@orthacms/content-server 0.0.0-reserve.0

package/dist/lib/public-api/infrastructure/public-entries.query.js

@@ -0,0 +1,557 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PublicEntriesQuery = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const drizzle_orm_1 = require("drizzle-orm");
+const database_1 = require("@orthacms/database");
+const utils_server_1 = require("@orthacms/utils-server");
+const entry_extension_1 = require("../../extension/entry-extension");
+const content_type_1 = require("../../types/content-type");
+const fields_1 = require("../../types/fields");
+const relation_link_service_1 = require("../../entries/infrastructure/persistence/relation-link.service");
+const entry_scalar_fields_1 = require("../../entries/infrastructure/queries/entry-scalar-fields");
+const entry_filter_surface_1 = require("../../entries/infrastructure/queries/entry-filter-surface");
+const entry_search_1 = require("../../entries/infrastructure/queries/entry-search");
+const field_selection_1 = require("./field-selection");
+const public_expansion_query_1 = require("./public-expansion.query");
+const entries_constants_1 = require("../../entries/entries.constants");
+const public_list_entries_query_dto_1 = require("../http/dto/public-list-entries-query.dto");
+const public_entry_row_1 = require("./public-entry-row");
+/**
+ * The read side of the public content API. Generic over the content type like
+ * the admin's `EntriesService` — the physical table and the sortable columns
+ * are derived from `type` per request, so one service serves every code-defined
+ * collection and single.
+ *
+ * It **reuses** the admin's query machinery where the semantics are identical —
+ * the same ILIKE search predicate and the same query-builder filter engine, so
+ * one query language covers both surfaces — but it is deliberately **not** built
+ * on `EntriesService` itself. Several of that service's knobs (`?deleted=only`
+ * most obviously) select rows this API must never serve, and reaching through it
+ * to subtract them would make the visibility rule an argument about what was
+ * *not* passed. Instead the public read states its own WHERE, so "what can a
+ * token see?" is answerable by reading one method:
+ *
+ * - the **workspace** the request resolved to, always;
+ * - **published only**, on publishable types — a draft is unfinished work and
+ *   never leaves the admin;
+ * - **not soft-deleted**, on paranoid types;
+ * - the bound `CONTENT_ENTRY_EXTENSION`'s scope, so a localized type reads the
+ *   requested locale (and the same rules the admin gets) for free.
+ *
+ * `?search=` and `?filter=` narrow that set further; neither can widen it, since
+ * both are AND-ed onto the predicate above.
+ */
+let PublicEntriesQuery = class PublicEntriesQuery {
+    db;
+    expansion;
+    relationLinks;
+    extension;
+    constructor(db, expansion, relationLinks, extension) {
+        this.db = db;
+        this.expansion = expansion;
+        this.relationLinks = relationLinks;
+        this.extension = extension;
+    }
+    /**
+     * One page of a type's publicly readable entries. Count and page share the
+     * WHERE and run concurrently, so the request pays the slower of the two.
+     */
+    async list(type, query, workspaceId, grantedTypes) {
+        const page = query.page ?? 1;
+        const pageSize = query.pageSize ?? entries_constants_1.DEFAULT_PAGE_SIZE;
+        const selected = (0, field_selection_1.parseFieldSelection)(type, query.fields);
+        const relationFields = query.relations === public_list_entries_query_dto_1.PREVIEW
+            ? this.expansion.parseRelationFields(type, query.relationFields, grantedTypes)
+            : [];
+        const mediaFields = query.media === public_list_entries_query_dto_1.PREVIEW
+            ? this.expansion.parseMediaFields(type, query.mediaFields)
+            : [];
+        const translations = this.wantsTranslations(type, query);
+        const where = (0, drizzle_orm_1.and)(this.readableWhere(type, workspaceId, query.locale, query.status), (0, entry_search_1.buildSearchPredicate)(type, query.search), await this.filterPredicate(type, query.filter, workspaceId, grantedTypes));
+        // An expansion reads columns that never appear in `values` — an owning
+        // single relation's FK, a media field's ids — so a `?fields=` selection
+        // must still carry them or the preview would find nothing to resolve.
