@orthacms/content-server 0.0.0-reserve.0

package/dist/lib/public-api/http/dto/public-list-entries-query.dto.d.ts

@@ -0,0 +1,106 @@
+/**
+ * `?relations=preview` / `?media=preview` opt an entry read into expanding the
+ * named fields. Opt-in because the cost scales with the number of expanded
+ * fields, and most reads want neither.
+ */
+export declare const PREVIEW = "preview";
+/**
+ * Default links / assets returned per expanded field. Matches the admin
+ * preview's cap so both surfaces summarise a relation the same way.
+ */
+export declare const DEFAULT_EXPANSION_LIMIT = 20;
+/**
+ * What publish states a read may return. `published` is the default and the only
+ * value a `read`-scope token may use; the other two need write scope.
+ */
+export declare const ENTRY_VISIBILITY: readonly ["published", "draft", "any"];
+/** @see ENTRY_VISIBILITY */
+export type EntryVisibility = (typeof ENTRY_VISIBILITY)[number];
+/**
+ * The one parameter every public read accepts: which locale to read. Shared by
+ * the list and the single-entry route so the slug is declared once.
+ */
+export declare class PublicEntryQueryDto {
+    /**
+     * Which publish states to return. Defaults to `published` — the whole
+     * contract of this API for an anonymous consumer.
+     *
+     * A **write-scoped** token may widen it, because otherwise creating a draft
+     * would produce a record the creator cannot read back: the write returns it
+     * once and it is then invisible forever. Narrower than "drafts are public" —
+     * the widening is gated on the same scope that could have published the row
+     * anyway.
+     */
+    status?: EntryVisibility;
+    /** `preview` expands the relation fields named by `relationFields`. */
+    relations?: typeof PREVIEW;
+    /**
+     * Comma-separated relation field names to expand. Each yields one capped
+     * page of links plus the count of visible ones.
+     */
+    relationFields?: string;
+    /** `preview` expands the media fields named by `mediaFields`. */
+    media?: typeof PREVIEW;
+    /**
+     * Links returned per expanded relation field. The **true** count is always
+     * reported as that field's `total`, so lowering this never hides the fact
+     * that more exist.
+     */
+    relationLimit?: number;
+    /**
+     * Assets returned per expanded media field, with the same
+     * `total`-tells-the-truth guarantee as {@link relationLimit}.
+     */
+    mediaLimit?: number;
+    /** Comma-separated media field names to expand. */
+    mediaFields?: string;
+    /**
+     * Comma-separated field names to return in `values` — a sparse fieldset.
+     * Absent returns every value field. Selection narrows the SQL projection
+     * too, so an unselected richtext column is never read, let alone sent.
+     */
+    fields?: string;
+    /**
+     * `preview` attaches the entry's other locale rows — the rest of its
+     * translation group. Opt-in like the other expansions, and a 400 on a type
+     * that isn't localized.
+     */
+    translations?: typeof PREVIEW;
+    /**
+     * Locale slug the read targets, on a localized type. Extension-owned:
+     * forwarded verbatim to the bound `CONTENT_ENTRY_EXTENSION`, which
+     * validates it; absent means the configured default locale.
+     */
+    locale?: string;
+}
+/**
+ * Query parameters for `GET /api/v1/content/:typeName` — search, filter, sort,
+ * paginate, locale. `search` and `filter` use the **same** shapes as the admin
+ * records list, so one query language covers both surfaces.
+ *
+ * `@Type` coerces the raw query strings; the host's global `ValidationPipe`
+ * transforms but does not implicitly convert, and rejects any key not declared
+ * here.
+ */
+export declare class PublicListEntriesQueryDto extends PublicEntryQueryDto {
+    /** Free-text search across the type's text-like columns. */
+    search?: string;
+    /**
+     * Structured filter tree as a JSON string, the same shape the admin's
+     * query builder emits. Length-capped here as a first line of defence; the
+     * engine's own node/depth caps bound the parsed shape.
+     */
+    filter?: string;
+    /** 1-based page number. */
+    page?: number;
+    /** Rows per page, capped at {@link MAX_PAGE_SIZE}. */
+    pageSize?: number;
+    /**
+     * Sort spec: a whitelisted column id (ascending) or `-`-prefixed
+     * (descending). The whitelist is the envelope timestamps, `publishedAt`,
+     * `locale`, and the type's scalar fields; anything else falls back to
+     * newest-updated first. `id` is always the tiebreaker.
+     */
+    sort?: string;
+}
+//# sourceMappingURL=public-list-entries-query.dto.d.ts.map

