@orthacms/content-server 0.0.0-reserve.0

package/dist/lib/entries/http/controllers/create-entry.controller.d.ts

@@ -0,0 +1,21 @@
+import { type PublicUser } from '@orthacms/identity-server';
+import type { ContentTypeRegistry } from '../../../registry/content-type-registry';
+import { EntryWriterService } from '../../infrastructure/persistence/entry-writer.service';
+import { SaveEntryDto } from '../dto/save-entry.dto';
+import type { EntryRecord } from '../../types/entry-list-view';
+/**
+ * `POST /api/content/:typeName` — create a draft entry from a validated values
+ * bag. The `:typeName` resolves via the registry (404 if unknown); the body is
+ * validated against the type's field specs (422 with the issue list on failure).
+ * `OriginGuard` defends this state-changing POST (CSRF); `WorkspaceGuard` scopes
+ * it to a workspace the caller belongs to; `content:create` gates it. The
+ * synchronous CSRF + permission guards run before `WorkspaceGuard` so a rejected
+ * request never incurs its membership DB probe.
+ */
+export declare class CreateEntryController {
+    private readonly registry;
+    private readonly writer;
+    constructor(registry: ContentTypeRegistry, writer: EntryWriterService);
+    create(typeName: string, body: SaveEntryDto, workspaceId: string, user?: PublicUser): Promise<EntryRecord>;
+}
+//# sourceMappingURL=create-entry.controller.d.ts.map

package/dist/lib/entries/http/controllers/create-entry.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-entry.controller.d.ts","sourceRoot":"","sources":["../../../../../src/lib/entries/http/controllers/create-entry.controller.ts"],"names":[],"mappings":"AACA,OAAO,EAKH,KAAK,UAAU,EAElB,MAAM,2BAA2B,CAAC;AAInC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uDAAuD,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAI/D;;;;;;;;GAQG;AACH,qBAGa,qBAAqB;IAG1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,QAAQ,EAAE,mBAAmB,EAC7B,MAAM,EAAE,kBAAkB;IAI/C,MAAM,CACiB,QAAQ,EAAE,MAAM,EAC3B,IAAI,EAAE,YAAY,EACN,WAAW,EAAE,MAAM,EACxB,IAAI,CAAC,EAAE,UAAU,GACjC,OAAO,CAAC,WAAW,CAAC;CAY1B"}

package/dist/lib/entries/http/controllers/create-entry.controller.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateEntryController = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const identity_server_1 = require("@orthacms/identity-server");
+const workspaces_server_1 = require("@orthacms/workspaces-server");
+const content_grant_guard_1 = require("../guards/content-grant.guard");
+const content_tokens_1 = require("../../../content.tokens");
+const entry_writer_service_1 = require("../../infrastructure/persistence/entry-writer.service");
+const save_entry_dto_1 = require("../dto/save-entry.dto");
+const resolve_type_1 = require("./resolve-type");
+const to_actor_1 = require("./to-actor");
+/**
+ * `POST /api/content/:typeName` — create a draft entry from a validated values
+ * bag. The `:typeName` resolves via the registry (404 if unknown); the body is
+ * validated against the type's field specs (422 with the issue list on failure).
+ * `OriginGuard` defends this state-changing POST (CSRF); `WorkspaceGuard` scopes
+ * it to a workspace the caller belongs to; `content:create` gates it. The
+ * synchronous CSRF + permission guards run before `WorkspaceGuard` so a rejected
+ * request never incurs its membership DB probe.
+ */
+let CreateEntryController = class CreateEntryController {
+    registry;
+    writer;
+    constructor(registry, writer) {
+        this.registry = registry;
+        this.writer = writer;
+    }
+    create(typeName, body, workspaceId, user) {
+        const type = (0, resolve_type_1.resolveType)(this.registry, typeName);
+        return this.writer.create(type, body.values, workspaceId, body.relations, body.locale, body.localeGroupId, (0, to_actor_1.toActor)(user));
+    }
+};
+exports.CreateEntryController = CreateEntryController;
+tslib_1.__decorate([
+    (0, common_1.Post)(':typeName'),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Body)()),
+    tslib_1.__param(2, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__param(3, (0, identity_server_1.CurrentUser)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, save_entry_dto_1.SaveEntryDto, String, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], CreateEntryController.prototype, "create", null);
+exports.CreateEntryController = CreateEntryController = tslib_1.__decorate([
+    (0, common_1.UseGuards)(identity_server_1.OriginGuard, identity_server_1.PermissionsGuard, workspaces_server_1.WorkspaceGuard, content_grant_guard_1.ContentGrantGuard),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.CONTENT_CREATE),
+    (0, common_1.Controller)('content'),
+    tslib_1.__param(0, (0, content_tokens_1.InjectContentRegistry)()),
+    tslib_1.__metadata("design:paramtypes", [Function, entry_writer_service_1.EntryWriterService])
+], CreateEntryController);