+        const projection = this.projection(type, selected, [
+            ...relationFields,
+            ...mediaFields
+        ]);
+        const rowsQuery = projection
+            ? this.db.select(projection).from(type.table)
+            : this.db.select().from(type.table);
+        const [[{ total }], rows] = await Promise.all([
+            this.db.select({ total: (0, drizzle_orm_1.count)() }).from(type.table).where(where),
+            rowsQuery
+                .where(where)
+                .orderBy(...this.orderBy(type, query.sort))
+                .limit(pageSize)
+                .offset((page - 1) * pageSize)
+        ]);
+        const items = rows.map((row) => (0, public_entry_row_1.toPublicEntry)(type, row, selected));
+        await this.attachExpansions(type, items, rows, workspaceId, { relations: relationFields, media: mediaFields, translations }, {
+            relation: query.relationLimit,
+            media: query.mediaLimit
+        }, selected);
+        return { items, total, page, pageSize };
+    }
+    /**
+     * Attach the opt-in relation / media / translation previews to an
+     * already-projected page. Every resolver is batched across the whole page,
+     * so this adds a bounded number of queries per requested field (and one for
+     * translations) — never one per row.
+     */
+    async attachExpansions(type, items, rows, workspaceId, want, limits, selected) {
+        if (!want.relations.length &&
+            !want.media.length &&
+            !want.translations) {
+            return;
+        }
+        const [relations, media, translations] = await Promise.all([
+            this.expansion.relationsForRows(type, want.relations, rows, workspaceId, limits.relation),
+            this.expansion.mediaForRows(type, want.media, rows, workspaceId, limits.media),
+            want.translations
+                ? this.translationsForEntries(type, items, workspaceId, selected)
+                : undefined
+        ]);
+        for (const item of items) {
+            // Keys are present-but-empty when the caller asked for a field the
+            // entry has no links in, so a consumer can read `relations.author`
+            // without testing for the map itself.
+            if (want.relations.length) {
+                item.relations = relations.get(item.id) ?? {};
+                for (const field of want.relations) {
+                    item.relations[field] ??= { items: [], total: 0 };
+                }
+            }
+            if (want.media.length) {
+                item.media = media.get(item.id) ?? {};
+                for (const field of want.media) {
+                    item.media[field] ??= { items: [], total: 0 };
+                }
+            }
+            // Likewise present-but-empty: an entry that is the only published
+            // row in its group reports `[]`, not a missing key, so "no other
+            // translations" and "you didn't ask" stay distinguishable.
+            if (want.translations) {
+                item.translations = translations?.get(item.id) ?? [];
+            }
+        }
+    }
+    /**
+     * Whether this request wants sibling translations — and a **400** when it
+     * asks for them on a type that isn't localized.
+     *
+     * Refusing rather than returning an empty list is the same call
+     * `relationFields` makes for a non-relation field: the type has no
+     * translation group at all, so `[]` would read as "this entry has no other
+     * locales" when the truth is "this content is not localized".
+     */
+    wantsTranslations(type, query) {
+        if (query.translations !== public_list_entries_query_dto_1.PREVIEW) {
+            return false;
+        }
+        this.assertLocalized(type, 'translations');
+        return true;
+    }
+    /** Guard a locale-only feature against a type that has no locale rows. */
+    assertLocalized(type, param) {
+        if (!type.i18n) {
+            throw new common_1.BadRequestException(`${param}: "${type.name}" is not a localized content type.`);
+        }
+    }
+    /**
+     * The sibling translations of every entry on a page, keyed by entry id.
+     *
+     * **One** query for the whole page: the group ids are collected and read
+     * with a single `locale_group_id IN (…)`, which the
+     * `(locale_group_id, locale)` index serves. No cap is applied — a group
+     * holds at most one row per configured locale, so its size is bounded by
+     * the host's own config rather than by user data.
