@orthacms/content-server 0.0.0-reserve.0

package/dist/lib/entries/infrastructure/persistence/entry-row.js

@@ -0,0 +1,185 @@
+"use strict";
+/**
+ * Pure row ↔ entry mappers shared by the read ({@link EntriesService}) and write
+ * ({@link EntryWriterService}) paths, so the wire shape and the column projection
+ * have one definition each. No DB access, no NestJS — just shape translation.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toRecord = toRecord;
+exports.coerceValues = coerceValues;
+exports.toColumns = toColumns;
+exports.entryTitle = entryTitle;
+exports.entrySlug = entrySlug;
+const content_domain_1 = require("@orthacms/content-domain");
+const fields_1 = require("../../../types/fields");
+/**
+ * Map a raw DB row to the admin {@link EntryRecord}: envelope fields plus a
+ * `values` bag keyed by field name. `status`/`publishedAt` are emitted only for
+ * publishable types. Relations that own no column — many-relations (their links live in join
+ * tables) and inverse/back-references (they reuse the owning side's storage) —
+ * aren't selected here; an owning single relation passes through as its FK uuid.
+ */
+function toRecord(type, row) {
+    const values = {};
+    for (const [name, spec] of Object.entries(type.fields)) {
+        if (spec.type === fields_1.CONTENT_FIELD_TYPE.Relation &&
+            (spec.relation?.many || spec.relation?.inverse))
+            continue;
+        values[name] = row[name] ?? null;
+    }
+    const record = {
+        id: row['id'],
+        createdAt: row['createdAt'].toISOString(),
+        updatedAt: row['updatedAt'].toISOString(),
+        values
+    };
+    if (type.publishable) {
+        record.status = row['status'];
+        // Carried alongside `status` because the two together name the publish
+        // state: a `draft` that has a `published_at` still has live content
+        // behind it (the admin's "Modified"), unlike one that never published.
+        const publishedAt = row['publishedAt'];
+        record.publishedAt = publishedAt ? publishedAt.toISOString() : null;
+    }
+    if (type.i18n) {
+        record.locale = row['locale'];
+        record.localeGroupId = row['localeGroupId'];
+    }
+    return record;
+}
+/**
+ * The shared empty-value test (see {@link isEmptyFieldValue}), taught the one
+ * thing it cannot see on its own: a **rich-text document** is a JSON object, so
+ * the empty one an editor leaves behind (`{ doc: [paragraph] }`) is neither
+ * null, nor blank, nor an empty array. Storing that instead of `null` would
+ * make a cleared body read as content — `required` would pass, the publish gate
+ * would let it through, and the admin's "Changed" badge would disagree with
+ * what the author sees.
+ */
+function isEmpty(value, spec) {
+    return spec?.type === fields_1.CONTENT_FIELD_TYPE.RichText
+        ? (0, content_domain_1.isEmptyRichText)(value)
+        : (0, fields_1.isEmptyFieldValue)(value);
+}
+/**
+ * Normalize the admin's (string-shaped) `values` bag to the proper JS types the
+ * validator and storage expect — numbers parsed, JSON text parsed, empties
+ * collapsed to null — keeping every field (so a many-relation array still
+ * validates). The single coercion point: both {@link toColumns} (storage) and
+ * the writer's validation run against the result, so they can't disagree on a
+ * value's type. Datetime/date stay ISO strings (the validator accepts them;
+ * {@link toColumns} converts datetime to `Date` for `timestamptz`).
+ */
+function coerceValues(type, values) {
+    const out = {};
+    for (const [name, spec] of Object.entries(type.fields)) {
+        let value = values[name];
+        if (isEmpty(value, spec)) {
+            out[name] = Array.isArray(value) ? value : null;
+            continue;
+        }
+        switch (spec.type) {
+            case fields_1.CONTENT_FIELD_TYPE.Number:
+            case fields_1.CONTENT_FIELD_TYPE.Money:
+                // NaN when unparseable — the validator reports "must be a number".
+                value = typeof value === 'number' ? value : Number(value);
+                break;
+            case fields_1.CONTENT_FIELD_TYPE.Json:
+                if (typeof value === 'string') {
+                    try {
+                        value = JSON.parse(value);
+                    }
+                    catch {
+                        // Unparseable: collapse to null rather than persist the
+                        // raw string into the jsonb column (which would store a
+                        // string scalar where consumers expect structured data).
+                        // Mirrors the invalid-date / NaN-number handling below.