package/dist/lib/entries/http/controllers/delete-entry.controller.d.ts

@@ -0,0 +1,25 @@
+import { type PublicUser } from '@orthacms/identity-server';
+import type { ContentTypeRegistry } from '../../../registry/content-type-registry';
+import { EntryWriterService } from '../../infrastructure/persistence/entry-writer.service';
+import type { EntryRecord } from '../../types/entry-list-view';
+/**
+ * Single-entry removal lifecycle, all gated on `content:delete`:
+ * - `DELETE /api/content/:typeName/:id` — soft delete (stamp `deleted_at`) for a
+ *   paranoid type, hard delete otherwise; 204.
+ * - `POST   /api/content/:typeName/:id/restore` — clear the tombstone (paranoid
+ *   only); returns the restored record.
+ * - `DELETE /api/content/:typeName/:id/permanent` — permanently remove a
+ *   tombstoned row (paranoid only); 204.
+ *
+ * `OriginGuard` defends these state-changing writes; `WorkspaceGuard` scopes them
+ * to a workspace the caller belongs to.
+ */
+export declare class DeleteEntryController {
+    private readonly registry;
+    private readonly writer;
+    constructor(registry: ContentTypeRegistry, writer: EntryWriterService);
+    remove(typeName: string, id: string, workspaceId: string, user?: PublicUser): Promise<void>;
+    restore(typeName: string, id: string, workspaceId: string, user?: PublicUser): Promise<EntryRecord>;
+    purge(typeName: string, id: string, workspaceId: string, user?: PublicUser): Promise<void>;
+}
+//# sourceMappingURL=delete-entry.controller.d.ts.map

package/dist/lib/entries/http/controllers/delete-entry.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-entry.controller.d.ts","sourceRoot":"","sources":["../../../../../src/lib/entries/http/controllers/delete-entry.controller.ts"],"names":[],"mappings":"AAUA,OAAO,EAKH,KAAK,UAAU,EAElB,MAAM,2BAA2B,CAAC;AAInC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uDAAuD,CAAC;AAC3F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAI/D;;;;;;;;;;;GAWG;AACH,qBAGa,qBAAqB;IAG1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,QAAQ,EAAE,mBAAmB,EAC7B,MAAM,EAAE,kBAAkB;IAKzC,MAAM,CACW,QAAQ,EAAE,MAAM,EACP,EAAE,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACxB,IAAI,CAAC,EAAE,UAAU,GACjC,OAAO,CAAC,IAAI,CAAC;IAMhB,OAAO,CACgB,QAAQ,EAAE,MAAM,EACP,EAAE,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACxB,IAAI,CAAC,EAAE,UAAU,GACjC,OAAO,CAAC,WAAW,CAAC;IAOjB,KAAK,CACY,QAAQ,EAAE,MAAM,EACP,EAAE,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACxB,IAAI,CAAC,EAAE,UAAU,GACjC,OAAO,CAAC,IAAI,CAAC;CAInB"}