+     *
+     * Deliberately built on {@link liveWhere} and not `readableWhere`: the
+     * extension's `listScope` pins the read to a **single** locale, which is
+     * exactly what a translation lookup must not do. Everything else about
+     * visibility is unchanged — workspace, published-only, not soft-deleted —
+     * so a locale that exists only as a draft stays invisible here too.
+     */
+    async translationsForEntries(type, items, workspaceId, selected) {
+        const out = new Map();
+        const groupIds = [
+            ...new Set(items
+                .map((item) => item.localeGroupId)
+                .filter((id) => !!id))
+        ];
+        if (!groupIds.length) {
+            return out;
+        }
+        const table = type.table;
+        const projection = this.projection(type, selected);
+        const rowsQuery = projection
+            ? this.db.select(projection).from(type.table)
+            : this.db.select().from(type.table);
+        const rows = (await rowsQuery
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.inArray)(table['localeGroupId'], groupIds), this.liveWhere(type, workspaceId)))
+            .orderBy((0, drizzle_orm_1.asc)(table['locale'])));
+        const byGroup = new Map();
+        for (const row of rows) {
+            const group = row['localeGroupId'];
+            const bucket = byGroup.get(group);
+            if (bucket)
+                bucket.push(row);
+            else
+                byGroup.set(group, [row]);
+        }
+        for (const item of items) {
+            const siblings = byGroup.get(item.localeGroupId ?? '') ?? [];
+            out.set(item.id, siblings
+                // The entry itself is the row the caller already holds;
+                // repeating it inside its own `translations` would double
+                // every payload for nothing.
+                .filter((row) => row['id'] !== item.id)
+                .map((row) => (0, public_entry_row_1.toPublicEntry)(type, row, selected)));
+        }
+        return out;
+    }
+    /**
+     * The sibling translations of one entry — the `/translations` sibling route,
+     * for a consumer that has the entry and wants its other locales without
+     * re-reading it. 404 for an entry that isn't publicly readable, exactly like
+     * the entry route; 400 on a type that isn't localized.
+     */
+    async translationsOf(type, locator, workspaceId, query) {
+        this.assertLocalized(type, 'translations');
+        const selected = (0, field_selection_1.parseFieldSelection)(type, query.fields);
+        const row = await this.readableRow(type, locator, workspaceId, query.locale, query.status);
+        const entry = (0, public_entry_row_1.toPublicEntry)(type, row, selected);
+        const byEntry = await this.translationsForEntries(type, [entry], workspaceId, selected);
+        return byEntry.get(entry.id) ?? [];
+    }
+    /**
+     * The SELECT list for a `?fields=` selection, or `undefined` to select the
+     * whole row. Narrowing this is the point of a sparse fieldset: without it
+     * the query still reads (and Postgres still detoasts) a richtext column the
+     * caller asked to leave out, and only the serializer saves any bytes.
+     *
+     * The envelope is always included — `toPublicEntry` reads those columns
+     * unconditionally, and they are what make an entry addressable. The WHERE
+     * and ORDER BY may reference columns outside this list; SQL allows that, so
+     * filtering and sorting stay unrestricted by the selection.
+     */
+    projection(type, selected, alsoNeeded = []) {
+        if (!selected) {
+            return undefined;
+        }
+        const table = type.table;
+        const columns = {
+            id: table['id'],
+            createdAt: table['createdAt'],
+            updatedAt: table['updatedAt']
+        };
+        if (type.publishable) {
+            columns['status'] = table['status'];
+            columns['publishedAt'] = table['publishedAt'];
+        }
+        if (type.i18n) {
+            columns['locale'] = table['locale'];
+            columns['localeGroupId'] = table['localeGroupId'];
+        }
+        // `Object.hasOwn` on both loops. `selected` is already own-property
+        // validated against the type's field map (`parseFieldSelection`), and
+        // `alsoNeeded` carries internal constants — but the failure mode here
+        // is putting a drizzle table's INHERITED member (a class function) into
+        // a `.select()` list, which is a 500, and a reader should not have to
+        // work out which of the two loops is the safe one.