+                        // A required Json field then fails validation as empty.
+                        value = null;
+                    }
+                }
+                break;
+        }
+        out[name] = value;
+    }
+    return out;
+}
+/**
+ * Project a (coerced) `values` bag onto the columns of a generated table for an
+ * insert/update. Includes only keys declared on the type (reserved envelope
+ * columns — `status`/`published_at`/`deleted_at`/timestamps — are owned by the
+ * service, never the client), skips relations that own no column (many-relations,
+ * whose links live in join tables, and inverse/back-references, which reuse the
+ * owning side's storage), collapses empties to `null`, converts a `datetime` to a `Date` for
+ * the `timestamptz` column (guarding an invalid date to `null` rather than
+ * letting `pg` throw), and drops a `NaN` number to `null`. A field absent from
+ * `values` is written as `null` — the editor submits the full bag, so a write
+ * replaces the whole document.
+ */
+function toColumns(type, values) {
+    const columns = {};
+    for (const [name, spec] of Object.entries(type.fields)) {
+        if (spec.type === fields_1.CONTENT_FIELD_TYPE.Relation &&
+            (spec.relation?.many || spec.relation?.inverse))
+            continue;
+        let value = values[name];
+        if (isEmpty(value, spec)) {
+            columns[name] = null;
+            continue;
+        }
+        if (spec.type === fields_1.CONTENT_FIELD_TYPE.Datetime) {
+            const date = value instanceof Date ? value : new Date(String(value));
+            value = Number.isNaN(date.getTime()) ? null : date;
+        }
+        else if (spec.type === fields_1.CONTENT_FIELD_TYPE.Number ||
+            spec.type === fields_1.CONTENT_FIELD_TYPE.Money) {
+            const num = typeof value === 'number' ? value : Number(value);
+            value = Number.isNaN(num) ? null : num;
+        }
+        columns[name] = value;
+    }
+    return columns;
+}
+/**
+ * Field types short enough to label a row by. Text first, then Select — both are
+ * compact strings, unlike richtext (potentially huge HTML).
+ */
+const TITLE_FIELD_TYPES = new Set([
+    fields_1.CONTENT_FIELD_TYPE.Text,
+    fields_1.CONTENT_FIELD_TYPE.Select
+]);
+/**
+ * A human display label for an entry — the first non-empty title-eligible field's
+ * value (see {@link TITLE_FIELD_TYPES}), falling back to the id. Used to label
+ * rows in the bulk-publish preview.
+ */
+function entryTitle(type, row) {
+    for (const [name, spec] of Object.entries(type.fields)) {
+        if (!TITLE_FIELD_TYPES.has(spec.type))
+            continue;
+        const value = row[name];
+        if (typeof value === 'string' && value.trim())
+            return value;
+    }
+    return row['id'];
+}
+/**
+ * The slug handle for an entry — the value of its **slug field**: the first
+ * field flagged `admin.widget === 'slug'`, else a field literally named `slug`.
+ * Returns the trimmed value when present and non-empty, otherwise `undefined`
+ * (the type has no slug field, or the row's slug is blank). Used to give a
+ * linked relation record a stable `/handle` in the admin.
+ */
+function entrySlug(type, row) {
+    let named;
+    for (const [name, spec] of Object.entries(type.fields)) {
+        const value = row[name];
+        if (typeof value !== 'string' || !value.trim())
+            continue;
+        if (spec.admin?.widget === 'slug')
+            return value;
+        if (name === 'slug')
+            named = value;
+    }
+    return named;
+}

package/dist/lib/entries/infrastructure/persistence/entry-writer.service.d.ts

@@ -0,0 +1,392 @@
+import { OutboxWriter, UnitOfWork, type Database, type EventActor } from '@orthacms/database';
+import { type ContentEntryExtension } from '../../../extension/entry-extension';
+import { type MediaAssetResolver } from '../../../extension/media-asset-resolver';
+import type { AnyContentType } from '../../../types/content-type';
+import { EntryValidationService, type ValidationIssue } from '../../../validation/services/entry-validation.service';
+import type { EntryRecord, RelationDelta, RelationFieldView } from '../../types/entry-list-view';
+import type { BulkActionResult } from '../../types/bulk-publish';
+import { RelationLinkService, type DbTransaction } from './relation-link.service';
+import { type RevisionStore } from '../../../revisions/application/ports/revision-store';
+/** A generated content table seen as a bag of values / columns by property name. */
+type Row = Record<string, unknown>;
+/**
+ * The infrastructure persistence engine for entry writes — create / read-one /
+ * update / delete / restore / purge, plus their bulk variants, plus the small
+ * status read/write primitives the **publish-lifecycle use-cases** compose
+ * (`findLive`, `markPublished`/`markDraft`, the bulk selectors, and
+ * `requiredRelationIssues`). Generic over the content type (like
+ * {@link EntriesService}): the physical table and its envelope columns are
+ * derived from `type` at request time, so one engine backs every collection.