package/dist/lib/entries/http/controllers/delete-entry.controller.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeleteEntryController = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const identity_server_1 = require("@orthacms/identity-server");
+const workspaces_server_1 = require("@orthacms/workspaces-server");
+const content_grant_guard_1 = require("../guards/content-grant.guard");
+const content_tokens_1 = require("../../../content.tokens");
+const entry_writer_service_1 = require("../../infrastructure/persistence/entry-writer.service");
+const resolve_type_1 = require("./resolve-type");
+const to_actor_1 = require("./to-actor");
+/**
+ * Single-entry removal lifecycle, all gated on `content:delete`:
+ * - `DELETE /api/content/:typeName/:id` — soft delete (stamp `deleted_at`) for a
+ *   paranoid type, hard delete otherwise; 204.
+ * - `POST   /api/content/:typeName/:id/restore` — clear the tombstone (paranoid
+ *   only); returns the restored record.
+ * - `DELETE /api/content/:typeName/:id/permanent` — permanently remove a
+ *   tombstoned row (paranoid only); 204.
+ *
+ * `OriginGuard` defends these state-changing writes; `WorkspaceGuard` scopes them
+ * to a workspace the caller belongs to.
+ */
+let DeleteEntryController = class DeleteEntryController {
+    registry;
+    writer;
+    constructor(registry, writer) {
+        this.registry = registry;
+        this.writer = writer;
+    }
+    async remove(typeName, id, workspaceId, user) {
+        const type = (0, resolve_type_1.resolveType)(this.registry, typeName);
+        await this.writer.remove(type, id, workspaceId, (0, to_actor_1.toActor)(user));
+    }
+    restore(typeName, id, workspaceId, user) {
+        const type = (0, resolve_type_1.resolveType)(this.registry, typeName);
+        return this.writer.restore(type, id, workspaceId, (0, to_actor_1.toActor)(user));
+    }
+    async purge(typeName, id, workspaceId, user) {
+        const type = (0, resolve_type_1.resolveType)(this.registry, typeName);
+        await this.writer.purge(type, id, workspaceId, (0, to_actor_1.toActor)(user));
+    }
+};
+exports.DeleteEntryController = DeleteEntryController;
+tslib_1.__decorate([
+    (0, common_1.Delete)(':typeName/:id'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.NO_CONTENT),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__param(2, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__param(3, (0, identity_server_1.CurrentUser)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String, String, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], DeleteEntryController.prototype, "remove", null);
+tslib_1.__decorate([
+    (0, common_1.Post)(':typeName/:id/restore'),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__param(2, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__param(3, (0, identity_server_1.CurrentUser)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String, String, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], DeleteEntryController.prototype, "restore", null);
+tslib_1.__decorate([
+    (0, common_1.Delete)(':typeName/:id/permanent'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.NO_CONTENT),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__param(2, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__param(3, (0, identity_server_1.CurrentUser)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String, String, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], DeleteEntryController.prototype, "purge", null);
+exports.DeleteEntryController = DeleteEntryController = tslib_1.__decorate([
+    (0, common_1.UseGuards)(identity_server_1.OriginGuard, identity_server_1.PermissionsGuard, workspaces_server_1.WorkspaceGuard, content_grant_guard_1.ContentGrantGuard),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.CONTENT_DELETE),
+    (0, common_1.Controller)('content'),
+    tslib_1.__param(0, (0, content_tokens_1.InjectContentRegistry)()),
+    tslib_1.__metadata("design:paramtypes", [Function, entry_writer_service_1.EntryWriterService])
+], DeleteEntryController);

package/dist/lib/entries/http/controllers/get-entry.controller.d.ts

@@ -0,0 +1,44 @@
+import type { ContentTypeRegistry } from '../../../registry/content-type-registry';
+import { EntryWriterService } from '../../infrastructure/persistence/entry-writer.service';
+import { MediaRefsQuery } from '../../infrastructure/queries/media-refs.query';
+import type { EntryMediaView, EntryRecord, EntryRelationsView, RelationFieldView } from '../../types/entry-list-view';
+/**
+ * `GET /api/content/:typeName/:id` — one live entry by id (404 if unknown or
+ * soft-deleted), so the editor can open an entry by deep link without relying on
+ * the records-list cache. `WorkspaceGuard` scopes it to a workspace the caller
+ * belongs to; gated on `content:read`.
+ */
+export declare class GetEntryController {
+    private readonly registry;
+    private readonly writer;
+    private readonly mediaRefs;
+    constructor(registry: ContentTypeRegistry, writer: EntryWriterService, mediaRefs: MediaRefsQuery);
+    getOne(typeName: string, id: string, workspaceId: string): Promise<EntryRecord>;
+    /**
+     * `GET /api/content/:typeName/:id/media` — one entry's media fields resolved
+     * to display refs (name / thumbnail url / kind), keyed by field name, so the
+     * editor's Media tab renders assigned assets by thumbnail without a per-id
+     * round-trip. Empty when no media resolver is bound. 404 when the entry is
+     * missing or soft-deleted in this workspace. `content:read`.
+     */
+    getMedia(typeName: string, id: string, workspaceId: string): Promise<EntryMediaView>;
+    /**
+     * `GET /api/content/:typeName/:id/relations` — one entry's relation links,
+     * keyed by field name. Every relation field (owning single/many **and**
+     * inverse back-references) resolved to display-ready refs (id + title) in a
+     * bounded set of queries, so the editor can render assigned relations by
+     * title and seed the form value with their ids without a round-trip per
+     * link. 404 when the entry is missing or soft-deleted in this workspace.
+     */
+    getRelations(typeName: string, id: string, workspaceId: string): Promise<EntryRelationsView>;
+    /**
+     * `GET /api/content/:typeName/:id/relations/:field` — one page of a single
+     * relation field's links (`{ items, total }`), ordered by position. Drives
+     * the editor's infinite-scroll of a many/inverse relation, so a field with
+     * thousands of links is paged, never loaded whole. `?page=&pageSize=`
+     * (1-based; clamped). 400 if `field` isn't a relation; 404 if the entry is
+     * missing. `content:read`.
+     */
+    getRelationField(typeName: string, id: string, field: string, workspaceId: string, page?: string, pageSize?: string): Promise<RelationFieldView>;
+}
+//# sourceMappingURL=get-entry.controller.d.ts.map