package/dist/lib/public-api/http/dto/public-list-entries-query.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-list-entries-query.dto.d.ts","sourceRoot":"","sources":["../../../../../src/lib/public-api/http/dto/public-list-entries-query.dto.ts"],"names":[],"mappings":"AA0BA;;;;GAIG;AACH,eAAO,MAAM,OAAO,YAAY,CAAC;AAEjC;;;GAGG;AACH,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C;;;GAGG;AACH,eAAO,MAAM,gBAAgB,wCAAyC,CAAC;AAEvE,4BAA4B;AAC5B,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE;;;GAGG;AACH,qBAAa,mBAAmB;IAC5B;;;;;;;;;OASG;IASH,MAAM,CAAC,EAAE,eAAe,CAAC;IAEzB,uEAAuE;IAQvE,SAAS,CAAC,EAAE,OAAO,OAAO,CAAC;IAE3B;;;OAGG;IAWH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,iEAAiE;IAQjE,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC;IAEvB;;;;OAIG;IAaH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IAaH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,mDAAmD;IAWnD,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;OAIG;IAWH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IAQH,YAAY,CAAC,EAAE,OAAO,OAAO,CAAC;IAE9B;;;;OAIG;IAWH,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,qBAAa,yBAA0B,SAAQ,mBAAmB;IAC9D,4DAA4D;IAU5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IAYH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAW3B,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,sDAAsD;IAatD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;;;OAKG;IAWH,IAAI,CAAC,EAAE,MAAM,CAAC;CACjB"}