+ *
+ * Layering note (ADR-0003): the entries engine is generic and registry-driven —
+ * one service backs every content type, with no per-aggregate table — so the
+ * heavy, battle-tested column/relation/extension persistence stays here as
+ * infrastructure rather than being forced into a row⇄aggregate mapper. The
+ * publish **lifecycle** (the part with real invariants) is modelled by the
+ * `Entry` domain object and driven by application use-cases, which call the
+ * status primitives below through the {@link UnitOfWork} so the write and its
+ * outbox events commit atomically. {@link EntryValidationService} remains the
+ * gate — nothing is written or published without passing it.
+ */
+export declare class EntryWriterService {
+    private readonly db;
+    private readonly uow;
+    private readonly outbox;
+    private readonly validation;
+    private readonly relations;
+    private readonly revisionStore;
+    private readonly extension?;
+    private readonly mediaResolver?;
+    constructor(db: Database, uow: UnitOfWork, outbox: OutboxWriter, validation: EntryValidationService, relations: RelationLinkService, revisionStore: RevisionStore, extension?: ContentEntryExtension | undefined, mediaResolver?: MediaAssetResolver | undefined);
+    /**
+     * The active unit-of-work transaction, typed as the handle drizzle hands a
+     * `db.transaction` callback.
+     *
+     * `UnitOfWork` stores exactly that object and publishes it as `Database`,
+     * because most callers only need the query surface — while this file's
+     * helpers, `RelationLinkService`, and the `CONTENT_ENTRY_EXTENSION` port are
+     * all typed against the transaction handle. Only ever called from inside
+     * `uow.run(...)`, where the two are the same object.
+     */
+    private tx;
+    /** One event per affected row, built from each row's own id. */
+    private eventsFor;
+    /**
+     * Append `events` to the transactional outbox, stamped with the acting
+     * user, from inside the active unit of work.
+     *
+     * `actor` is `null` for a write made with an API token: revisions record a
+     * *user* id and a token is not one, and an audit row naming a person who
+     * did not do it is worse than one that says "System". Attributing a token's
+     * writes is a real gap that wants its own column, not a misused one.
+     */
+    private emit;
+    /**
+     * The declared fields whose stored value differs between two rows — what
+     * `entry.updated` reports, and the test for whether it is raised at all.
+     *
+     * Compared by JSON shape rather than identity so a jsonb field (`json`,
+     * `multiselect`, a media array) is judged on content, and only over
+     * `type.fields`: the envelope columns a save always rewrites
+     * (`updated_at`, and `status` on a publishable type) are not editorial
+     * changes and would make every save look like one.
+     */
+    private changedFields;
+    /**
+     * Fold any `relations: { <singleField>: { set } }` entries into the values
+     * bag, resolving `by: "localeGroup"` on the way, and return the deltas with
+     * those fields removed.
+     *
+     * Done **before** the write rather than alongside the link deltas, because a
+     * single relation is a column on the row itself: routing it through `values`
+     * means the row is written once, and the resolved id then passes through
+     * `assertRelationTargets` — existence, workspace, and the same-locale rule —
+     * with no second implementation of any of them.
+     *
+     * The field must not appear in both bags. One of the two would have to win
+     * silently, and a caller who set it twice does not know which they meant.
+     * Reads the **raw** submitted values for that test — `coerceValues` stamps
+     * every declared field, so after coercion every field is "present".
+     */
+    private foldSingleRelationSets;
+    /**
+     * The locale of one live row, or `undefined` on a type that has none.
+     *
+     * A relation link may not cross locales, and an update's target checks run
+     * before the transaction opens — so the row's locale has to be read up
+     * front. Costs one indexed lookup, and only on localized types: a non-i18n
+     * type short-circuits without touching the database.
