@orthacms/content-server 0.0.0-reserve.0

package/dist/lib/entries/services/entries.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entries.service.d.ts","sourceRoot":"","sources":["../../../../src/lib/entries/services/entries.service.ts"],"names":[],"mappings":"AAcA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpE,OAAO,EAEH,KAAK,qBAAqB,EAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,EAEH,KAAK,mBAAmB,EAC3B,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAiB9D;;;;;;GAMG;AACH,qBACa,cAAc;IAED,OAAO,CAAC,QAAQ,CAAC,EAAE;IAKrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBALQ,EAAE,EAAE,QAAQ,EAK9B,SAAS,CAAC,EAAE,qBAAqB,YAAA;IAGtD;;;;;;OAMG;IACG,IAAI,CACN,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,mBAAmB,EAC1B,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,aAAa,CAAC;IA8BzB;;;;;;;OAOG;YACW,SAAS;IAqCvB;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAWxB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAcvB;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;CAsBlB"}

package/dist/lib/entries/services/entry-counter.service.d.ts

@@ -0,0 +1,31 @@
+import { type Database } from '@ortha-cms/database';
+import type { ContentEntryCounter } from '@ortha-cms/identity-server';
+import type { ContentTypeRegistry } from '../../registry/content-type-registry';
+/**
+ * Implements identity's {@link ContentEntryCounter} port over the generated
+ * `content_<name>` tables: counts how many entries of a content type a
+ * workspace holds. Bound to `CONTENT_ENTRY_COUNTER` in {@link ContentModule},
+ * so identity's "revoke a content-type grant only when empty" rule resolves
+ * against the real stored entries.
+ */
+export declare class EntryCounterService implements ContentEntryCounter {
+    private readonly db;
+    private readonly registry;
+    constructor(db: Database, registry: ContentTypeRegistry);
+    /**
+     * Every stored row of content type `slug` in `workspaceId`. Counts the
+     * whole workspace slice of the type's table — including soft-deleted rows
+     * for paranoid types (data that still exists must keep the grant). An
+     * unknown slug (no such content type) counts as `0`.
+     */
+    countEntries(workspaceId: string, slug: string): Promise<number>;
+    /**
+     * Every stored row the workspace holds across **all** content types —
+     * summed over each type's table. Backs the workspace-delete guard (delete is
+     * refused until this is zero). The per-type counts run concurrently.
+     */
+    countWorkspaceEntries(workspaceId: string): Promise<number>;
+    /** Counts a single content type's rows in a workspace. */
+    private countTable;
+}
+//# sourceMappingURL=entry-counter.service.d.ts.map

package/dist/lib/entries/services/entry-counter.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-counter.service.d.ts","sourceRoot":"","sources":["../../../../src/lib/entries/services/entry-counter.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAMhF;;;;;;GAMG;AACH,qBACa,mBAAoB,YAAW,mBAAmB;IAErC,OAAO,CAAC,QAAQ,CAAC,EAAE;IACZ,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADf,EAAE,EAAE,QAAQ,EACL,QAAQ,EAAE,mBAAmB;IAG3E;;;;;OAKG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAMtE;;;;OAIG;IACG,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IASjE,0DAA0D;YAC5C,UAAU;CAW3B"}

package/dist/lib/entries/services/entry-filter-schema.d.ts

@@ -0,0 +1,32 @@
+import { type FieldSchema, type FilterSchema } from '@ortha-cms/utils-server';
+import { type AnyContentType } from '../../types/content-type';
+import { type AnyFieldSpec } from '../../types/fields';
+/**
+ * Whether a field is backed by a comparable scalar column — the single source of
+ * truth for "can this field be filtered or sorted". `json`/`multiselect` (jsonb)
+ * and `relation` (FK uuid / join table) are not: they have no scalar editor and
+ * ordering them is meaningless. The sort whitelist and the filter schema both
+ * derive from this, so the two can't drift apart.
+ */
+export declare function isScalarField(spec: AnyFieldSpec): boolean;
+/**
+ * Build the query-builder `FilterSchema` for one content type at request time.
+ * Whitelists the always-present envelope columns (`createdAt`/`updatedAt`),
+ * plus `status`/`publishedAt` only on publishable types, plus `locale` on i18n
+ * types, plus every filterable field (those `isScalarField` admits — the same
+ * set the admin's `filterFieldsFromSchema` offers), keyed by the property
+ * names the engine resolves to table columns. (`status` has a matching admin
+ * filter; the timestamp envelopes like `publishedAt` are filterable via the
+ * API but have no UI control yet.) This is the security boundary: only listed
+ * fields/ops reach SQL, and the engine's depth/node caps bound payload
+ * blow-up.
+ *
+ * `extensionFields` are **virtual** fields contributed by the bound
+ * `CONTENT_ENTRY_EXTENSION` (e.g. locale aggregates): their declarations merge
+ * into `fields` (so the parser can coerce values) and their names are
+ * registered on the schema's `extensionFields` set, routing them to the
+ * extension's own SQL resolver instead of a table column. A field column
+ * always wins a name collision — an extension cannot shadow real data.
+ */
+export declare function buildEntryFilterSchema(type: AnyContentType, extensionFields?: FieldSchema): FilterSchema;
+//# sourceMappingURL=entry-filter-schema.d.ts.map