+        for (const name of selected) {
+            if (Object.hasOwn(table, name))
+                columns[name] = table[name];
+        }
+        for (const name of alsoNeeded) {
+            // Join-backed relations own no column on this table; skip them
+            // rather than putting `undefined` in the SELECT list.
+            if (Object.hasOwn(table, name) && table[name]) {
+                columns[name] = table[name];
+            }
+        }
+        return columns;
+    }
+    /**
+     * One publicly readable entry, addressed by **either** spelling of
+     * {@link EntryLocator}.
+     *
+     * By id: a draft, a soft-deleted row, an entry in another workspace, and an
+     * id that never existed are all the same 404 — an unpublished entry must not
+     * be distinguishable from a missing one.
+     *
+     * By translation group, the read a localized front-end actually wants: a
+     * consumer that knows an article by its group id ("this story") renders it
+     * in whatever locale the visitor is in by varying `?locale=` alone, instead
+     * of keeping a per-locale id map — the group id is the stable identity of
+     * the story across languages, while each locale's `id` is not. A group with
+     * no published row in the requested locale is the same 404 as an unknown
+     * group: the caller asked for content that isn't live in that language, and
+     * which of the two it is isn't theirs to learn.
+     */
+    async getOne(type, locator, workspaceId, query, grantedTypes) {
+        const selected = (0, field_selection_1.parseFieldSelection)(type, query.fields);
+        const relationFields = query.relations === public_list_entries_query_dto_1.PREVIEW
+            ? this.expansion.parseRelationFields(type, query.relationFields, grantedTypes)
+            : [];
+        const mediaFields = query.media === public_list_entries_query_dto_1.PREVIEW
+            ? this.expansion.parseMediaFields(type, query.mediaFields)
+            : [];
+        const projection = this.projection(type, selected, [
+            ...relationFields,
+            ...mediaFields
+        ]);
+        const rowQuery = projection
+            ? this.db.select(projection).from(type.table)
+            : this.db.select().from(type.table);
+        const [row] = await rowQuery
+            .where(this.entryWhere(type, locator, workspaceId, query.locale, query.status))
+            .limit(1);
+        if (!row) {
+            throw new common_1.NotFoundException(this.notFoundFor(type, locator));
+        }
+        const entry = (0, public_entry_row_1.toPublicEntry)(type, row, selected);
+        // One row is still a "page" as far as the batched resolvers care, so
+        // the single read reuses exactly the list's expansion path.
+        await this.attachExpansions(type, [entry], [row], workspaceId, {
+            relations: relationFields,
+            media: mediaFields,
+            translations: this.wantsTranslations(type, query)
+        }, { relation: query.relationLimit, media: query.mediaLimit }, selected);
+        return entry;
+    }
+    /**
+     * The row a locator names, for a **write** — its id addresses the write, and
+     * its stored values are what a partial update merges onto.
+     *
+     * Resolved with `status: 'any'`, because writes address rows in whatever
+     * state they are in — the overwhelmingly common case is editing a draft,
+     * which the published-only default would hide. Everything else about the
+     * lookup is the read rule verbatim (workspace, not soft-deleted, the
+     * requested locale), so a token can never reach across a workspace with a
+     * write that it could not reach with a read.
+     *
+     * Lives here rather than in the write service so there is exactly one
+     * implementation of "which row does this locator mean?" — a second one that
+     * forgot the workspace clause is the failure this avoids.
+     */
+    async resolveWritableRow(type, locator, workspaceId, locale) {
+        // An id locator is still a real lookup, not a pass-through: an id in
+        // another workspace or a soft-deleted one has to 404 here rather than
+        // reach the writer, which scopes by workspace but would report the
+        // mismatch as its own kind of failure.
+        return this.readableRow(type, locator, workspaceId, locale, 'any');
+    }
+    /**
+     * The full predicate for a **single-entry** read: the locator, the
+     * locale-independent visibility rule, and — for a group locator only — the
+     * extension's locale scope.