+     */
+    private localeOf;
+    /**
+     * Append an immutable **draft** revision for a just-saved row, on the save's
+     * own transaction so the snapshot commits atomically with it. Captures the
+     * whole document — the field `values` bag plus the full ordered link sets of
+     * every join-backed relation (read back inside `tx`, so it reflects the
+     * committed state). The entry's append lock serializes concurrent savers so
+     * each allocates a distinct version number.
+     */
+    private appendRevision;
+    /**
+     * Append a revision for each row an extension changed as a side-effect of
+     * this save — the locale siblings a shared (non-localized) field is synced
+     * to, today.
+     *
+     * Without this their stored values move while their timeline doesn't, so
+     * the history claims a change that never happened to them and hides one
+     * that did. Rows are sorted by id before appending: each takes a per-entry
+     * advisory lock, and a stable order across concurrent savers is what keeps
+     * two of them from deadlocking on the pair.
+     */
+    private appendRevisionsFor;
+    /**
+     * Create an entry **owned by `workspaceId`** (stamped onto the row so the
+     * reader's workspace filter and every later scoped write see it). A
+     * publishable type starts as a **draft** and may be incomplete — validation
+     * is deferred to publish. A non-publishable type is always live, so its
+     * values must validate now.
+     *
+     * The insert runs in a transaction that first takes the workspace's *shared*
+     * content lock ({@link lockWorkspaceShared}): it coordinates with the
+     * workspace delete / content-revoke guards (which take the lock exclusively),
+     * so a new entry can't land between their emptiness check and their mutation
+     * and be orphaned. Shared mode keeps concurrent creates non-blocking.
+     *
+     * `locale` / `localeGroupId` are opaque, extension-owned params: the bound
+     * extension validates them and stamps the envelope columns (a
+     * `localeGroupId` makes the row a **sibling** in that translation group). A
+     * duplicate `(group, locale)` surfaces as a **409** via {@link uniqueGuarded}.
+     */
+    create(type: AnyContentType, values: Record<string, unknown>, workspaceId: string, relations?: Record<string, RelationDelta>, locale?: string, localeGroupId?: string, actor?: EventActor | null): Promise<EntryRecord>;
+    /**
+     * First page (+ total) of every relation field's links for one live entry,
+     * keyed by field name — what the editor loads on open. Each field is
+     * paginated, so a relation with many links contributes only its first page.
+     * 404 if the entry is missing (or soft-deleted) in this workspace.
+     */
+    getRelations(type: AnyContentType, id: string, workspaceId: string): Promise<Record<string, RelationFieldView>>;
+    /**
+     * One page of a single relation field's links (infinite-scroll for a
+     * many/inverse relation). 404 if the entry is missing; 400 if `field` isn't a
+     * relation on the type.
+     */
+    getRelationField(type: AnyContentType, id: string, field: string, page: number, pageSize: number, workspaceId: string): Promise<RelationFieldView>;
+    /**
+     * Apply the staged per-field relation deltas of a save, inside the entry's
+     * transaction — so the row and every link change commit or roll back as one.
+     * Each field must be a **many/inverse** relation (a single relation is set
+     * through `values`); a single-relation or unknown key is a 400. `applyDelta`
+     * validates the linked ids against the workspace (422 on a bad target).
+     */
+    private applyRelationDeltas;
+    /** Resolve a relation field spec on the type, or 400 if it isn't one. */
+    private relationSpec;
+    /** Read one live entry in the workspace, or 404. */
+    getOne(type: AnyContentType, id: string, workspaceId: string): Promise<EntryRecord>;
+    /**
+     * Replace a live entry's values, or 404. As with {@link create}, a
+     * publishable type's values aren't validated here (a draft may be saved
+     * incomplete; publish enforces the rules) — a non-publishable, always-live
+     * type validates now.
+     */
+    update(type: AnyContentType, id: string, values: Record<string, unknown>, workspaceId: string, relations?: Record<string, RelationDelta>, actor?: EventActor | null, options?: {
+        /**
+         * Whether this write appends a version of its own (default `true`).
+         * Set `false` by the publish-a-specific-version path, which re-applies
+         * an existing version's snapshot to the live row: that version is
+         * marked published in place, so minting a copy of it would add a
+         * duplicate entry to the timeline for every publish. Locale siblings
+         * the extension rewrites still get their versions — their content
+         * really did change.
+         */
+        appendRevision?: boolean;
+    }): Promise<EntryRecord>;
+    /**
+     * Stamp `status='published'` + `published_at`/`updated_at` on one live row,
+     * returning the updated row (or undefined if none matched, i.e. a 404).