package/dist/lib/entries/http/controllers/get-entry.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-entry.controller.d.ts","sourceRoot":"","sources":["../../../../../src/lib/entries/http/controllers/get-entry.controller.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uDAAuD,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,+CAA+C,CAAC;AAC/E,OAAO,KAAK,EACR,cAAc,EACd,WAAW,EACX,kBAAkB,EAClB,iBAAiB,EACpB,MAAM,6BAA6B,CAAC;AAIrC;;;;;GAKG;AACH,qBAGa,kBAAkB;IAGvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAFT,QAAQ,EAAE,mBAAmB,EAC7B,MAAM,EAAE,kBAAkB,EAC1B,SAAS,EAAE,cAAc;IAI9C,MAAM,CACiB,QAAQ,EAAE,MAAM,EACP,EAAE,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GACxC,OAAO,CAAC,WAAW,CAAC;IAKvB;;;;;;OAMG;IAEG,QAAQ,CACS,QAAQ,EAAE,MAAM,EACP,EAAE,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GACxC,OAAO,CAAC,cAAc,CAAC;IAa1B;;;;;;;OAOG;IAEG,YAAY,CACK,QAAQ,EAAE,MAAM,EACP,EAAE,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GACxC,OAAO,CAAC,kBAAkB,CAAC;IAO9B;;;;;;;OAOG;IAEH,gBAAgB,CACO,QAAQ,EAAE,MAAM,EACP,EAAE,EAAE,MAAM,EACtB,KAAK,EAAE,MAAM,EACT,WAAW,EAAE,MAAM,EACxB,IAAI,CAAC,EAAE,MAAM,EACT,QAAQ,CAAC,EAAE,MAAM,GACrC,OAAO,CAAC,iBAAiB,CAAC;CAWhC"}