package/dist/lib/entries/services/entry-filter-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-filter-schema.d.ts","sourceRoot":"","sources":["../../../../src/lib/entries/services/entry-filter-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAEH,KAAK,WAAW,EAChB,KAAK,YAAY,EAEpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAiC3E;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAEzD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sBAAsB,CAClC,IAAI,EAAE,cAAc,EACpB,eAAe,CAAC,EAAE,WAAW,GAC9B,YAAY,CAmCd"}

package/dist/lib/entries/services/entry-row.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Pure row ↔ entry mappers shared by the read ({@link EntriesService}) and write
+ * ({@link EntryWriterService}) paths, so the wire shape and the column projection
+ * have one definition each. No DB access, no NestJS — just shape translation.
+ */
+import type { AnyContentType } from '../../types/content-type';
+import type { EntryRecord } from '../types/entry-list-view';
+/** A generated content table row seen as a bag of values by property name. */
+type Row = Record<string, unknown>;
+/**
+ * Map a raw DB row to the admin {@link EntryRecord}: envelope fields plus a
+ * `values` bag keyed by field name. `status` is emitted only for publishable
+ * types. Relations that own no column — many-relations (their links live in join
+ * tables) and inverse/back-references (they reuse the owning side's storage) —
+ * aren't selected here; an owning single relation passes through as its FK uuid.
+ */
+export declare function toRecord(type: AnyContentType, row: Row): EntryRecord;
+/**
+ * Normalize the admin's (string-shaped) `values` bag to the proper JS types the
+ * validator and storage expect — numbers parsed, JSON text parsed, empties
+ * collapsed to null — keeping every field (so a many-relation array still
+ * validates). The single coercion point: both {@link toColumns} (storage) and
+ * the writer's validation run against the result, so they can't disagree on a
+ * value's type. Datetime/date stay ISO strings (the validator accepts them;
+ * {@link toColumns} converts datetime to `Date` for `timestamptz`).
+ */
+export declare function coerceValues(type: AnyContentType, values: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Project a (coerced) `values` bag onto the columns of a generated table for an
+ * insert/update. Includes only keys declared on the type (reserved envelope
+ * columns — `status`/`published_at`/`deleted_at`/timestamps — are owned by the
+ * service, never the client), skips relations that own no column (many-relations,
+ * whose links live in join tables, and inverse/back-references, which reuse the
+ * owning side's storage), collapses empties to `null`, converts a `datetime` to a `Date` for
+ * the `timestamptz` column (guarding an invalid date to `null` rather than
+ * letting `pg` throw), and drops a `NaN` number to `null`. A field absent from
+ * `values` is written as `null` — the editor submits the full bag, so a write
+ * replaces the whole document.
+ */
+export declare function toColumns(type: AnyContentType, values: Record<string, unknown>): Record<string, unknown>;
+/**
+ * A human display label for an entry — the first non-empty title-eligible field's
+ * value (see {@link TITLE_FIELD_TYPES}), falling back to the id. Used to label
+ * rows in the bulk-publish preview.
+ */
+export declare function entryTitle(type: AnyContentType, row: Row): string;
+/**
+ * The slug handle for an entry — the value of its **slug field**: the first
+ * field flagged `admin.widget === 'slug'`, else a field literally named `slug`.
+ * Returns the trimmed value when present and non-empty, otherwise `undefined`
+ * (the type has no slug field, or the row's slug is blank). Used to give a
+ * linked relation record a stable `/handle` in the admin.
+ */
+export declare function entrySlug(type: AnyContentType, row: Row): string | undefined;
+export {};
+//# sourceMappingURL=entry-row.d.ts.map

package/dist/lib/entries/services/entry-row.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-row.d.ts","sourceRoot":"","sources":["../../../../src/lib/entries/services/entry-row.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D,8EAA8E;AAC9E,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,WAAW,CAwBpE;AAKD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CACxB,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgCzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CACrB,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA0BzB;AAWD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,CAOjE;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,SAAS,CAS5E"}