package/dist/lib/public-api/http/dto/public-list-entries-query.dto.js

@@ -0,0 +1,297 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PublicListEntriesQueryDto = exports.PublicEntryQueryDto = exports.ENTRY_VISIBILITY = exports.DEFAULT_EXPANSION_LIMIT = exports.PREVIEW = void 0;
+const tslib_1 = require("tslib");
+const swagger_1 = require("@nestjs/swagger");
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const entries_constants_1 = require("../../../entries/entries.constants");
+/** Longest accepted locale slug (BCP-47's practical bound). */
+const LOCALE_MAX_LENGTH = 35;
+/** Longest accepted free-text search needle — matches the admin list's cap. */
+const SEARCH_MAX_LENGTH = 255;
+/** Upper bound on the raw `?fields=` list (a comma-separated field list). */
+const FIELDS_MAX_LENGTH = 1024;
+/**
+ * `?relations=preview` / `?media=preview` opt an entry read into expanding the
+ * named fields. Opt-in because the cost scales with the number of expanded
+ * fields, and most reads want neither.
+ */
+exports.PREVIEW = 'preview';
+/**
+ * Default links / assets returned per expanded field. Matches the admin
+ * preview's cap so both surfaces summarise a relation the same way.
+ */
+exports.DEFAULT_EXPANSION_LIMIT = 20;
+/**
+ * What publish states a read may return. `published` is the default and the only
+ * value a `read`-scope token may use; the other two need write scope.
+ */
+exports.ENTRY_VISIBILITY = ['published', 'draft', 'any'];
+/**
+ * The one parameter every public read accepts: which locale to read. Shared by
+ * the list and the single-entry route so the slug is declared once.
+ */
+class PublicEntryQueryDto {
+    /**
+     * Which publish states to return. Defaults to `published` — the whole
+     * contract of this API for an anonymous consumer.
+     *
+     * A **write-scoped** token may widen it, because otherwise creating a draft
+     * would produce a record the creator cannot read back: the write returns it
+     * once and it is then invisible forever. Narrower than "drafts are public" —
+     * the widening is gated on the same scope that could have published the row
+     * anyway.
+     */
+    status;
+    /** `preview` expands the relation fields named by `relationFields`. */
+    relations;
+    /**
+     * Comma-separated relation field names to expand. Each yields one capped
+     * page of links plus the count of visible ones.
+     */
+    relationFields;
+    /** `preview` expands the media fields named by `mediaFields`. */
+    media;
+    /**
+     * Links returned per expanded relation field. The **true** count is always
+     * reported as that field's `total`, so lowering this never hides the fact
+     * that more exist.
+     */
+    relationLimit;
+    /**
+     * Assets returned per expanded media field, with the same
+     * `total`-tells-the-truth guarantee as {@link relationLimit}.
+     */
+    mediaLimit;
+    /** Comma-separated media field names to expand. */
+    mediaFields;
+    /**
+     * Comma-separated field names to return in `values` — a sparse fieldset.
+     * Absent returns every value field. Selection narrows the SQL projection
+     * too, so an unselected richtext column is never read, let alone sent.
+     */
+    fields;
+    /**
+     * `preview` attaches the entry's other locale rows — the rest of its
+     * translation group. Opt-in like the other expansions, and a 400 on a type
+     * that isn't localized.
+     */
+    translations;
+    /**
+     * Locale slug the read targets, on a localized type. Extension-owned:
+     * forwarded verbatim to the bound `CONTENT_ENTRY_EXTENSION`, which
+     * validates it; absent means the configured default locale.
+     */
+    locale;
+}
+exports.PublicEntryQueryDto = PublicEntryQueryDto;
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        enum: exports.ENTRY_VISIBILITY,
+        default: 'published',
+        description: 'Publish states to return. `published` (default) is all a read-only token may ask for; `draft` and `any` require a `full`-scope token, and are a 403 otherwise. Ignored on types that are not publishable — those have no publish state and every row is live.'
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsIn)(exports.ENTRY_VISIBILITY),
+    tslib_1.__metadata("design:type", String)
+], PublicEntryQueryDto.prototype, "status", void 0);
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        enum: [exports.PREVIEW],
+        description: '`preview` expands the relation fields named by `relationFields`. Absent returns no relation data.'
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsIn)([exports.PREVIEW]),
+    tslib_1.__metadata("design:type", Object)
+], PublicEntryQueryDto.prototype, "relations", void 0);
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: String,
+        maxLength: FIELDS_MAX_LENGTH,
+        example: 'author,tags',
+        description: 'Comma-separated relation fields to expand (ignored without `relations=preview`). Only published targets are shown or counted. A name that is not a relation field, or whose target type the workspace was not granted, is a 400.'
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(FIELDS_MAX_LENGTH),
+    tslib_1.__metadata("design:type", String)
+], PublicEntryQueryDto.prototype, "relationFields", void 0);
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        enum: [exports.PREVIEW],
+        description: '`preview` expands the media fields named by `mediaFields`. Absent returns no media data.'
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsIn)([exports.PREVIEW]),
+    tslib_1.__metadata("design:type", Object)
+], PublicEntryQueryDto.prototype, "media", void 0);
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: 'integer',
+        minimum: 1,
+        maximum: entries_constants_1.MAX_PAGE_SIZE,
+        default: exports.DEFAULT_EXPANSION_LIMIT,
+        description: `Links returned per expanded relation field (1…${entries_constants_1.MAX_PAGE_SIZE}, default ${exports.DEFAULT_EXPANSION_LIMIT}). The field's \`total\` always reports the true count, so a low limit hides nothing. Page the rest via /relations/<field>.`
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_transformer_1.Type)(() => Number),
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.Min)(1),
+    (0, class_validator_1.Max)(entries_constants_1.MAX_PAGE_SIZE),
+    tslib_1.__metadata("design:type", Number)
+], PublicEntryQueryDto.prototype, "relationLimit", void 0);
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: 'integer',
+        minimum: 1,
+        maximum: entries_constants_1.MAX_PAGE_SIZE,
+        default: exports.DEFAULT_EXPANSION_LIMIT,