+     *
+     * That asymmetry is the point. A **group** id names a whole translation
+     * group, so the locale is what picks the row out of it; `LIMIT 1` never has
+     * to break a tie. An **entry id** already names exactly one row, so AND-ing
+     * the locale scope onto it can do nothing except turn a valid id into a 404
+     * whenever that row is not in the default locale. That used to be the
+     * behaviour, documented as a sharp edge; the write API made it untenable,
+     * since updating a German article by its own id would have needed
+     * `?locale=de` appended to a request that already named the row uniquely.
+     *
+     * The narrowing is safe because `liveWhere` still carries the whole of the
+     * *visibility* rule — workspace, publish state, soft delete. The extension's
+     * `listScope` is, per its own name and its one implementation, about
+     * choosing rows out of a *set*; a request that names one row has already
+     * chosen.
+     *
+     * What the asymmetry must **not** cost is validation. Dropping the scope
+     * from an id read also dropped the only thing that looks at `?locale=`, so
+     * `?locale=zz` went from a 400 to being silently ignored — a typo that
+     * quietly returns another language's content, on a contract that says
+     * every route taking a locale rejects an unknown one. Hence the discarded
+     * call below: `listScope` validates as well as narrows (see the port's
+     * docs), and only the narrowing is unwanted here.
+     */
+    entryWhere(type, locator, workspaceId, locale, visibility) {
+        const table = type.table;
+        if ('id' in locator) {
+            // Called for its validation, not its predicate — an unknown slug
+            // throws here. Do not "clean up" the unused return value.
+            this.extension?.listScope(type, workspaceId, { locale });
+            return (0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(table['id'], locator.id), this.liveWhere(type, workspaceId, visibility));
+        }
+        // A group locator is only meaningful on a localized type, and is a 400
+        // elsewhere — the caller addressed the entry by something the type does
+        // not have, which is a different mistake from naming a group that does
+        // not exist (a 404).
+        this.assertLocalized(type, 'localeGroupId');
+        return (0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(table['localeGroupId'], locator.localeGroupId), this.liveWhere(type, workspaceId, visibility), this.extension?.listScope(type, workspaceId, { locale }));
+    }
+    /** The 404 message for a locator that matched nothing readable. */
+    notFoundFor(type, locator) {
+        return 'id' in locator
+            ? `No published "${type.name}" entry with id "${locator.id}".`
+            : `No published "${type.name}" entry in translation group "${locator.localeGroupId}" for the requested locale.`;
+    }
+    /**
+     * One page of a single relation field's links — the only relation read that
+     * `?relations=preview` cannot express, and therefore the only one with a
+     * route of its own.
+     */
+    async relationField(type, locator, field, page, pageSize, workspaceId, grantedTypes, locale, visibility) {
+        const spec = type.fields[field];
+        if (!spec ||
+            spec.type !== fields_1.CONTENT_FIELD_TYPE.Relation ||
+            !spec.relation) {
+            throw new common_1.BadRequestException(`"${field}" is not a relation field on "${type.name}".`);
+        }
+        if (!grantedTypes.has(spec.relation.to().name)) {
+            throw new common_1.BadRequestException(`"${field}" cannot be expanded — this workspace has no access to "${spec.relation.to().name}".`);
+        }
+        const row = await this.readableRow(type, locator, workspaceId, locale, visibility);
+        const view = await this.relationLinks.readField(type, row, field, spec, page, pageSize, workspaceId, { publishedOnly: true });
+        const hydrated = await this.expansion.hydrateRelationViews(type, { [field]: view }, workspaceId);
+        return hydrated[field];
+    }
+    /** Every media field of one entry, resolved to asset metadata + URLs. */
+    async mediaOf(type, locator, workspaceId, locale, limit = public_list_entries_query_dto_1.DEFAULT_EXPANSION_LIMIT, visibility) {
+        const row = await this.readableRow(type, locator, workspaceId, locale, visibility);
+        const fields = Object.entries(type.fields)
+            .filter(([, spec]) => spec.type === fields_1.CONTENT_FIELD_TYPE.Media)
+            .map(([name]) => name);
+        const media = await this.expansion.mediaForRows(type, fields, [row], workspaceId, limit);
+        // Keyed by the row's OWN id, not by anything in the locator — a group
+        // locator resolved to a row whose id the caller may never have seen.