package/dist/lib/entries/services/entry-writer.service.d.ts

@@ -0,0 +1,193 @@
+import { type Database } from '@ortha-cms/database';
+import { type ContentEntryExtension } from '../../extension/entry-extension';
+import type { AnyContentType } from '../../types/content-type';
+import { EntryValidationService } from '../../validation/services/entry-validation.service';
+import type { EntryRecord, RelationDelta, RelationFieldView } from '../types/entry-list-view';
+import { type BulkActionResult, type BulkPublishPreview, type BulkPublishResult } from '../types/bulk-publish';
+import { RelationLinkService } from './relation-link.service';
+/**
+ * The write half of the entries pipeline — create / read-one / update / publish
+ * / unpublish / delete / restore / purge, plus their bulk variants. Generic over
+ * the content type (like {@link EntriesService}): the physical table and its
+ * envelope columns are derived from `type` at request time, so one service backs
+ * every collection. {@link EntryValidationService} is the gate — nothing is
+ * written or published without passing it.
+ */
+export declare class EntryWriterService {
+    private readonly db;
+    private readonly validation;
+    private readonly relations;
+    private readonly extension?;
+    constructor(db: Database, validation: EntryValidationService, relations: RelationLinkService, extension?: ContentEntryExtension | undefined);
+    /**
+     * Create an entry **owned by `workspaceId`** (stamped onto the row so the
+     * reader's workspace filter and every later scoped write see it). A
+     * publishable type starts as a **draft** and may be incomplete — validation
+     * is deferred to publish. A non-publishable type is always live, so its
+     * values must validate now.
+     *
+     * The insert runs in a transaction that first takes the workspace's *shared*
+     * content lock ({@link lockWorkspaceShared}): it coordinates with the
+     * workspace delete / content-revoke guards (which take the lock exclusively),
+     * so a new entry can't land between their emptiness check and their mutation
+     * and be orphaned. Shared mode keeps concurrent creates non-blocking.
+     *
+     * `locale` / `localeGroupId` are opaque, extension-owned params: the bound
+     * extension validates them and stamps the envelope columns (a
+     * `localeGroupId` makes the row a **sibling** in that translation group). A
+     * duplicate `(group, locale)` surfaces as a **409** via {@link uniqueGuarded}.
+     */
+    create(type: AnyContentType, values: Record<string, unknown>, workspaceId: string, relations?: Record<string, RelationDelta>, locale?: string, localeGroupId?: string): Promise<EntryRecord>;
+    /**
+     * First page (+ total) of every relation field's links for one live entry,
+     * keyed by field name — what the editor loads on open. Each field is
+     * paginated, so a relation with many links contributes only its first page.
+     * 404 if the entry is missing (or soft-deleted) in this workspace.
+     */
+    getRelations(type: AnyContentType, id: string, workspaceId: string): Promise<Record<string, RelationFieldView>>;
+    /**
+     * One page of a single relation field's links (infinite-scroll for a
+     * many/inverse relation). 404 if the entry is missing; 400 if `field` isn't a
+     * relation on the type.
+     */
+    getRelationField(type: AnyContentType, id: string, field: string, page: number, pageSize: number, workspaceId: string): Promise<RelationFieldView>;
+    /**
+     * Apply the staged per-field relation deltas of a save, inside the entry's
+     * transaction — so the row and every link change commit or roll back as one.
+     * Each field must be a **many/inverse** relation (a single relation is set
+     * through `values`); a single-relation or unknown key is a 400. `applyDelta`
+     * validates the linked ids against the workspace (422 on a bad target).
+     */
+    private applyRelationDeltas;
+    /** Resolve a relation field spec on the type, or 400 if it isn't one. */
+    private relationSpec;
+    /** Read one live entry in the workspace, or 404. */
+    getOne(type: AnyContentType, id: string, workspaceId: string): Promise<EntryRecord>;
+    /**
+     * Replace a live entry's values, or 404. As with {@link create}, a
+     * publishable type's values aren't validated here (a draft may be saved
+     * incomplete; publish enforces the rules) — a non-publishable, always-live
+     * type validates now.
+     */
+    update(type: AnyContentType, id: string, values: Record<string, unknown>, workspaceId: string, relations?: Record<string, RelationDelta>): Promise<EntryRecord>;
+    /** Validate the stored row, then mark it published (publishable types only). */
+    publish(type: AnyContentType, id: string, workspaceId: string): Promise<EntryRecord>;
+    /** Revert a live entry to draft (publishable types only). */
+    unpublish(type: AnyContentType, id: string, workspaceId: string): Promise<EntryRecord>;
+    /**
+     * Delete an entry: soft (stamp `deleted_at`) for a paranoid type, hard
+     * `DELETE` otherwise. 404 if there's no live row to remove **in this
+     * workspace** — an id from another workspace is indistinguishable from a
+     * missing one.
+     */
+    remove(type: AnyContentType, id: string, workspaceId: string): Promise<void>;
+    /**
+     * Clear a soft-deleted entry's tombstone (paranoid types only), or 404.
+     * On an i18n type the restore can collide with a row created in the same
+     * (locale group, locale) slot after the soft delete — the partial unique
+     * index rejects it, surfaced as a 409 rather than a 500.
+     */
+    restore(type: AnyContentType, id: string, workspaceId: string): Promise<EntryRecord>;