+     */
+    markPublished(exec: Database | DbTransaction, type: AnyContentType, id: string, workspaceId: string): Promise<Row | undefined>;
+    /**
+     * Transition the entry's **revision history** to reflect a publish: one
+     * revision becomes the live (`published`) version and any prior published
+     * one is `superseded`. Runs on the publish transaction's executor (the
+     * active unit of work) so the row's status and its history commit as one.
+     * Delegates to the revision store — every revision is minted a draft, so
+     * this is what makes a published entry read as "Live" in the timeline.
+     *
+     * `revisionNumber` targets a **specific** version (publishing an earlier one
+     * in place); omitted, it targets the latest — the row that was just saved.
+     */
+    markRevisionPublished(exec: Database | DbTransaction, entryId: string, workspaceId: string, revisionNumber?: number): Promise<void>;
+    /**
+     * Revert the entry's published revision back to `draft` on `exec` — the
+     * unpublish counterpart to {@link markRevisionPublished}.
+     */
+    markRevisionUnpublished(exec: Database | DbTransaction, entryId: string, workspaceId: string): Promise<void>;
+    /** Revert one live row to `status='draft'` (clearing `published_at`) on `exec`. */
+    markDraft(exec: Database | DbTransaction, type: AnyContentType, id: string, workspaceId: string): Promise<Row | undefined>;
+    /**
+     * Load the workspace's live rows for `ids` **`FOR UPDATE`** on `exec`, keyed
+     * by id — the locked candidate set a bulk publish re-validates inside its
+     * transaction (closing the preview→commit TOCTOU window the comments on the
+     * original single-transaction bulk publish defended).
+     */
+    loadLiveByIdsForUpdate(exec: Database | DbTransaction, type: AnyContentType, ids: string[], workspaceId: string): Promise<Map<string, Row>>;
+    /** Publish a set of ids in one statement on `exec` (the caller pre-filtered them). */
+    markPublishedBulk(exec: Database | DbTransaction, type: AnyContentType, ids: string[], workspaceId: string): Promise<void>;
+    /**
+     * Which of `ids` are currently `published` and live in the workspace, on
+     * `exec` — the set a bulk unpublish actually transitions, so it raises one
+     * `entry.unpublished` per real change rather than per matched row.
+     */
+    publishedIdsAmong(exec: Database | DbTransaction, type: AnyContentType, ids: string[], workspaceId: string): Promise<string[]>;
+    /**
+     * Revert the **published** rows among `ids` to draft on `exec`, returning
+     * how many actually transitioned — the `{ count }` the bulk endpoint
+     * reports.
+     *
+     * The status predicate is the whole of it, and it was missing: without it
+     * the `UPDATE` matched every live row in the list, so unpublishing two ids
+     * of which one was already a draft answered `{ count: 2 }` — which is what
+     * the route's own OpenAPI description promises it never does ("an id that
+     * was not a live published row … is not counted"). It also stamped
+     * `updatedAt` on rows nothing happened to, moving an entry up a
+     * last-modified sort because somebody unpublished a *different* one.
+     */
+    markDraftBulk(exec: Database | DbTransaction, type: AnyContentType, ids: string[], workspaceId: string): Promise<number>;
+    /**
+     * Delete an entry: soft (stamp `deleted_at`) for a paranoid type, hard
+     * `DELETE` otherwise. 404 if there's no live row to remove **in this
+     * workspace** — an id from another workspace is indistinguishable from a
+     * missing one.
+     */
+    remove(type: AnyContentType, id: string, workspaceId: string, actor?: EventActor | null): Promise<void>;
+    /**
+     * Clear a soft-deleted entry's tombstone (paranoid types only), or 404.
+     * On an i18n type the restore can collide with a row created in the same
+     * (locale group, locale) slot after the soft delete — the partial unique
+     * index rejects it, surfaced as a 409 rather than a 500.
+     */
+    restore(type: AnyContentType, id: string, workspaceId: string, actor?: EventActor | null): Promise<EntryRecord>;
+    /** Permanently delete a tombstoned entry (paranoid types only), or 404. */
+    purge(type: AnyContentType, id: string, workspaceId: string, actor?: EventActor | null): Promise<void>;
+    /** Delete a set of entries: soft for paranoid types, hard otherwise. */
+    bulkRemove(type: AnyContentType, ids: string[], workspaceId: string, actor?: EventActor | null): Promise<BulkActionResult>;
+    /** Permanently delete a set of tombstoned entries (paranoid types only). */
+    bulkPurge(type: AnyContentType, ids: string[], workspaceId: string, actor?: EventActor | null): Promise<BulkActionResult>;
+    /**
+     * Restore a set of soft-deleted entries (paranoid types only). As with
+     * {@link restore}, a restored row colliding with a live sibling in its
+     * (locale group, locale) slot is a 409 — the whole batch rolls back
+     * (single statement), so the caller can retry without the conflicting id.