+        const out = media.get(row['id']) ?? {};
+        for (const field of fields)
+            out[field] ??= { items: [], total: 0 };
+        return out;
+    }
+    /**
+     * The full row of one publicly readable entry, or a 404 — the shared
+     * pre-step of the sibling routes, so `/relations/:field`, `/media`, and
+     * `/translations` are exactly as invisible for a draft or foreign entry as
+     * the entry read itself, in either addressing form.
+     */
+    async readableRow(type, locator, workspaceId, locale, visibility) {
+        const [row] = await this.db
+            .select()
+            .from(type.table)
+            .where(this.entryWhere(type, locator, workspaceId, locale, visibility))
+            .limit(1);
+        if (!row) {
+            throw new common_1.NotFoundException(this.notFoundFor(type, locator));
+        }
+        return row;
+    }
+    /**
+     * Translate one `?filter=` payload — the same query-builder tree the admin
+     * records list takes — against a surface derived from the type.
+     *
+     * Two departures from the admin's version, both deliberate:
+     *
+     * - **Grant-pruned.** `grantedTypes` is passed, so a relation whose target
+     *   the workspace was never granted is omitted from the surface and a rule
+     *   naming it 400s. Without it, `author.name eq "Ada"` would let a token
+     *   infer relation data by watching which entries come back — data this API
+     *   deliberately does not return. The admin's list leaves this unset on
+     *   purpose (there it is a SQL whitelist, not a visibility boundary); here
+     *   it is exactly a visibility boundary.
+     * - **No `status`.** The read already forces `status = published`, so a
+     *   `status` rule could only be a no-op or match nothing. Dropping it from
+     *   the schema turns a confusingly empty page into a clear 400.
+     *
+     * Built lazily — the surface walks the type's whole relation graph to the
+     * hop budget, so an unfiltered list (the common case) never pays for it.
+     * A malformed filter throws `FilterException`, which is a 400.
+     */
+    async filterPredicate(type, filter, workspaceId, grantedTypes) {
+        if (!filter) {
+            return undefined;
+        }
+        const { schema } = (0, entry_filter_surface_1.buildEntryFilterSurface)(type, {
+            workspaceId,
+            grantedTypes
+        });
+        if (schema.fields) {
+            delete schema.fields['status'];
+        }
+        const tree = (0, utils_server_1.parseFilterTree)(filter, schema);
+        return (0, utils_server_1.applyFilterTree)(tree, schema, type.table, this.db);
+    }
+    /**
+     * The predicate every public read shares — the whole visibility rule in one
+     * place. `and(undefined, …)` collapses the clauses a type doesn't have, so
+     * a plain non-publishable, non-paranoid type reduces to the workspace scope.
+     */
+    readableWhere(type, workspaceId, locale, visibility = 'published') {
+        return (0, drizzle_orm_1.and)(this.liveWhere(type, workspaceId, visibility), 
+        // No-op for types the extension doesn't apply to; for an i18n type
+        // it scopes to the requested locale (rejecting an unknown one).
+        this.extension?.listScope(type, workspaceId, { locale }));
+    }
+    /**
+     * The locale-**independent** half of {@link readableWhere}: workspace,
+     * published-only, not soft-deleted. Split out for the one read that must
+     * span locales — a translation lookup, whose whole job is to find the rows
+     * `listScope` would have filtered away — so that read narrows the entry
+     * visibility rule in exactly one respect and inherits the rest verbatim.
+     */
+    liveWhere(type, workspaceId, visibility = 'published') {
+        const table = type.table;
+        return (0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(table['workspaceId'], workspaceId), this.statusWhere(type, visibility), type.paranoid ? (0, drizzle_orm_1.isNull)(table['deletedAt']) : undefined);
+    }
+    /**
+     * The publish-state clause. `published` — the default and everything a
+     * read-only token can ask for — is the API's headline rule; the other two
+     * exist so a write-scoped token can read back what it just created.