+    /** Permanently delete a tombstoned entry (paranoid types only), or 404. */
+    purge(type: AnyContentType, id: string, workspaceId: string): Promise<void>;
+    /**
+     * Dry-run a publish over a set of ids: validate each live row and report a
+     * verdict (will-publish / already-published / blocked / not-found) in
+     * request order. Writes nothing.
+     */
+    previewBulkPublish(type: AnyContentType, ids: string[], workspaceId: string): Promise<BulkPublishPreview>;
+    /**
+     * Commit a bulk publish. The validation gate is **locked**: the candidate
+     * rows are selected `FOR UPDATE` and re-validated inside one transaction, so
+     * a concurrent edit can't invalidate a row between the dry run and the write
+     * (the single-statement preview-then-update split had that TOCTOU window).
+     * Publishes only the `publishable` ids, reporting which were skipped and why.
+     */
+    bulkPublish(type: AnyContentType, ids: string[], workspaceId: string): Promise<BulkPublishResult>;
+    /**
+     * Compute the per-entry publish verdict (will-publish / already-published /
+     * blocked / not-found) for `ids` in request order, given the live rows keyed
+     * by id. Pure — the dry run and the committed {@link bulkPublish} share it so
+     * they can't disagree on what's publishable.
+     */
+    private verdictsFor;
+    /**
+     * The per-field publish-gate checklist for one record: every required field
+     * plus any field that has an issue, each marked pass/fail. Mirrors the
+     * editor's Publish Gate so a row can show its passed fields, not just the
+     * failures.
+     */
+    private buildChecks;
+    /** Revert a set of live entries to draft. */
+    bulkUnpublish(type: AnyContentType, ids: string[], workspaceId: string): Promise<BulkActionResult>;
+    /** Delete a set of entries: soft for paranoid types, hard otherwise. */
+    bulkRemove(type: AnyContentType, ids: string[], workspaceId: string): Promise<BulkActionResult>;
+    /** Permanently delete a set of tombstoned entries (paranoid types only). */
+    bulkPurge(type: AnyContentType, ids: string[], workspaceId: string): Promise<BulkActionResult>;
+    /**
+     * Restore a set of soft-deleted entries (paranoid types only). As with
+     * {@link restore}, a restored row colliding with a live sibling in its
+     * (locale group, locale) slot is a 409 — the whole batch rolls back
+     * (single statement), so the caller can retry without the conflicting id.
+     */
+    bulkRestore(type: AnyContentType, ids: string[], workspaceId: string): Promise<BulkActionResult>;
+    /**
+     * Run a write, translating a Postgres unique violation (23505) into a 409.
+     * Only i18n types carry a restore-relevant unique index — the partial
+     * `(locale_group_id, locale)` one — so the mapping is scoped to them and
+     * any other type's violation still surfaces as the bug it is.
+     */
+    private uniqueGuarded;
+    /** The type's generated table seen as a column bag (envelope + fields). */
+    private columns;
+    /**
+     * `workspace_id = :workspaceId` — the ownership predicate every read and
+     * write AND-s in, so a request scoped to one workspace can neither see nor
+     * mutate another's rows.
+     */
+    private scope;
+    /**
+     * `id = :id` AND the workspace scope AND (for paranoid types)
+     * `deleted_at IS NULL`.
+     */
+    private liveWhere;
+    /** Fetch one live row by id in the workspace, or undefined. */
+    private findLive;
+    /** Fetch the workspace's live rows for a set of ids, keyed by id. */
+    private loadLiveByIds;
+    /**
+     * Verify every referenced relation target exists **in the same workspace** —
+     * single FKs, many-to-many links, and the inverse (back-reference) side of a
+     * two-way relation. Neither the FK column nor the join table has a workspace
+     * constraint of its own (the target table is workspace-scoped only at the app
+     * layer), so without this a caller could reference — or probe the existence
+     * of — an entry in another workspace. Batched one existence query per
+     * referenced target type; a missing or cross-workspace target surfaces as a
+     * uniform 422 validation issue (indistinguishable from a plain "invalid id",
+     * so no not-found-vs-forbidden enumeration signal). Runs on every
+     * create/update, draft or not, because links are written eagerly either way.
+     * An inverse-of-single (one-to-many) field owns no writable link from this
+     * side, so it's skipped.
+     */
+    private assertRelationTargets;
+    /**
+     * Enforce required **link-managed** relations (an owning many-to-many, or the
+     * inverse of one) against the entry's actual link set — the check
+     * {@link EntryValidationService} can't make, because those links never travel
+     * in the `values` bag it sees. A required such relation with zero links is a
+     * 422 `is required`, matching how a required scalar field reads. A single FK
+     * relation is validated in `values` already; an inverse-of-single owns no
+     * writable link from this side, so it's skipped (it can't be satisfied here).
+     * `exec` is the write transaction on create/update (so it counts the
+     * just-written, uncommitted rows) or the root client on publish (committed).
+     */
+    private assertRequiredRelations;
+    /** Throw 422 with the issue list when the values fail validation. */
+    private assertValid;
+    /** Reject publish/unpublish on a type with no publish workflow. */
+    private assertPublishable;
+    /** Reject restore/purge on a type without soft delete. */
+    private assertParanoid;
+    private notFound;
+}
+//# sourceMappingURL=entry-writer.service.d.ts.map