+        description: `Assets returned per expanded media field (1…${entries_constants_1.MAX_PAGE_SIZE}, default ${exports.DEFAULT_EXPANSION_LIMIT}). The field's \`total\` always reports the true count.`
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_transformer_1.Type)(() => Number),
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.Min)(1),
+    (0, class_validator_1.Max)(entries_constants_1.MAX_PAGE_SIZE),
+    tslib_1.__metadata("design:type", Number)
+], PublicEntryQueryDto.prototype, "mediaLimit", void 0);
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: String,
+        maxLength: FIELDS_MAX_LENGTH,
+        example: 'coverImage,gallery',
+        description: 'Comma-separated media fields to expand (ignored without `media=preview`). Returns asset metadata plus URLs under `/v1/media/assets/:id/raw`, which take the same bearer token as this request.'
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(FIELDS_MAX_LENGTH),
+    tslib_1.__metadata("design:type", String)
+], PublicEntryQueryDto.prototype, "mediaFields", void 0);
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: String,
+        maxLength: FIELDS_MAX_LENGTH,
+        example: 'title,slug,publishedAt',
+        description: 'Comma-separated field names to return in `values`. Absent returns every value field. The envelope (`id`, `createdAt`, `updatedAt`, `publishedAt`, `locale`, `localeGroupId`) is always returned and is not selectable. An unknown name is a 400; so is a relation or media field, which this API cannot return yet.'
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(FIELDS_MAX_LENGTH),
+    tslib_1.__metadata("design:type", String)
+], PublicEntryQueryDto.prototype, "fields", void 0);
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        enum: [exports.PREVIEW],
+        description: '`preview` attaches the entry’s sibling translations (the rest of its `localeGroupId` group) as `translations`. 400 on a type that is not localized.'
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsIn)([exports.PREVIEW]),
+    tslib_1.__metadata("design:type", Object)
+], PublicEntryQueryDto.prototype, "translations", void 0);
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: String,
+        maxLength: LOCALE_MAX_LENGTH,
+        example: 'en',
+        description: "Locale slug the read targets. Validated by the localization plugin (unknown → 400); absent means the default locale. Ignored on types that aren't localized."
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(LOCALE_MAX_LENGTH),
+    tslib_1.__metadata("design:type", String)
+], PublicEntryQueryDto.prototype, "locale", void 0);
+/**
+ * Query parameters for `GET /api/v1/content/:typeName` — search, filter, sort,
+ * paginate, locale. `search` and `filter` use the **same** shapes as the admin
+ * records list, so one query language covers both surfaces.
+ *
+ * `@Type` coerces the raw query strings; the host's global `ValidationPipe`
+ * transforms but does not implicitly convert, and rejects any key not declared
+ * here.
+ */
+class PublicListEntriesQueryDto extends PublicEntryQueryDto {
+    /** Free-text search across the type's text-like columns. */
+    search;
+    /**
+     * Structured filter tree as a JSON string, the same shape the admin's
+     * query builder emits. Length-capped here as a first line of defence; the
+     * engine's own node/depth caps bound the parsed shape.
+     */
+    filter;
+    /** 1-based page number. */
+    page;
+    /** Rows per page, capped at {@link MAX_PAGE_SIZE}. */
+    pageSize;
+    /**
+     * Sort spec: a whitelisted column id (ascending) or `-`-prefixed
+     * (descending). The whitelist is the envelope timestamps, `publishedAt`,
+     * `locale`, and the type's scalar fields; anything else falls back to
+     * newest-updated first. `id` is always the tiebreaker.
+     */
+    sort;
+}
+exports.PublicListEntriesQueryDto = PublicListEntriesQueryDto;
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: String,
+        maxLength: SEARCH_MAX_LENGTH,
+        description: "Free-text, case-insensitive search across the type's text-like columns (text / richtext / select). LIKE metacharacters are matched literally."
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(SEARCH_MAX_LENGTH),
+    tslib_1.__metadata("design:type", String)
+], PublicListEntriesQueryDto.prototype, "search", void 0);
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: String,
+        maxLength: entries_constants_1.FILTER_MAX_LENGTH,
+        example: '{"and":[{"field":"featured","op":"eq","value":true},{"field":"publishedAt","op":"gte","value":"2026-01-01"}]}',
+        description: 'Structured filter tree as a JSON string, validated against the type’s derived filter schema. Filterable: the type’s own scalar fields plus `id`, `createdAt`, `updatedAt`, `publishedAt`, and — on localized types — `locale` and `localeGroupId`. `status` is NOT filterable — this API serves published entries only, so the rule could only ever be a no-op or match nothing. Malformed or unknown fields → 400.'
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(entries_constants_1.FILTER_MAX_LENGTH),
+    tslib_1.__metadata("design:type", String)
+], PublicListEntriesQueryDto.prototype, "filter", void 0);
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: 'integer',
+        minimum: 1,
+        default: 1,
+        description: '1-based page number.'
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_transformer_1.Type)(() => Number),
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.Min)(1),
+    tslib_1.__metadata("design:type", Number)
+], PublicListEntriesQueryDto.prototype, "page", void 0);
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: 'integer',
+        minimum: 1,
+        maximum: entries_constants_1.MAX_PAGE_SIZE,
+        default: entries_constants_1.DEFAULT_PAGE_SIZE,
+        description: `Rows per page, capped at ${entries_constants_1.MAX_PAGE_SIZE}.`
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_transformer_1.Type)(() => Number),
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.Min)(1),
+    (0, class_validator_1.Max)(entries_constants_1.MAX_PAGE_SIZE),
+    tslib_1.__metadata("design:type", Number)
+], PublicListEntriesQueryDto.prototype, "pageSize", void 0);
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: String,
+        maxLength: 255,
+        example: '-publishedAt',
+        description: 'Sort spec: a whitelisted column id (ascending) or `-`-prefixed (descending). Unknown keys fall back to `-updatedAt`; `id` is always the tiebreaker.'
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(255),
+    tslib_1.__metadata("design:type", String)
+], PublicListEntriesQueryDto.prototype, "sort", void 0);