+     */
+    bulkRestore(type: AnyContentType, ids: string[], workspaceId: string, actor?: EventActor | null): Promise<BulkActionResult>;
+    /**
+     * Run a write, translating a Postgres unique violation (23505) into a 409.
+     * Only i18n types carry a restore-relevant unique index — the partial
+     * `(locale_group_id, locale)` one — so the mapping is scoped to them and
+     * any other type's violation still surfaces as the bug it is.
+     */
+    /**
+     * Run a delete and translate a Postgres **foreign-key** violation into a
+     * `409`.
+     *
+     * A required single relation declares `onDelete: 'restrict'` (a NOT NULL FK
+     * cannot be nulled on delete), so deleting a row something still points at
+     * is refused by the database. That refusal is legitimate and actionable —
+     * "detach the referring records first" — but it surfaced as a raw `500`,
+     * which tells the caller the server broke and gives them nothing to do. The
+     * symmetric counterpart of {@link uniqueGuarded}.
+     *
+     * Deliberately does not name the referring rows: finding them means a query
+     * per inbound relation across every type in the registry, and the caller
+     * cannot be told about records in workspaces they cannot see.
+     */
+    private restrictGuarded;
+    private uniqueGuarded;
+    /** The type's generated table seen as a column bag (envelope + fields). */
+    private columns;
+    /**
+     * `workspace_id = :workspaceId` — the ownership predicate every read and
+     * write AND-s in, so a request scoped to one workspace can neither see nor
+     * mutate another's rows.
+     */
+    private scope;
+    /**
+     * `id = :id` AND the workspace scope AND (for paranoid types)
+     * `deleted_at IS NULL`.
+     */
+    private liveWhere;
+    /**
+     * Fetch one live row by id in the workspace, or undefined. Public + executor
+     * parameterized so the publish-lifecycle use-cases can read it under the
+     * active unit of work; internal callers use the default (base connection).
+     */
+    findLive(type: AnyContentType, id: string, workspaceId: string, exec?: Database | DbTransaction): Promise<Row | undefined>;
+    /**
+     * Fetch the workspace's live rows for a set of ids, keyed by id — the
+     * bulk-publish **dry run** (no `FOR UPDATE`; the committed path uses
+     * {@link loadLiveByIdsForUpdate}).
+     */
+    loadLiveByIds(type: AnyContentType, ids: string[], workspaceId: string, exec?: Database | DbTransaction): Promise<Map<string, Row>>;
+    /**
+     * Verify every referenced relation target exists **in the same workspace** —
+     * single FKs, many-to-many links, and the inverse (back-reference) side of a
+     * two-way relation. Neither the FK column nor the join table has a workspace
+     * constraint of its own (the target table is workspace-scoped only at the app
+     * layer), so without this a caller could reference — or probe the existence
+     * of — an entry in another workspace. Batched one existence query per
+     * referenced target type; a missing or cross-workspace target surfaces as a
+     * uniform 422 validation issue (indistinguishable from a plain "invalid id",
+     * so no not-found-vs-forbidden enumeration signal). Runs on every
+     * create/update, draft or not, because links are written eagerly either way.
+     * An inverse-of-single (one-to-many) field owns no writable link from this
+     * side, so it's skipped.
+     */
+    /**
+     * Reject a `unique: true` single relation whose target is already claimed
+     * — by a **different record**, in the locale being written.
+     *
+     * The database settles this too (a column-wide UNIQUE on a plain type, a
+     * per-locale `(<field>_id, locale)` index on a localized one), and it has to
+     * stay there: it is the only thing that holds under concurrency. This check
+     * exists for the message, not the guarantee. A raw 23505 surfaces as a 500
+     * with a constraint name in it; the caller needs to know *which field* is
+     * taken, in the same `{ field, message }` shape as every other entry
+     * validation error.