package/dist/lib/entries/services/entry-writer.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-writer.service.d.ts","sourceRoot":"","sources":["../../../../src/lib/entries/services/entry-writer.service.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EAEH,KAAK,qBAAqB,EAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,cAAc,EAAe,MAAM,0BAA0B,CAAC;AAG5E,OAAO,EACH,sBAAsB,EAEzB,MAAM,oDAAoD,CAAC;AAC5D,OAAO,KAAK,EACR,WAAW,EACX,aAAa,EACb,iBAAiB,EACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEH,KAAK,gBAAgB,EAErB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EAEzB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACH,mBAAmB,EAEtB,MAAM,yBAAyB,CAAC;AAKjC;;;;;;;GAOG;AACH,qBACa,kBAAkB;IAEL,OAAO,CAAC,QAAQ,CAAC,EAAE;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAK1B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAPQ,EAAE,EAAE,QAAQ,EAC9B,UAAU,EAAE,sBAAsB,EAClC,SAAS,EAAE,mBAAmB,EAK9B,SAAS,CAAC,EAAE,qBAAqB,YAAA;IAGtD;;;;;;;;;;;;;;;;;OAiBG;IACG,MAAM,CACR,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,EACzC,MAAM,CAAC,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,WAAW,CAAC;IA4EvB;;;;;OAKG;IACG,YAAY,CACd,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAM7C;;;;OAIG;IACG,gBAAgB,CAClB,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,iBAAiB,CAAC;IAe7B;;;;;;OAMG;YACW,mBAAmB;IAqCjC,yEAAyE;IACzE,OAAO,CAAC,YAAY;IAUpB,oDAAoD;IAC9C,MAAM,CACR,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,CAAC;IAMvB;;;;;OAKG;IACG,MAAM,CACR,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAC1C,OAAO,CAAC,WAAW,CAAC;IAoEvB,gFAAgF;IAC1E,OAAO,CACT,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,CAAC;IAwBvB,6DAA6D;IACvD,SAAS,CACX,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,CAAC;IAevB;;;;;OAKG;IACG,MAAM,CACR,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAmBhB;;;;;OAKG;IACG,OAAO,CACT,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,CAAC;IAsBvB,2EAA2E;IACrE,KAAK,CACP,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAgBhB;;;;OAIG;IACG,kBAAkB,CACpB,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,kBAAkB,CAAC;IAM9B;;;;;;OAMG;IACG,WAAW,CACb,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,iBAAiB,CAAC;IAoC7B;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IAsDnB;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IAmBnB,6CAA6C;IACvC,aAAa,CACf,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAsB5B,wEAAwE;IAClE,UAAU,CACZ,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAsB5B,4EAA4E;IACtE,SAAS,CACX,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAiB5B;;;;;OAKG;IACG,WAAW,CACb,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,gBAAgB,CAAC;IAsB5B;;;;;OAKG;YACW,aAAa;IAgB3B,2EAA2E;IAC3E,OAAO,CAAC,OAAO;IAIf;;;;OAIG;IACH,OAAO,CAAC,KAAK;IAIb;;;OAGG;IACH,OAAO,CAAC,SAAS;IAajB,+DAA+D;YACjD,QAAQ;IAatB,qEAAqE;YACvD,aAAa;IAoB3B;;;;;;;;;;;;;OAaG;YACW,qBAAqB;IAsEnC;;;;;;;;;;OAUG;YACW,uBAAuB;IAwCrC,qEAAqE;IACrE,OAAO,CAAC,WAAW;IAanB,mEAAmE;IACnE,OAAO,CAAC,iBAAiB;IAQzB,0DAA0D;IAC1D,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,QAAQ;CAKnB"}