package/dist/lib/entries/http/controllers/get-entry.controller.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetEntryController = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const identity_server_1 = require("@orthacms/identity-server");
+const workspaces_server_1 = require("@orthacms/workspaces-server");
+const content_grant_guard_1 = require("../guards/content-grant.guard");
+const utils_server_1 = require("@orthacms/utils-server");
+const entries_constants_1 = require("../../entries.constants");
+const content_tokens_1 = require("../../../content.tokens");
+const entry_writer_service_1 = require("../../infrastructure/persistence/entry-writer.service");
+const media_refs_query_1 = require("../../infrastructure/queries/media-refs.query");
+const relation_link_service_1 = require("../../infrastructure/persistence/relation-link.service");
+const resolve_type_1 = require("./resolve-type");
+/**
+ * `GET /api/content/:typeName/:id` — one live entry by id (404 if unknown or
+ * soft-deleted), so the editor can open an entry by deep link without relying on
+ * the records-list cache. `WorkspaceGuard` scopes it to a workspace the caller
+ * belongs to; gated on `content:read`.
+ */
+let GetEntryController = class GetEntryController {
+    registry;
+    writer;
+    mediaRefs;
+    constructor(registry, writer, mediaRefs) {
+        this.registry = registry;
+        this.writer = writer;
+        this.mediaRefs = mediaRefs;
+    }
+    getOne(typeName, id, workspaceId) {
+        const type = (0, resolve_type_1.resolveType)(this.registry, typeName);
+        return this.writer.getOne(type, id, workspaceId);
+    }
+    /**
+     * `GET /api/content/:typeName/:id/media` — one entry's media fields resolved
+     * to display refs (name / thumbnail url / kind), keyed by field name, so the
+     * editor's Media tab renders assigned assets by thumbnail without a per-id
+     * round-trip. Empty when no media resolver is bound. 404 when the entry is
+     * missing or soft-deleted in this workspace. `content:read`.
+     */
+    async getMedia(typeName, id, workspaceId) {
+        const type = (0, resolve_type_1.resolveType)(this.registry, typeName);
+        // 404s a missing/soft-deleted entry, and gives us its live values bag.
+        const entry = await this.writer.getOne(type, id, workspaceId);
+        return {
+            media: await this.mediaRefs.forValues(type, entry.values, workspaceId)
+        };
+    }
+    /**
+     * `GET /api/content/:typeName/:id/relations` — one entry's relation links,
+     * keyed by field name. Every relation field (owning single/many **and**
+     * inverse back-references) resolved to display-ready refs (id + title) in a
+     * bounded set of queries, so the editor can render assigned relations by
+     * title and seed the form value with their ids without a round-trip per
+     * link. 404 when the entry is missing or soft-deleted in this workspace.
+     */
+    async getRelations(typeName, id, workspaceId) {
+        const type = (0, resolve_type_1.resolveType)(this.registry, typeName);
+        return {
+            relations: await this.writer.getRelations(type, id, workspaceId)
+        };
+    }
+    /**
+     * `GET /api/content/:typeName/:id/relations/:field` — one page of a single
+     * relation field's links (`{ items, total }`), ordered by position. Drives
+     * the editor's infinite-scroll of a many/inverse relation, so a field with
+     * thousands of links is paged, never loaded whole. `?page=&pageSize=`
+     * (1-based; clamped). 400 if `field` isn't a relation; 404 if the entry is
+     * missing. `content:read`.
+     */
+    getRelationField(typeName, id, field, workspaceId, page, pageSize) {
+        const type = (0, resolve_type_1.resolveType)(this.registry, typeName);
+        return this.writer.getRelationField(type, id, field, (0, utils_server_1.clampInt)(page, 1, 1, Number.MAX_SAFE_INTEGER), (0, utils_server_1.clampInt)(pageSize, relation_link_service_1.RELATION_PAGE_SIZE, 1, entries_constants_1.MAX_PAGE_SIZE), workspaceId);
+    }
+};
+exports.GetEntryController = GetEntryController;
+tslib_1.__decorate([
+    (0, common_1.Get)(':typeName/:id'),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__param(2, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], GetEntryController.prototype, "getOne", null);
+tslib_1.__decorate([
+    (0, common_1.Get)(':typeName/:id/media'),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__param(2, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], GetEntryController.prototype, "getMedia", null);
+tslib_1.__decorate([
+    (0, common_1.Get)(':typeName/:id/relations'),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__param(2, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], GetEntryController.prototype, "getRelations", null);
+tslib_1.__decorate([
+    (0, common_1.Get)(':typeName/:id/relations/:field'),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__param(2, (0, common_1.Param)('field')),
+    tslib_1.__param(3, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__param(4, (0, common_1.Query)('page')),
+    tslib_1.__param(5, (0, common_1.Query)('pageSize')),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String, String, String, String, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], GetEntryController.prototype, "getRelationField", null);
+exports.GetEntryController = GetEntryController = tslib_1.__decorate([
+    (0, common_1.UseGuards)(identity_server_1.PermissionsGuard, workspaces_server_1.WorkspaceGuard, content_grant_guard_1.ContentGrantGuard),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.CONTENT_READ),
+    (0, common_1.Controller)('content'),
+    tslib_1.__param(0, (0, content_tokens_1.InjectContentRegistry)()),
+    tslib_1.__metadata("design:paramtypes", [Function, entry_writer_service_1.EntryWriterService,
+        media_refs_query_1.MediaRefsQuery])
+], GetEntryController);

package/dist/lib/entries/http/controllers/list-entries.controller.d.ts

@@ -0,0 +1,20 @@
+import type { ContentTypeRegistry } from '../../../registry/content-type-registry';
+import { EntriesService } from '../../infrastructure/queries/entries.service';
+import { ListEntriesQueryDto } from '../dto/list-entries-query.dto';
+import type { EntryListView } from '../../types/entry-list-view';
+/**
+ * `GET /api/content/:typeName` — one page of a collection's entries, filtered/
+ * searched/sorted via query params (`?search=`, `?filter=`, `?sort=`, `?page=`,
+ * `?pageSize=`). The `:typeName` is resolved from the registry (404 if unknown),
+ * so this single route serves every collection; the service runs the generic SQL
+ * pipeline against the type's generated table. Authentication is enforced by the
+ * app-wide AuthGuard; `WorkspaceGuard` scopes the request to a workspace the
+ * caller belongs to; read access is gated on `content:read`.
+ */
+export declare class ListEntriesController {
+    private readonly registry;
+    private readonly entries;
+    constructor(registry: ContentTypeRegistry, entries: EntriesService);
+    list(typeName: string, query: ListEntriesQueryDto, workspaceId: string): Promise<EntryListView>;
+}
+//# sourceMappingURL=list-entries.controller.d.ts.map

