq(contents.spaceId, spaceId)];
+		if (selection.typeIds.length) predicates.push(inArray(contents.typeId, selection.typeIds));
+		if (selection.status !== "any") predicates.push(eq(contents.status, selection.status));
+		if (selection.locale) predicates.push(eq(contents.locale, selection.locale));
+		if (selection.changedWithinHours) {
+			const since = /* @__PURE__ */ new Date(Date.now() - selection.changedWithinHours * 36e5);
+			predicates.push(gte(contents.updatedAt, since));
+		}
+		return this.db.select().from(contents).where(and(...predicates)).orderBy(desc(contents.updatedAt)).limit(limit);
+	}
+	async subscriptionsFor(userIds) {
+		if (userIds.length === 0) return [];
+		return this.db.select().from(pushSubscriptions).where(inArray(pushSubscriptions.userId, userIds));
+	}
+	async subscriptionsOf(userId) {
+		return this.db.select().from(pushSubscriptions).where(eq(pushSubscriptions.userId, userId)).orderBy(desc(pushSubscriptions.createdAt));
+	}
+	/** Upserts on the endpoint: a browser re-subscribing keeps one row, not two. */
+	async subscribe(data) {
+		const [row] = await this.db.insert(pushSubscriptions).values(data).onConflictDoUpdate({
+			target: pushSubscriptions.endpoint,
+			set: {
+				userId: data.userId,
+				keys: data.keys,
+				userAgent: data.userAgent
+			}
+		}).returning();
+		if (!row) throw new ManabloxError("workflow.create.failed");
+		return row;
+	}
+	async unsubscribe(userId, endpoint) {
+		await this.db.delete(pushSubscriptions).where(and(eq(pushSubscriptions.userId, userId), eq(pushSubscriptions.endpoint, endpoint)));
+	}
+	/** A push service answered 404/410: the browser is gone, and so is the row. */
+	async dropSubscription(id) {
+		await this.db.delete(pushSubscriptions).where(eq(pushSubscriptions.id, id));
+	}
+	async markSubscriptionUsed(id) {
+		await this.db.update(pushSubscriptions).set({ lastUsedAt: /* @__PURE__ */ new Date() }).where(eq(pushSubscriptions.id, id));
+	}
+};
+//#endregion
+//#region src/repositories/index.ts
+function createRepositories(db, registry, options = {}) {
+	return {
+		content: new ContentRepository(db, registry),
+		contentTypes: new ContentTypeRepository(db),
+		spaces: new SpaceRepository(db),
+		assets: new AssetRepository(db),
+		assetUsages: new AssetUsageRepository(db),
+		users: new UserRepository(db),
+		menus: new MenuRepository(db),
+		roles: new RoleRepository(db),
+		workflows: new WorkflowRepository(db),
+		webhooks: new WebhookRepository(db),
+		audit: new AuditRepository(db, options.audit),
+		notifications: new NotificationRepository(db),
+		approvals: new ContentApprovalRepository(db)
+	};
+}
+//#endregion
+export { buildOrderBy as _, UserRepository as a, applyBootstrapSql as b, MenuRepository as c, ContentRepository as d, buildTree$1 as f, buildContentWhere as g, AssetRepository as h, WebhookRepository as i, ContentTypeRepository as l, AssetUsageRepository as m, RUNS_KEPT_PER_WORKFLOW as n, SpaceRepository as o, AuditRepository as p, WorkflowRepository as r, NotificationRepository as s, createRepositories as t, ContentApprovalRepository as u, paginate as v, createDatabase as y };