package/dist/lib/entries/services/relation-link.service.d.ts

@@ -0,0 +1,115 @@
+import { type Database } from '@ortha-cms/database';
+import type { AnyContentType } from '../../types/content-type';
+import { type AnyFieldSpec } from '../../types/fields';
+import type { RelationDelta, RelationFieldView } from '../types/entry-list-view';
+/** A generated content row seen as a bag of values by property name. */
+type Row = Record<string, unknown>;
+/** Default links per page when the caller doesn't specify one. */
+export declare const RELATION_PAGE_SIZE = 20;
+/**
+ * The transaction handle Drizzle hands the `db.transaction(tx => …)` callback —
+ * derived from {@link Database} so link writes share the exact query surface of
+ * the client without hard-coding the dialect's transaction type.
+ */
+export type DbTransaction = Parameters<Parameters<Database['transaction']>[0]>[0];
+/**
+ * Reads and writes the relation **links** an entry owns beyond its own columns:
+ * many-to-many join rows and the inverse (back-reference) side of a two-way
+ * relation. Owning **single** relations are plain `<field>_id` FK columns —
+ * written by `toColumns`, read off the row — so they need no join plumbing.
+ *
+ * Everything is **paginated**: a relation can hold thousands of links, so reads
+ * return one ordered page + a `total` (never every id), and writes apply an
+ * incremental {@link RelationDelta} (link / unlink / reorder) inside a
+ * transaction — so a huge relation never has to be sent or held in full.
+ * Order is persisted in the join table's `position` column, owned by the
+ * **source** side; the inverse reads by it (stable) but can't reorder it.
+ */
+export declare class RelationLinkService {
+    private readonly db;
+    constructor(db: Database);
+    /**
+     * First page (+ total) of **every** relation field of `type` for one entry,
+     * keyed by field name — what the editor loads on open. Each field is read
+     * independently (paginated), so a relation with many links contributes only
+     * its first page, not every id.
+     */
+    readAll(type: AnyContentType, row: Row, workspaceId: string, pageSize?: number): Promise<Record<string, RelationFieldView>>;
+    /**
+     * One page of a single relation field's links, ordered by `position`
+     * (owning) and resolved to display-ready refs (id + title). `row` is the
+     * editing entry (its FK columns back a single relation); pass it to avoid a
+     * re-read. Returns `{ items, total }`.
+     */
+    readField(type: AnyContentType, row: Row, field: string, spec: AnyFieldSpec, page: number, pageSize: number, workspaceId: string): Promise<RelationFieldView>;
+    /**
+     * Apply an incremental {@link RelationDelta} to one many/inverse relation
+     * field inside `tx`: validate the linked targets are in the workspace, unlink
+     * the removed pairs, append the new ones (`position = max+1` for the source,
+     * `ON CONFLICT DO NOTHING`), then renumber to `order` (owning side only).
+     * A single relation or an inverse-of-single owns no delta-writable link, so
+     * it's a no-op. Returns nothing — read the field back for the new state.
+     */
+    applyDelta(tx: DbTransaction, type: AnyContentType, sourceId: string, field: string, delta: RelationDelta, workspaceId: string): Promise<void>;
+    /**
+     * Replace a many-relation's links with exactly `values[field]` (array),
+     * position = array index — the **whole-set** write used only when a caller
+     * genuinely submits a relation **array** in the entry body (legacy / bulk).
+     * The editor uses {@link applyDelta} instead. Runs inside the entry's
+     * transaction. **Only an array counts**: a field that's absent or `null`
+     * (`coerceValues` stamps `null` onto every unset field) is left untouched, so
+     * a save that manages a relation purely through deltas can never have its
+     * links cleared here.
+     */
+    writeLinks(tx: DbTransaction, type: AnyContentType, sourceId: string, values: Record<string, unknown>, workspaceId: string): Promise<void>;
+    /**
+     * Count the links of one join-backed relation field for an entry — the
+     * `total` a read would report, without fetching or resolving any page. Runs
+     * on the passed executor (the write transaction when validating a just-saved
+     * entry, so it sees the delta's uncommitted rows). Returns 0 for a relation
+     * that owns no writable links from this side (single FK / inverse-of-single).
+     */
+    countLinks(exec: Database | DbTransaction, type: AnyContentType, row: Row, field: string, spec: AnyFieldSpec, workspaceId: string): Promise<number>;
+    /**
+     * Take the transaction-scoped advisory lock for one physical source list
+     * (`<join table>:<sourceId>`), serializing every appender to that list so no
+     * two concurrent writes read the same `max(position)`. Auto-releases at
+     * commit/rollback. Keyed on the table name too, so distinct join tables that
+     * happen to share a source id don't falsely contend.
+     */
+    private lockSource;
+    /** Next append position for a source: `max(position) + 1`, else 0. */
+    private nextPosition;
+    /**
+     * Resolve `ids` (in order) to display-ready refs via one lookup on the target
+     * type, scoped to the workspace. Ids with no **live** row drop to an id-only
+     * ref — a soft-deleted (paranoid) target is excluded here just as it is on
+     * the inverse read side, so a trashed record never surfaces its title on the
+     * owning side while it's hidden on the other.
+     */
+    private refsFor;
+    /** Build a display ref from a full target row. */
+    private rowToRef;
+    /**
+     * Verify every id to be linked exists **in the same workspace** (the join FK
+     * has no workspace constraint of its own). A missing or cross-workspace id is
+     * a uniform 422 — indistinguishable from an invalid id, so no enumeration
+     * signal.
+     */
+    private assertTargets;
+    /**
+     * The join-table plan for a relation field, or `null` when it owns no join
+     * table (an owning single relation, or an inverse-of-single). An owning
+     * many-relation uses its own join table (`source→target`); an inverse of a
+     * many-to-many reuses the owning side's join table with the roles swapped.
+     */
+    private joinPlanFor;
+    /**
+     * The inverse-of-single (one-to-many) plan for a relation field, or `null`:
+     * it reads the owner rows whose FK points back at the editing record, and
+     * owns no writable link from this side.
+     */
+    private inversePlanFor;
+}
+export {};
+//# sourceMappingURL=relation-link.service.d.ts.map