+     *
+     * A non-publishable type has no `status` column and every row is simply
+     * live, so this is a no-op there rather than an error: the caller asked for
+     * a distinction the type does not make.
+     */
+    statusWhere(type, visibility) {
+        if (!type.publishable || visibility === 'any') {
+            return undefined;
+        }
+        const table = type.table;
+        return (0, drizzle_orm_1.eq)(table['status'], visibility === 'draft' ? content_type_1.ENTRY_STATUS.Draft : content_type_1.ENTRY_STATUS.Published);
+    }
+    /**
+     * Translate `?sort=` (`col` ascending, `-col` descending) into an ORDER BY,
+     * always with an `id` tiebreaker so paging is stable across requests.
+     * Sortable = the envelope timestamps, `publishedAt` (publishable types),
+     * `locale` (i18n types), and the type's **scalar** fields — the same
+     * whitelist rule the admin list uses, so a sort key never reaches
+     * `asc(undefined)`. Unknown or excluded keys fall back to newest-updated.
+     */
+    orderBy(type, sort) {
+        const table = type.table;
+        const sortable = new Set([
+            'createdAt',
+            'updatedAt',
+            ...(type.publishable ? ['publishedAt'] : []),
+            ...(type.i18n ? ['locale'] : []),
+            ...Object.entries(type.fields)
+                .filter(([, spec]) => (0, entry_scalar_fields_1.isScalarField)(spec))
+                .map(([name]) => name)
+        ]);
+        const isDesc = !!sort && sort.startsWith('-');
+        const columnId = sort ? (isDesc ? sort.slice(1) : sort) : '';
+        const column = sortable.has(columnId) ? table[columnId] : undefined;
+        if (column) {
+            return [isDesc ? (0, drizzle_orm_1.desc)(column) : (0, drizzle_orm_1.asc)(column), (0, drizzle_orm_1.asc)(table['id'])];
+        }
+        return [(0, drizzle_orm_1.desc)(table['updatedAt']), (0, drizzle_orm_1.asc)(table['id'])];
+    }
+};
+exports.PublicEntriesQuery = PublicEntriesQuery;
+exports.PublicEntriesQuery = PublicEntriesQuery = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(0, (0, database_1.InjectDatabase)()),
+    tslib_1.__param(3, (0, common_1.Optional)()),
+    tslib_1.__param(3, (0, common_1.Inject)(entry_extension_1.CONTENT_ENTRY_EXTENSION)),
+    tslib_1.__metadata("design:paramtypes", [Object, public_expansion_query_1.PublicExpansionQuery,
+        relation_link_service_1.RelationLinkService, Object])
+], PublicEntriesQuery);

package/dist/lib/public-api/infrastructure/public-entry-row.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The row → {@link PublicEntry} projection. Pure shape translation: no DB
+ * access, no NestJS. Separate from the admin's `toRecord` because the public
+ * wire contract is its own thing (see `types/public-entry.ts`).
+ */
+import type { AnyContentType } from '../../types/content-type';
+import type { PublicEntry } from '../types/public-entry';
+/** A generated content table row seen as a bag of values by property name. */
+type Row = Record<string, unknown>;
+/**
+ * Whether a field carries the entry's **own** value — a scalar, a `json` or
+ * `multiselect` bag, anything stored in the row and meaningful on its own.
+ * See {@link REFERENCE_FIELD_TYPES} for what this excludes and why.
+ */
+export declare function isPureValueField(spec: AnyContentType['fields'][string]): boolean;
+/**
+ * Projects a raw DB row onto the public wire shape: the envelope (`id`,
+ * timestamps, plus `publishedAt` / locale columns where the type has them) and
+ * a `values` bag of the entry's **own** field values — every field except the
+ * reference kinds (see {@link REFERENCE_FIELD_TYPES}). An unset field reads
+ * back as `null`, never as a missing key, so the key set is stable across
+ * entries of a type.
+ *
+ * `selected` narrows `values` to a `?fields=` sparse fieldset. It must be
+ * passed whenever the row was read with a narrowed projection: without it the
+ * loop would emit `title: null` for a column the query never selected, which
+ * reads as "this entry has no title" rather than "you didn't ask for it".