package/dist/lib/entries/http/controllers/list-entries.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-entries.controller.d.ts","sourceRoot":"","sources":["../../../../../src/lib/entries/http/controllers/list-entries.controller.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE;;;;;;;;GAQG;AACH,qBAGa,qBAAqB;IAG1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,cAAc;IAI5C,IAAI,CACmB,QAAQ,EAAE,MAAM,EAC1B,KAAK,EAAE,mBAAmB,EACf,WAAW,EAAE,MAAM,GACxC,OAAO,CAAC,aAAa,CAAC;CAO5B"}

package/dist/lib/entries/http/controllers/list-entries.controller.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ListEntriesController = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const identity_server_1 = require("@orthacms/identity-server");
+const workspaces_server_1 = require("@orthacms/workspaces-server");
+const content_grant_guard_1 = require("../guards/content-grant.guard");
+const content_tokens_1 = require("../../../content.tokens");
+const entries_service_1 = require("../../infrastructure/queries/entries.service");
+const list_entries_query_dto_1 = require("../dto/list-entries-query.dto");
+/**
+ * `GET /api/content/:typeName` — one page of a collection's entries, filtered/
+ * searched/sorted via query params (`?search=`, `?filter=`, `?sort=`, `?page=`,
+ * `?pageSize=`). The `:typeName` is resolved from the registry (404 if unknown),
+ * so this single route serves every collection; the service runs the generic SQL
+ * pipeline against the type's generated table. Authentication is enforced by the
+ * app-wide AuthGuard; `WorkspaceGuard` scopes the request to a workspace the
+ * caller belongs to; read access is gated on `content:read`.
+ */
+let ListEntriesController = class ListEntriesController {
+    registry;
+    entries;
+    constructor(registry, entries) {
+        this.registry = registry;
+        this.entries = entries;
+    }
+    list(typeName, query, workspaceId) {
+        const type = this.registry.get(typeName);
+        if (!type) {
+            throw new common_1.NotFoundException(`Unknown content type "${typeName}".`);
+        }
+        return this.entries.list(type, query, workspaceId);
+    }
+};
+exports.ListEntriesController = ListEntriesController;
+tslib_1.__decorate([
+    (0, common_1.Get)(':typeName'),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Query)()),
+    tslib_1.__param(2, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, list_entries_query_dto_1.ListEntriesQueryDto, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], ListEntriesController.prototype, "list", null);
+exports.ListEntriesController = ListEntriesController = tslib_1.__decorate([
+    (0, common_1.UseGuards)(identity_server_1.PermissionsGuard, workspaces_server_1.WorkspaceGuard, content_grant_guard_1.ContentGrantGuard),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.CONTENT_READ),
+    (0, common_1.Controller)('content'),
+    tslib_1.__param(0, (0, content_tokens_1.InjectContentRegistry)()),
+    tslib_1.__metadata("design:paramtypes", [Function, entries_service_1.EntriesService])
+], ListEntriesController);

package/dist/lib/entries/http/controllers/publish-entry.controller.d.ts

@@ -0,0 +1,22 @@
+import { type PublicUser } from '@orthacms/identity-server';
+import type { ContentTypeRegistry } from '../../../registry/content-type-registry';
+import { PublishEntryUseCase } from '../../application/use-cases/publish-entry.use-case';
+import { UnpublishEntryUseCase } from '../../application/use-cases/unpublish-entry.use-case';
+import type { EntryRecord } from '../../types/entry-list-view';
+/**
+ * `POST /api/content/:typeName/:id/publish` and `.../unpublish` — the publish
+ * workflow for a single entry. Publish revalidates the stored row (a 422 if the
+ * draft no longer passes), then stamps `status='published'` + `published_at`;
+ * unpublish reverts to draft. Both 400 on a non-publishable type and 404 on a
+ * missing live row. `OriginGuard` defends the writes; `WorkspaceGuard` scopes
+ * them to a workspace the caller belongs to; `content:publish` gates them.
+ */
+export declare class PublishEntryController {
+    private readonly registry;
+    private readonly publishEntry;
+    private readonly unpublishEntry;
+    constructor(registry: ContentTypeRegistry, publishEntry: PublishEntryUseCase, unpublishEntry: UnpublishEntryUseCase);
+    publish(typeName: string, id: string, workspaceId: string, user?: PublicUser): Promise<EntryRecord>;
+    unpublish(typeName: string, id: string, workspaceId: string, user?: PublicUser): Promise<EntryRecord>;
+}
+//# sourceMappingURL=publish-entry.controller.d.ts.map