package/dist/lib/public-api/http/dto/public-save-entry.dto.d.ts

@@ -0,0 +1,39 @@
+import type { RelationDelta } from '../../../entries/types/entry-list-view';
+/**
+ * Body for the public write routes — `POST /v1/content/:typeName` and
+ * `PATCH /v1/content/:typeName/:id`.
+ *
+ * Its own class rather than a re-export of the admin's `SaveEntryDto`, for the
+ * same reason `PublicEntry` is not `EntryRecord`: this is a **published
+ * contract** an external client codes against, so it must be free to stay still
+ * while the editor's internal shape moves. The two happen to agree today, and
+ * the *validators* are shared (`IsRelationDeltaMap` is imported, not restated)
+ * so the accepted delta shape cannot drift — only the documented surface is
+ * duplicated.
+ *
+ * What is deliberately NOT settable here: `status`, `publishedAt`, `deletedAt`.
+ * Publishing is its own route with its own permission, and the other two are
+ * stamped by the server. `toColumns` projects only keys declared on the type, so
+ * a reserved key in `values` is dropped before storage rather than honoured.
+ */
+export declare class PublicSaveEntryDto {
+    /** Field values keyed by field name. */
+    values: Record<string, unknown>;
+    /**
+     * Per-field relation deltas — the assign / unassign half of the write API.
+     * Many and inverse relations only; an owning single relation is set through
+     * `values`.
+     */
+    relations?: Record<string, RelationDelta>;
+    /**
+     * Locale the created row is written in — **create only**; an update never
+     * re-homes a row's locale.
+     */
+    locale?: string;
+    /**
+     * The translation group a created row joins — how a **new translation of an
+     * existing record** is written. Create only.
+     */
+    localeGroupId?: string;
+}
+//# sourceMappingURL=public-save-entry.dto.d.ts.map

package/dist/lib/public-api/http/dto/public-save-entry.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-save-entry.dto.d.ts","sourceRoot":"","sources":["../../../../../src/lib/public-api/http/dto/public-save-entry.dto.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AAiB5E;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,kBAAkB;IAC3B,wCAAwC;IASxC,MAAM,EAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC;;;;OAIG;IAyBH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAE1C;;;OAGG;IAWH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;OAGG;IASH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B"}