+ */
+export declare function toPublicEntry(type: AnyContentType, row: Row, selected?: ReadonlySet<string>): PublicEntry;
+export {};
+//# sourceMappingURL=public-entry-row.d.ts.map

package/dist/lib/public-api/infrastructure/public-entry-row.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-entry-row.d.ts","sourceRoot":"","sources":["../../../../src/lib/public-api/infrastructure/public-entry-row.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD,8EAA8E;AAC9E,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAsBnC;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC5B,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GACvC,OAAO,CAET;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CACzB,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,EACR,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAC/B,WAAW,CAwBb"}

package/dist/lib/public-api/infrastructure/public-entry-row.js

@@ -0,0 +1,76 @@
+"use strict";
+/**
+ * The row → {@link PublicEntry} projection. Pure shape translation: no DB
+ * access, no NestJS. Separate from the admin's `toRecord` because the public
+ * wire contract is its own thing (see `types/public-entry.ts`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPureValueField = isPureValueField;
+exports.toPublicEntry = toPublicEntry;
+const fields_1 = require("../../types/fields");
+/**
+ * Field types the public read omits entirely — every kind whose value is a
+ * **reference to something else** rather than the entry's own data.
+ *
+ * `relation` covers all four cardinalities: an owning many-relation and an
+ * inverse have no column to read anyway, and an owning single one does (a
+ * `<field>_id` FK) but is dropped too, so the rule is one line rather than a
+ * per-cardinality carve-out. `media` is an asset id (or a list of them) in the
+ * media plugin's own store.
+ *
+ * The public API resolves neither today, so emitting a bare uuid would hand a
+ * consumer an identifier with nothing to do with it. **This is deliberately
+ * provisional** — when relation and media reads land, this set shrinks and the
+ * omitted fields start appearing in `values`, which is an additive change.
+ */
+const REFERENCE_FIELD_TYPES = new Set([
+    fields_1.CONTENT_FIELD_TYPE.Relation,
+    fields_1.CONTENT_FIELD_TYPE.Media
+]);
+/**
+ * Whether a field carries the entry's **own** value — a scalar, a `json` or
+ * `multiselect` bag, anything stored in the row and meaningful on its own.
+ * See {@link REFERENCE_FIELD_TYPES} for what this excludes and why.
+ */
+function isPureValueField(spec) {
+    return !REFERENCE_FIELD_TYPES.has(spec.type);
+}
+/**
+ * Projects a raw DB row onto the public wire shape: the envelope (`id`,
+ * timestamps, plus `publishedAt` / locale columns where the type has them) and
+ * a `values` bag of the entry's **own** field values — every field except the
+ * reference kinds (see {@link REFERENCE_FIELD_TYPES}). An unset field reads
+ * back as `null`, never as a missing key, so the key set is stable across
+ * entries of a type.
+ *
+ * `selected` narrows `values` to a `?fields=` sparse fieldset. It must be
+ * passed whenever the row was read with a narrowed projection: without it the
+ * loop would emit `title: null` for a column the query never selected, which
+ * reads as "this entry has no title" rather than "you didn't ask for it".
+ */
+function toPublicEntry(type, row, selected) {
+    const values = {};
+    for (const [name, spec] of Object.entries(type.fields)) {
+        if (!isPureValueField(spec))
+            continue;
+        if (selected && !selected.has(name))
+            continue;
+        values[name] = row[name] ?? null;
+    }
+    const entry = {
+        id: row['id'],
+        createdAt: row['createdAt'].toISOString(),
+        updatedAt: row['updatedAt'].toISOString(),
+        values
+    };
+    if (type.publishable) {
+        entry.status = row['status'];
+        const publishedAt = row['publishedAt'];
+        entry.publishedAt = publishedAt ? publishedAt.toISOString() : null;
+    }
+    if (type.i18n) {
+        entry.locale = row['locale'];
+        entry.localeGroupId = row['localeGroupId'];
+    }
+    return entry;
+}