package/dist/lib/entries/services/relation-link.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relation-link.service.d.ts","sourceRoot":"","sources":["../../../../src/lib/entries/services/relation-link.service.ts"],"names":[],"mappings":"AAeA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAe,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,KAAK,EACR,aAAa,EACb,iBAAiB,EAEpB,MAAM,0BAA0B,CAAC;AAMlC,wEAAwE;AACxE,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAUrC;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,CAClC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC,CAAC,CAAC,CAAC;AA0BL;;;;;;;;;;;;GAYG;AACH,qBACa,mBAAmB;IACE,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ;IAI3D;;;;;OAKG;IACG,OAAO,CACT,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,QAAQ,SAAqB,GAC9B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAoB7C;;;;;OAKG;IACG,SAAS,CACX,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,iBAAiB,CAAC;IA0E7B;;;;;;;OAOG;IACG,UAAU,CACZ,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,aAAa,EACpB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IA+FhB;;;;;;;;;OASG;IACG,UAAU,CACZ,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAwChB;;;;;;OAMG;IACG,UAAU,CACZ,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,YAAY,EAClB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC;IA8BlB;;;;;;OAMG;YACW,UAAU;IAWxB,sEAAsE;YACxD,YAAY;IAc1B;;;;;;OAMG;YACW,OAAO;IAuBrB,kDAAkD;IAClD,OAAO,CAAC,QAAQ;IAWhB;;;;;OAKG;YACW,aAAa;IAmC3B;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IA8BnB;;;;OAIG;IACH,OAAO,CAAC,cAAc;CAYzB"}

