@pilotiq/pilotiq 0.24.1 → 0.24.2

package/src/actions/crudFactories.ts

@@ -1,220 +0,0 @@
-/**
- * CRUD single-row Action factories — `create / edit / view / delete /
- * replicate / restore / forceDelete`, plus the notification `markAsRead`
- * factory.
- *
- * Each factory builds and returns a configured `Action`. The matching
- * `static` methods on the `Action` class are thin delegators that call
- * into these functions, preserving the public `Action.create(R, base)`
- * call shape.
- *
- * See `docs/plans/action-split.md` for the split plan.
- */
-
-import { Action, type ReplicateOptions, type ResourceLike } from './Action.js'
-import { buildReplica, callPredicate, isTrashed, resourceBase } from './factoryHelpers.js'
-
-/** Create-action factory — link to `${basePath}/${R.slug}/create`.
- * Auto-hides when `R.canCreate(user)` returns false. */
-export function createAction(R: ResourceLike, basePath: string): Action {
-  return Action.make('create')
-    .label(`New ${R.labelSingular}`)
-    .href(`${resourceBase(basePath, R)}/create`)
-    .visible(({ user }) => callPredicate(R.canCreate, user))
-}
-
-/**
- * Edit-action factory — link to the resource's edit page.
- *
- * Pass `recordId` when building actions for a single-record context
- * (e.g. `ViewPage.getActions()`); the URL is baked at config time.
- * Omit `recordId` for row context (`Table.recordActions(...)`); the
- * URL keeps the `:id` template and the renderer substitutes per-row.
- *
- * Auto-hides when `R.canEdit(user, record)` returns false. For row
- * context the per-row record threads in via `loadTableRecords`'s
- * per-row eval; for view-page context, `resolveSchema` provides the
- * resolved record on the eval context.
- */
-export function editAction(R: ResourceLike, basePath: string, recordId?: string): Action {
-  const id = recordId ?? ':id'
-  return Action.make('edit')
-    .label('Edit')
-    .href(`${resourceBase(basePath, R)}/${id}/edit`)
-    .visible(({ user, record }) => callPredicate(R.canEdit, user, record))
-}
-
-/** View-action factory — link to the resource's view page. See `editAction` for the `recordId` semantics.
- * Auto-hides when `R.canView(user, record)` returns false. */
-export function viewAction(R: ResourceLike, basePath: string, recordId?: string): Action {
-  const id = recordId ?? ':id'
-  return Action.make('view')
-    .label('View')
-    .href(`${resourceBase(basePath, R)}/${id}`)
-    .visible(({ user, record }) => callPredicate(R.canView, user, record))
-}
-
-/**
- * Delete-action factory — POSTs to the resource's delete route,
- * destructive style, with a confirmation prompt referencing the
- * resource label. Same `recordId` semantics as `editAction`.
- * Auto-hides when `R.canDelete(user, record)` returns false.
- *
- * Plan #13 — when `R.softDeletes = true`, additionally hides on
- * rows whose `deletedAtColumn` is set (already-trashed rows get the
- * Restore + ForceDelete pair instead, surfaced via the matching
- * factories below).
- */
-export function deleteAction(R: ResourceLike, basePath: string, recordId?: string): Action {
-  const id = recordId ?? ':id'
-  return Action.make('delete')
-    .label('Delete')
-    .destructive()
-    .method('post')
-    .action(`${resourceBase(basePath, R)}/${id}/delete`)
-    .confirm(`Delete this ${R.labelSingular.toLowerCase()}?`)
-    .visible(async ({ user, record }) => {
-      if (R.softDeletes && isTrashed(record, R)) return false
-      return callPredicate(R.canDelete, user, record)
-    })
-}
-
-/**
- * Replicate-action factory — handler-style. Loads the source record
- * from `ctx.record` (the `_action/:actionName` route already resolves
- * it through `R.query(ctx)` for row + single-target placements),
- * strips PK + soft-delete column + any `opts.excludeAttributes`,
- * optionally runs `opts.beforeReplicaSaved`, and creates a new row
- * via `R.model.create(...)`. Redirects to the new record's edit page
- * on success so the user can review + tweak before saving again.