package/dist/lib/public-api/http/dto/public-save-entry.dto.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PublicSaveEntryDto = void 0;
+const tslib_1 = require("tslib");
+const swagger_1 = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+const relation_delta_map_validator_1 = require("../../../entries/http/dto/relation-delta-map.validator");
+/** Longest accepted locale slug (BCP-47's practical bound). */
+const LOCALE_MAX_LENGTH = 35;
+/** OpenAPI schema of one uuid-array leg of a relation delta. */
+const UUID_ARRAY_SCHEMA = {
+    type: 'array',
+    maxItems: relation_delta_map_validator_1.MAX_DELTA_IDS,
+    items: { type: 'string', format: 'uuid' }
+};
+/**
+ * Body for the public write routes — `POST /v1/content/:typeName` and
+ * `PATCH /v1/content/:typeName/:id`.
+ *
+ * Its own class rather than a re-export of the admin's `SaveEntryDto`, for the
+ * same reason `PublicEntry` is not `EntryRecord`: this is a **published
+ * contract** an external client codes against, so it must be free to stay still
+ * while the editor's internal shape moves. The two happen to agree today, and
+ * the *validators* are shared (`IsRelationDeltaMap` is imported, not restated)
+ * so the accepted delta shape cannot drift — only the documented surface is
+ * duplicated.
+ *
+ * What is deliberately NOT settable here: `status`, `publishedAt`, `deletedAt`.
+ * Publishing is its own route with its own permission, and the other two are
+ * stamped by the server. `toColumns` projects only keys declared on the type, so
+ * a reserved key in `values` is dropped before storage rather than honoured.
+ */
+class PublicSaveEntryDto {
+    /** Field values keyed by field name. */
+    values;
+    /**
+     * Per-field relation deltas — the assign / unassign half of the write API.
+     * Many and inverse relations only; an owning single relation is set through
+     * `values`.
+     */
+    relations;
+    /**
+     * Locale the created row is written in — **create only**; an update never
+     * re-homes a row's locale.
+     */
+    locale;
+    /**
+     * The translation group a created row joins — how a **new translation of an
+     * existing record** is written. Create only.
+     */
+    localeGroupId;
+}
+exports.PublicSaveEntryDto = PublicSaveEntryDto;
+tslib_1.__decorate([
+    (0, swagger_1.ApiProperty)({
+        type: 'object',
+        additionalProperties: true,
+        example: { title: 'Hello world', coverImage: null },
+        description: 'Field values keyed by field name — the per-type contract, so this is structurally just an object. Contents are validated against the content type’s field specs (a failure is a 422 carrying per-field issues). A **media** field takes asset ids (one, or an array) from `POST /v1/media/assets`; an id the workspace does not own, or one the field’s `accept` rule excludes, is a 422. An owning **single** relation is set here by target id. Reserved envelope keys (`status`, `publishedAt`, `deletedAt`, `locale`, `localeGroupId`) are not settable.'
+    }),
+    (0, class_validator_1.IsObject)(),
+    tslib_1.__metadata("design:type", Object)
+], PublicSaveEntryDto.prototype, "values", void 0);
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: 'object',
+        maxProperties: relation_delta_map_validator_1.MAX_DELTA_FIELDS,
+        additionalProperties: {
+            type: 'object',
+            properties: {
+                link: UUID_ARRAY_SCHEMA,
+                unlink: UUID_ARRAY_SCHEMA,
+                order: UUID_ARRAY_SCHEMA,
+                by: { type: 'string', enum: ['id', 'localeGroup'] }
+            },
+            additionalProperties: false
+        },
+        example: {
+            tags: {
+                link: ['9c4b1e77-2f0a-4d3b-8e6c-1a5f7b2d9e04'],
+                unlink: ['1f9a3c55-7b21-4e08-9d4a-6c2e8b1f0a37']
+            }
+        },
+        description: `Relation changes, keyed by relation field: \`link\` assigns, \`unlink\` unassigns, \`order\` reorders. A **delta**, not a replacement — ids you do not mention are left alone, so a record with thousands of links never has to be sent whole. Many-to-many and inverse relations only; naming an owning single relation here is a 400 (set it through \`values\`). At most ${relation_delta_map_validator_1.MAX_DELTA_FIELDS} fields per save and ${relation_delta_map_validator_1.MAX_DELTA_IDS} ids per array; \`order\` is accepted on the owning side only. Every id must name an entry in the same workspace, or the save is a 422.\n\n**Locales.** When both this type and the target are localized, a link may not cross locales — the English article links the English tag — and a target in another locale is a 422. Set \`by: "localeGroup"\` to pass **translation group** ids instead of entry ids: each is resolved to that group's row in this entry's own locale, so a client that thinks in stories never has to keep a per-locale id map. A group with no row in this locale is a 422 telling you to translate it first.`
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsObject)(),
+    (0, relation_delta_map_validator_1.IsRelationDeltaMap)(),
+    tslib_1.__metadata("design:type", Object)
+], PublicSaveEntryDto.prototype, "relations", void 0);
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: String,
+        maxLength: LOCALE_MAX_LENGTH,
+        example: 'de',
+        description: 'Locale slug the entry is created in; absent means the configured default. An unknown slug is a 400. **Create only** — an update never re-homes a row’s locale, and sending it there is ignored. Ignored on types that are not localized.'
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(LOCALE_MAX_LENGTH),
+    tslib_1.__metadata("design:type", String)
+], PublicSaveEntryDto.prototype, "locale", void 0);
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: String,
+        format: 'uuid',
+        description: 'The existing translation group the new row joins, making it a sibling translation — this is how you add a locale to a record you already have (take `localeGroupId` off any read, POST with it plus a different `locale`). Absent → the row starts its own fresh group. An unknown group is a 404; a locale the group already holds is a 409. **Create only.**'
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsUUID)(),
+    tslib_1.__metadata("design:type", String)
+], PublicSaveEntryDto.prototype, "localeGroupId", void 0);