package/dist/lib/entries/http/controllers/publish-entry.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-entry.controller.d.ts","sourceRoot":"","sources":["../../../../../src/lib/entries/http/controllers/publish-entry.controller.ts"],"names":[],"mappings":"AAOA,OAAO,EAKH,KAAK,UAAU,EAElB,MAAM,2BAA2B,CAAC;AAInC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oDAAoD,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,sDAAsD,CAAC;AAC7F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAI/D;;;;;;;GAOG;AACH,qBAGa,sBAAsB;IAG3B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBAFd,QAAQ,EAAE,mBAAmB,EAC7B,YAAY,EAAE,mBAAmB,EACjC,cAAc,EAAE,qBAAqB;IAI1D,OAAO,CACgB,QAAQ,EAAE,MAAM,EACP,EAAE,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACxB,IAAI,CAAC,EAAE,UAAU,GACjC,OAAO,CAAC,WAAW,CAAC;IAMvB,SAAS,CACc,QAAQ,EAAE,MAAM,EACP,EAAE,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACxB,IAAI,CAAC,EAAE,UAAU,GACjC,OAAO,CAAC,WAAW,CAAC;CAS1B"}

package/dist/lib/entries/http/controllers/publish-entry.controller.js

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PublishEntryController = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const identity_server_1 = require("@orthacms/identity-server");
+const workspaces_server_1 = require("@orthacms/workspaces-server");
+const content_grant_guard_1 = require("../guards/content-grant.guard");
+const content_tokens_1 = require("../../../content.tokens");
+const publish_entry_use_case_1 = require("../../application/use-cases/publish-entry.use-case");
+const unpublish_entry_use_case_1 = require("../../application/use-cases/unpublish-entry.use-case");
+const resolve_type_1 = require("./resolve-type");
+const to_actor_1 = require("./to-actor");
+/**
+ * `POST /api/content/:typeName/:id/publish` and `.../unpublish` — the publish
+ * workflow for a single entry. Publish revalidates the stored row (a 422 if the
+ * draft no longer passes), then stamps `status='published'` + `published_at`;
+ * unpublish reverts to draft. Both 400 on a non-publishable type and 404 on a
+ * missing live row. `OriginGuard` defends the writes; `WorkspaceGuard` scopes
+ * them to a workspace the caller belongs to; `content:publish` gates them.
+ */
+let PublishEntryController = class PublishEntryController {
+    registry;
+    publishEntry;
+    unpublishEntry;
+    constructor(registry, publishEntry, unpublishEntry) {
+        this.registry = registry;
+        this.publishEntry = publishEntry;
+        this.unpublishEntry = unpublishEntry;
+    }
+    publish(typeName, id, workspaceId, user) {
+        const type = (0, resolve_type_1.resolveType)(this.registry, typeName);
+        return this.publishEntry.execute(type, id, workspaceId, (0, to_actor_1.toActor)(user));
+    }
+    unpublish(typeName, id, workspaceId, user) {
+        const type = (0, resolve_type_1.resolveType)(this.registry, typeName);
+        return this.unpublishEntry.execute(type, id, workspaceId, (0, to_actor_1.toActor)(user));
+    }
+};
+exports.PublishEntryController = PublishEntryController;
+tslib_1.__decorate([
+    (0, common_1.Post)(':typeName/:id/publish'),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__param(2, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__param(3, (0, identity_server_1.CurrentUser)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String, String, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], PublishEntryController.prototype, "publish", null);
+tslib_1.__decorate([
+    (0, common_1.Post)(':typeName/:id/unpublish'),
+    tslib_1.__param(0, (0, common_1.Param)('typeName')),
+    tslib_1.__param(1, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    tslib_1.__param(2, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__param(3, (0, identity_server_1.CurrentUser)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String, String, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], PublishEntryController.prototype, "unpublish", null);
+exports.PublishEntryController = PublishEntryController = tslib_1.__decorate([
+    (0, common_1.UseGuards)(identity_server_1.OriginGuard, identity_server_1.PermissionsGuard, workspaces_server_1.WorkspaceGuard, content_grant_guard_1.ContentGrantGuard),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.CONTENT_PUBLISH),
+    (0, common_1.Controller)('content'),
+    tslib_1.__param(0, (0, content_tokens_1.InjectContentRegistry)()),
+    tslib_1.__metadata("design:paramtypes", [Function, publish_entry_use_case_1.PublishEntryUseCase,
+        unpublish_entry_use_case_1.UnpublishEntryUseCase])
+], PublishEntryController);