- *
- * `recordId` kept in the signature for parity with `delete / edit /
- * view` so users can swap factories without rewriting call sites; the
- * dispatcher resolves the source record from the URL and hands it to
- * the handler as `ctx.record`, so we don't reference `recordId` here.
- *
- * Auto-hides when `R.canCreate(user)` returns false — replicating
- * writes a new row, so the gate is `canCreate`, not `canView`.
- */
-export function replicateAction(
-  R:        ResourceLike,
-  basePath: string,
-  recordId?: string,
-  opts:     ReplicateOptions = {},
-): Action {
-  void recordId
-  return Action.make('replicate')
-    .label('Replicate')
-    .handler(async (ctx) => {
-      const source = ctx.record
-      if (!source || typeof source !== 'object') {
-        return { notify: { title: 'Replicate failed: source record missing', type: 'error' } as never }
-      }
-      const M = R.model
-      if (!M || typeof M.create !== 'function') {
-        return { notify: { title: 'Replicate not configured (resource has no model.create)', type: 'error' } as never }
-      }
-
-      let replica: Record<string, unknown>
-      let pkCol: string
-      try {
-        ({ replica, pkCol } = await buildReplica(source, M, {
-          excludeAttributes: opts.excludeAttributes,
-          deletedAtColumn:   R.deletedAtColumn,
-          beforeReplicaSaved: opts.beforeReplicaSaved,
-        }))
-      } catch (err) {
-        return { notify: { title: `Replicate failed: ${err instanceof Error ? err.message : String(err)}`, type: 'error' } as never }
-      }
-
-      let created: unknown
-      try {
-        created = await M.create(replica)
-      } catch (err) {
-        return { notify: { title: `Replicate failed: ${err instanceof Error ? err.message : String(err)}`, type: 'error' } as never }
-      }
-
-      const newId = (created as Record<string, unknown> | null | undefined)?.[pkCol]
-      const defaultRedirect = newId !== undefined && newId !== null
-        ? `${resourceBase(basePath, R)}/${String(newId)}/edit`
-        : `${resourceBase(basePath, R)}`
-      // `!== undefined` rather than `??` so an override returning
-      // `null`/empty-string isn't silently swallowed (see
-      // feedback_nullish_swallows_explicit_null).
-      const overrideRedirect = opts.getRedirectUrl
-        ? await opts.getRedirectUrl({ replica: created, source })
-        : undefined
-      const redirect = overrideRedirect !== undefined ? overrideRedirect : defaultRedirect
-      const overrideTitle = opts.getCreatedNotificationTitle
-        ? await opts.getCreatedNotificationTitle({ replica: created, source })
-        : undefined
-      const title = overrideTitle !== undefined ? overrideTitle : `${R.labelSingular} replicated`
-      return {
-        redirect,
-        notify: { title, type: 'success' } as never,
-      }
-    })
-    .visible(({ user }) => callPredicate(R.canCreate, user))
-}
-
-/**
- * Plan #13 — Restore factory. POSTs to the resource's restore route,
- * success-styled, no confirm prompt (restoration is reversible).
- * Auto-hides on live (non-trashed) rows AND when `R.canRestore(user,
- * record)` returns false. Same `recordId` semantics as `editAction`.
- */
-export function restoreAction(R: ResourceLike, basePath: string, recordId?: string): Action {
-  const id = recordId ?? ':id'
-  return Action.make('restore')
-    .label('Restore')
-    .color('success')
-    .method('post')
-    .action(`${resourceBase(basePath, R)}/${id}/restore`)
-    .visible(async ({ user, record }) => {
-      if (!isTrashed(record, R)) return false
-      return callPredicate(R.canRestore, user, record)
-    })
-}
-
-/**
- * Plan #13 — Force-delete factory. POSTs to the resource's
- * force-delete route, destructive-styled, with a stricter confirm
- * prompt referencing permanence. Auto-hides on live (non-trashed)
- * rows AND when `R.canForceDelete(user, record)` returns false.