package/dist/lib/entries/types/bulk-publish.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Wire contracts for the bulk-publish dry run and its commit. The preview is
+ * advisory (the admin renders it in a confirm modal); the commit re-validates
+ * server-side and never trusts the client's copy.
+ */
+import type { EntryStatus } from '../../types/content-type';
+import type { ValidationIssue } from '../../validation/services/entry-validation.service';
+/**
+ * The outcome of dry-running a publish against one selected entry. The runtime
+ * object is the source of truth so the admin and server share the verdict set.
+ */
+export declare const BULK_VERDICT: {
+    /** Currently a draft and valid — will publish. */
+    readonly Publishable: "publishable";
+    /** Already published — nothing to do. */
+    readonly AlreadyPublished: "already-published";
+    /** Has validation issues — cannot publish until fixed. */
+    readonly Blocked: "blocked";
+    /** No live row with this id (unknown or soft-deleted). */
+    readonly NotFound: "not-found";
+};
+/** One row's dry-run verdict. */
+export type BulkVerdictKind = (typeof BULK_VERDICT)[keyof typeof BULK_VERDICT];
+/**
+ * One field's publish-gate check: whether it currently passes (and, when it
+ * doesn't, why). Lets the admin show a full per-record checklist — passed fields
+ * included — not just the failures.
+ */
+export interface BulkPublishCheck {
+    /** Field name. */
+    field: string;
+    /** Human label (admin label, else the field name). */
+    label: string;
+    /** Whether the field passes publish validation. */
+    ok: boolean;
+    /** The failure message when `ok` is false. */
+    message?: string;
+}
+/** Per-entry result in a bulk-publish dry run. */
+export interface BulkPublishVerdict {
+    id: string;
+    /** Display label (first text field, else id). */
+    title: string;
+    /** Current publish state, or null when not found. */
+    status: EntryStatus | null;
+    verdict: BulkVerdictKind;
+    /** Populated only when `verdict === 'blocked'`. */
+    issues: ValidationIssue[];
+    /**
+     * Per-field publish-gate checks (required fields + any field with an issue),
+     * for any record the server validated — `publishable`, `blocked`, and
+     * `already-published` (whose checks all pass). Empty only for a `not-found`
+     * row, which has no record to check.
+     */
+    checks: BulkPublishCheck[];
+}
+/** The dry-run response: one verdict per requested id, in request order. */
+export interface BulkPublishPreview {
+    items: BulkPublishVerdict[];
+}
+/** The result of committing a bulk publish. */
+export interface BulkPublishResult {
+    /** Ids actually transitioned to published. */
+    published: string[];
+    /** Ids left untouched, with why (a non-publishable verdict kind). */
+    skipped: {
+        id: string;
+        reason: BulkVerdictKind;
+    }[];
+}
+/** The result of a bulk unpublish/delete/restore — how many rows changed. */
+export interface BulkActionResult {
+    count: number;
+}
+//# sourceMappingURL=bulk-publish.d.ts.map

package/dist/lib/entries/types/bulk-publish.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bulk-publish.d.ts","sourceRoot":"","sources":["../../../../src/lib/entries/types/bulk-publish.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oDAAoD,CAAC;AAE1F;;;GAGG;AACH,eAAO,MAAM,YAAY;IACrB,kDAAkD;;IAElD,yCAAyC;;IAEzC,0DAA0D;;IAE1D,0DAA0D;;CAEpD,CAAC;AAEX,iCAAiC;AACjC,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAE/E;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC7B,kBAAkB;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,EAAE,EAAE,OAAO,CAAC;IACZ,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,kDAAkD;AAClD,MAAM,WAAW,kBAAkB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,iDAAiD;IACjD,KAAK,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,eAAe,CAAC;IACzB,mDAAmD;IACnD,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B;;;;;OAKG;IACH,MAAM,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAED,4EAA4E;AAC5E,MAAM,WAAW,kBAAkB;IAC/B,KAAK,EAAE,kBAAkB,EAAE,CAAC;CAC/B;AAED,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAC9B,8CAA8C;IAC9C,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,qEAAqE;IACrE,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,eAAe,CAAA;KAAE,EAAE,CAAC;CACtD;AAED,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC7B,KAAK,EAAE,MAAM,CAAC;CACjB"}

package/dist/lib/entries/types/bulk-publish.js

@@ -0,0 +1,22 @@
+"use strict";
+/**
+ * Wire contracts for the bulk-publish dry run and its commit. The preview is
+ * advisory (the admin renders it in a confirm modal); the commit re-validates
+ * server-side and never trusts the client's copy.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BULK_VERDICT = void 0;
+/**
+ * The outcome of dry-running a publish against one selected entry. The runtime
+ * object is the source of truth so the admin and server share the verdict set.
+ */
+exports.BULK_VERDICT = {
+    /** Currently a draft and valid — will publish. */
+    Publishable: 'publishable',
+    /** Already published — nothing to do. */
+    AlreadyPublished: 'already-published',
+    /** Has validation issues — cannot publish until fixed. */
+    Blocked: 'blocked',
+    /** No live row with this id (unknown or soft-deleted). */
+    NotFound: 'not-found'
+};