package/dist/lib/entries/http/controllers/resolve-type.d.ts

@@ -0,0 +1,9 @@
+import type { AnyContentType } from '../../../types/content-type';
+import type { ContentTypeRegistry } from '../../../registry/content-type-registry';
+/**
+ * Resolve a `:typeName` route param to a registered content type, or throw 404.
+ * Every entries controller routes one path per HTTP verb against the registry,
+ * so this single lookup keeps them thin and consistent.
+ */
+export declare function resolveType(registry: ContentTypeRegistry, typeName: string): AnyContentType;
+//# sourceMappingURL=resolve-type.d.ts.map

package/dist/lib/entries/http/controllers/resolve-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-type.d.ts","sourceRoot":"","sources":["../../../../../src/lib/entries/http/controllers/resolve-type.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAEnF;;;;GAIG;AACH,wBAAgB,WAAW,CACvB,QAAQ,EAAE,mBAAmB,EAC7B,QAAQ,EAAE,MAAM,GACjB,cAAc,CAMhB"}

package/dist/lib/entries/http/controllers/resolve-type.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveType = resolveType;
+const common_1 = require("@nestjs/common");
+/**
+ * Resolve a `:typeName` route param to a registered content type, or throw 404.
+ * Every entries controller routes one path per HTTP verb against the registry,
+ * so this single lookup keeps them thin and consistent.
+ */
+function resolveType(registry, typeName) {
+    const type = registry.get(typeName);
+    if (!type) {
+        throw new common_1.NotFoundException(`Unknown content type "${typeName}".`);
+    }
+    return type;
+}

package/dist/lib/entries/http/controllers/to-actor.d.ts

@@ -0,0 +1,13 @@
+import type { EventActor } from '@orthacms/database';
+import type { PublicUser } from '@orthacms/identity-server';
+/**
+ * The signed-in user as the {@link EventActor} an entry write stamps onto its
+ * domain events, or `undefined` when there is nobody to name.
+ *
+ * Shared by every entry write controller rather than restated per file: the
+ * audit log's whole claim is "who did what, when", and a route that quietly
+ * dropped the actor would answer the first third of that with "System" while
+ * looking identical to one that did not.
+ */
+export declare function toActor(user?: PublicUser): EventActor | undefined;
+//# sourceMappingURL=to-actor.d.ts.map

package/dist/lib/entries/http/controllers/to-actor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"to-actor.d.ts","sourceRoot":"","sources":["../../../../../src/lib/entries/http/controllers/to-actor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAEjE"}

package/dist/lib/entries/http/controllers/to-actor.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toActor = toActor;
+/**
+ * The signed-in user as the {@link EventActor} an entry write stamps onto its
+ * domain events, or `undefined` when there is nobody to name.
+ *
+ * Shared by every entry write controller rather than restated per file: the
+ * audit log's whole claim is "who did what, when", and a route that quietly
+ * dropped the actor would answer the first third of that with "System" while
+ * looking identical to one that did not.
+ */
+function toActor(user) {
+    return user ? { id: user.id, email: user.email ?? null } : undefined;
+}

package/dist/lib/entries/http/controllers/update-entry.controller.d.ts

@@ -0,0 +1,19 @@
+import { type PublicUser } from '@orthacms/identity-server';
+import type { ContentTypeRegistry } from '../../../registry/content-type-registry';
+import { EntryWriterService } from '../../infrastructure/persistence/entry-writer.service';
+import { SaveEntryDto } from '../dto/save-entry.dto';
+import type { EntryRecord } from '../../types/entry-list-view';
+/**
+ * `PATCH /api/content/:typeName/:id` — replace a live entry's values with a
+ * validated bag (the editor always submits the full document). 404 if there's no
+ * live row; 422 with the issue list on validation failure. `OriginGuard` defends
+ * this state-changing write; `WorkspaceGuard` scopes it to a workspace the caller
+ * belongs to; `content:update` gates it.
+ */
+export declare class UpdateEntryController {
+    private readonly registry;
+    private readonly writer;
+    constructor(registry: ContentTypeRegistry, writer: EntryWriterService);
+    update(typeName: string, id: string, body: SaveEntryDto, workspaceId: string, user?: PublicUser): Promise<EntryRecord>;
+}
+//# sourceMappingURL=update-entry.controller.d.ts.map