package/dist/lib/public-api/http/guards/api-token-workspace.guard.d.ts

@@ -0,0 +1,25 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+/**
+ * Resolves which of a token's workspaces a public-API request targets, and
+ * stamps it on the request for `@CurrentWorkspace()` — the token-authenticated
+ * counterpart of workspaces' membership-based `WorkspaceGuard`.
+ *
+ * The rule:
+ *
+ * - `X-Workspace-Id` present → it must be well-formed (400) **and** in the
+ *   token's bucket (403). A token can never read a workspace it wasn't minted
+ *   for, whatever the header says.
+ * - Header absent, token covers exactly one workspace → that workspace. A
+ *   single-workspace token needs no header at all, which is what makes the
+ *   common case a one-line fetch.
+ * - Header absent, token covers several → 400. Guessing would silently pick a
+ *   workspace for the caller, and "why is this empty?" is a much worse failure
+ *   than an explicit error.
+ *
+ * Runs **after** {@link ApiTokenGuard} (which attaches `request.apiToken`);
+ * reaching it without a token is a wiring bug, not an unauthenticated caller.
+ */
+export declare class ApiTokenWorkspaceGuard implements CanActivate {
+    canActivate(context: ExecutionContext): boolean;
+}
+//# sourceMappingURL=api-token-workspace.guard.d.ts.map

package/dist/lib/public-api/http/guards/api-token-workspace.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-token-workspace.guard.d.ts","sourceRoot":"","sources":["../../../../../src/lib/public-api/http/guards/api-token-workspace.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEH,WAAW,EACX,gBAAgB,EAInB,MAAM,gBAAgB,CAAC;AAOxB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBACa,sBAAuB,YAAW,WAAW;IACtD,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;CAmClD"}

package/dist/lib/public-api/http/guards/api-token-workspace.guard.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiTokenWorkspaceGuard = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const workspaces_server_1 = require("@orthacms/workspaces-server");
+/**
+ * Resolves which of a token's workspaces a public-API request targets, and
+ * stamps it on the request for `@CurrentWorkspace()` — the token-authenticated
+ * counterpart of workspaces' membership-based `WorkspaceGuard`.
+ *
+ * The rule:
+ *
+ * - `X-Workspace-Id` present → it must be well-formed (400) **and** in the
+ *   token's bucket (403). A token can never read a workspace it wasn't minted
+ *   for, whatever the header says.
+ * - Header absent, token covers exactly one workspace → that workspace. A
+ *   single-workspace token needs no header at all, which is what makes the
+ *   common case a one-line fetch.
+ * - Header absent, token covers several → 400. Guessing would silently pick a
+ *   workspace for the caller, and "why is this empty?" is a much worse failure
+ *   than an explicit error.
+ *
+ * Runs **after** {@link ApiTokenGuard} (which attaches `request.apiToken`);
+ * reaching it without a token is a wiring bug, not an unauthenticated caller.
+ */
+let ApiTokenWorkspaceGuard = class ApiTokenWorkspaceGuard {
+    canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        const token = request.apiToken;
+        if (!token) {
+            throw new common_1.UnauthorizedException();
+        }
+        const header = request.headers[workspaces_server_1.WORKSPACE_HEADER];
+        const requested = Array.isArray(header) ? header[0] : header;
+        if (!requested) {
+            if (token.workspaceIds.length === 1) {
+                request.workspaceId = token.workspaceIds[0];
+                return true;
+            }
+            throw new common_1.BadRequestException(`This token covers ${token.workspaceIds.length} workspaces — name the one you want with the X-Workspace-Id header.`);
+        }
+        if (!workspaces_server_1.WORKSPACE_ID_PATTERN.test(requested)) {
+            throw new common_1.BadRequestException('Malformed X-Workspace-Id header.');
+        }
+        if (!token.workspaceIds.includes(requested)) {
+            // Not-in-bucket and no-such-workspace are the same 403, so a token
+            // can't be used to probe which workspace ids exist.
+            throw new common_1.ForbiddenException('This token does not cover that workspace.');
+        }
+        request.workspaceId = requested;
+        return true;
+    }
+};
+exports.ApiTokenWorkspaceGuard = ApiTokenWorkspaceGuard;
+exports.ApiTokenWorkspaceGuard = ApiTokenWorkspaceGuard = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], ApiTokenWorkspaceGuard);