+     *
+     * "Different record" is the whole subtlety on a localized type. The English
+     * and German rows of one article are two rows and one record, and a relation
+     * synced across the group deliberately puts the same id in both — so this
+     * compares translation **groups**, not row ids. Excluding only `entryId`
+     * would make the second locale of a record look like a rival claimant to the
+     * target the record already owns.
+     */
+    private assertUniqueRelations;
+    private assertRelationTargets;
+    /**
+     * Validate every media field's asset ids: each must reference an asset that
+     * **exists in the same workspace** and whose kind/MIME satisfies the field's
+     * `accept` restriction. Mirrors {@link assertRelationTargets} — asset ids are
+     * plain uuids with no FK (the assets live in the media plugin's schema), so
+     * without this a caller could reference — or probe — an asset in another
+     * workspace, or attach a disallowed file type. Batched: one resolver lookup
+     * across every media id on the entry.
+     *
+     * A **missing** asset and a **cross-workspace** one both read as the same
+     * uniform 422 (the resolver simply omits them from its map — no
+     * not-found-vs-forbidden enumeration signal). When no resolver is bound (the
+     * media plugin isn't registered) this is a no-op: media fields shape-validate
+     * and store their ids, but existence/restriction aren't enforced.
+     */
+    private assertMediaTargets;
+    /**
+     * Enforce required **link-managed** relations (an owning many-to-many, or the
+     * inverse of one) against the entry's actual link set — the check
+     * {@link EntryValidationService} can't make, because those links never travel
+     * in the `values` bag it sees. A required such relation with zero links is a
+     * 422 `is required`, matching how a required scalar field reads. A single FK
+     * relation is validated in `values` already; an inverse-of-single owns no
+     * writable link from this side, so it's skipped (it can't be satisfied here).
+     * `exec` is the write transaction on create/update (so it counts the
+     * just-written, uncommitted rows) or the root client on publish (committed).
+     */
+    private assertRequiredRelations;
+    /**
+     * The `is required` issues for required **link-managed** relations (an owning
+     * many-to-many, or the inverse of one) whose link set is empty — the check
+     * {@link EntryValidationService} can't make, since those links never travel
+     * in the `values` bag. Returns the issues rather than throwing, so the
+     * publish use-case can fold them into the `Entry` domain publish gate. `exec`
+     * is the write transaction (counting just-written rows) on create/update, or
+     * the unit-of-work transaction on publish.
+     */
+    requiredRelationIssues(exec: Database | DbTransaction, type: AnyContentType, row: Row, workspaceId: string): Promise<ValidationIssue[]>;
+    /** Throw 422 with the issue list when the values fail validation. */
+    private assertValid;
+    /** Reject restore/purge on a type without soft delete. */
+    private assertParanoid;
+    private notFound;
+}
+export {};
+//# sourceMappingURL=entry-writer.service.d.ts.map

package/dist/lib/entries/infrastructure/persistence/entry-writer.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-writer.service.d.ts","sourceRoot":"","sources":["../../../../../src/lib/entries/infrastructure/persistence/entry-writer.service.ts"],"names":[],"mappings":"AAoBA,OAAO,EAGH,YAAY,EACZ,UAAU,EACV,KAAK,QAAQ,EAEb,KAAK,UAAU,EAClB,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EAEH,KAAK,qBAAqB,EAC7B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAEH,KAAK,kBAAkB,EAC1B,MAAM,yCAAyC,CAAC;AAEjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAGlE,OAAO,EACH,sBAAsB,EACtB,KAAK,eAAe,EACvB,MAAM,uDAAuD,CAAC;AAC/D,OAAO,KAAK,EACR,WAAW,EACX,aAAa,EACb,iBAAiB,EACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,OAAO,EAEH,mBAAmB,EACnB,KAAK,aAAa,EACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAEH,KAAK,aAAa,EACrB,MAAM,qDAAqD,CAAC;AAW7D,oFAAoF;AACpF,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAenC;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,kBAAkB;IAEL,OAAO,CAAC,QAAQ,CAAC,EAAE;IAIrC,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAI1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAK9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAO3B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAvBI,EAAE,EAAE,QAAQ,EAI9B,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,YAAY,EACpB,UAAU,EAAE,sBAAsB,EAClC,SAAS,EAAE,mBAAmB,EAI9B,aAAa,EAAE,aAAa,EAK5B,SAAS,CAAC,EAAE,qBAAqB,YAAA,EAOjC,aAAa,CAAC,EAAE,kBAAkB,YAAA;IAGvD;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE;IAIV,gEAAgE;IAChE,OAAO,CAAC,SAAS;IAOjB;;;;;;;;OAQG;YACW,IAAI;IASlB;;;;;;;;;OASG;IACH,OAAO,CAAC,aAAa;IAarB;;;;;;;;;;;;;;;OAeG;YACW,sBAAsB;IAwDpC;;;;;;;OAOG;YACW,QAAQ;IAuBtB;;;;;;;OAOG;YACW,cAAc;IAwB5B;;;;;;;;;;OAUG;YACW,kBAAkB;IAsBhC;;;;;;;;;;;;;;;;;OAiBG;IACG,MAAM,CACR,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,EACzC,MAAM,CAAC,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,GAC1B,OAAO,CAAC,WAAW,CAAC;IAyJvB;;;;;OAKG;IACG,YAAY,CACd,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAM7C;;;;OAIG;IACG,gBAAgB,CAClB,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,iBAAiB,CAAC;IAe7B;;;;;;OAMG;YACW,mBAAmB;IAuCjC,yEAAyE;IACzE,OAAO,CAAC,YAAY;IAUpB,oDAAoD;IAC9C,MAAM,CACR,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,CAAC;IAMvB;;;;;OAKG;IACG,MAAM,CACR,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,EACzC,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,EACzB,OAAO,CAAC,EAAE;QACN;;;;;;;;WAQG;QACH,cAAc,CAAC,EAAE,OAAO,CAAC;KAC5B,GACF,OAAO,CAAC,WAAW,CAAC;IA2JvB;;;OAGG;IACG,aAAa,CACf,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;IAa3B;;;;;;;;;;OAUG;IACG,qBAAqB,CACvB,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,cAAc,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,IAAI,CAAC;IAShB;;;OAGG;IACG,uBAAuB,CACzB,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAIhB,mFAAmF;IAC7E,SAAS,CACX,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;IAa3B;;;;;OAKG;IACG,sBAAsB,CACxB,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAkB5B,sFAAsF;IAChF,iBAAiB,CACnB,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAoBhB;;;;OAIG;IACG,iBAAiB,CACnB,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,EAAE,CAAC;IAkBpB;;;;;;;;;;;;OAYG;IACG,aAAa,CACf,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC;IAsBlB;;;;;OAKG;IACG,MAAM,CACR,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,GAC1B,OAAO,CAAC,IAAI,CAAC;IAwChB;;;;;OAKG;IACG,OAAO,CACT,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,GAC1B,OAAO,CAAC,WAAW,CAAC;IA6BvB,2EAA2E;IACrE,KAAK,CACP,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,GAC1B,OAAO,CAAC,IAAI,CAAC;IA0BhB,wEAAwE;IAClE,UAAU,CACZ,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,GAC1B,OAAO,CAAC,gBAAgB,CAAC;IAyC5B,4EAA4E;IACtE,SAAS,CACX,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,GAC1B,OAAO,CAAC,gBAAgB,CAAC;IA8B5B;;;;;OAKG;IACG,WAAW,CACb,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,GAC1B,OAAO,CAAC,gBAAgB,CAAC;IAkC5B;;;;;OAKG;IACH;;;;;;;;;;;;;;OAcG;YACW,eAAe;YAcf,aAAa;IA8C3B,2EAA2E;IAC3E,OAAO,CAAC,OAAO;IAIf;;;;OAIG;IACH,OAAO,CAAC,KAAK;IAIb;;;OAGG;IACH,OAAO,CAAC,SAAS;IAajB;;;;OAIG;IACG,QAAQ,CACV,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,QAAQ,GAAG,aAAuB,GACzC,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;IAS3B;;;;OAIG;IACG,aAAa,CACf,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,QAAQ,GAAG,aAAuB,GACzC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAgB5B;;;;;;;;;;;;;OAaG;IACH;;;;;;;;;;;;;;;;;;OAkBG;YACW,qBAAqB;YA4DrB,qBAAqB;IAwGnC;;;;;;;;;;;;;;OAcG;YACW,kBAAkB;IAoDhC;;;;;;;;;;OAUG;YACW,uBAAuB;IAoBrC;;;;;;;;OAQG;IACG,sBAAsB,CACxB,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,eAAe,EAAE,CAAC;IA8B7B,qEAAqE;IACrE,OAAO,CAAC,WAAW;IAanB,0DAA0D;IAC1D,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,QAAQ;CAKnB"}