- */
-export function forceDeleteAction(R: ResourceLike, basePath: string, recordId?: string): Action {
-  const id = recordId ?? ':id'
-  return Action.make('forceDelete')
-    .label('Delete forever')
-    .destructive()
-    .method('post')
-    .action(`${resourceBase(basePath, R)}/${id}/force-delete`)
-    .confirm(`Permanently delete this ${R.labelSingular.toLowerCase()}? This cannot be undone.`)
-    .visible(async ({ user, record }) => {
-      if (!isTrashed(record, R)) return false
-      return callPredicate(R.canForceDelete, user, record)
-    })
-}
-
-/**
- * Mark-as-read factory — POSTs to the panel's notification read
- * endpoint for the given notification id. The endpoint
- * (`${base}/_notifications/:id/read`) is mounted by
- * `Pilotiq.databaseNotifications()`, so calling this without
- * opting into the bell surface produces an Action whose POST 404s.
- *
- * `notificationId` is baked at config time. For row context where
- * the id varies per row, omit it and the URL keeps the `:id`
- * template; the renderer substitutes per-row at render time
- * (parallel to `editAction`'s row form).
- *
- * No auto-visibility. Wrap in `.visible(({ record }) => !record.readAt)`
- * to hide on already-read rows.
- */
-export function markAsReadAction(basePath: string, notificationId?: string): Action {
-  const id = notificationId ?? ':id'
-  return Action.make('markAsRead')
-    .label('Mark as read')
-    .method('post')
-    .action(`${basePath}/_notifications/${id}/read`)
-}

package/src/actions/exportFactory.ts

@@ -1,225 +0,0 @@
-/**
- * Internals for the `Action.export` / `Action.bulkExport` factories.
- *
- * Lives in its own module to keep the cycle between `Action.ts` and
- * `Table.ts` honest — `Action.export` calls into here via dynamic
- * import inside the handler, so module-eval order never reads either
- * side's exports too early.
- *
- * The `R: { table?(t: any): any }` shape on `resolveExportColumns`
- * (and the matching parameter in `collectExportRows`) is the load-bearing
- * piece of this isolation: the real `Resource.table()` signature is
- * `(t: Table) => Table`, but importing `Table` here from a static-top
- * import would resurrect the cycle this file exists to break. Loosening
- * the parameter to `any` is the price — call sites in `Action.ts` are
- * typed against the proper `ResourceLike`, so the leak doesn't escape
- * this module. Don't widen `R`'s annotation; do narrow inside the body
- * if you need stricter local typing.
- */
-
-import { Table } from '../elements/Table.js'
-import { Column } from '../Column.js'
-import type { ActionContext } from './Action.js'
-import { encodeCsv, type CsvColumn } from '../io/csv.js'
-import { parseTableQuery, type QueryParams } from '../elements/dispatchTable.js'
-
-export type ExportFormat = 'csv' | 'json'
-
-export type ExportColumnSpec =
-  | string
-  | {
-      key:     string
-      label?:  string
-      format?: (value: unknown, record: Record<string, unknown>) => string
-    }
-
-export interface ExportOptions {
-  /** Columns to include. Strings → bare `key` (label = key). Objects
-   *  may add `label` and `format(value, record) => string`. When omitted,
-   *  defaults to every `Column` returned by `R.table()` in declaration
-   *  order, with header label = `Column.getLabel()`. */
-  columns?: ExportColumnSpec[]
-  /** Output filename. Function form receives the action context (so the
-   *  filename can include the user, current filters, etc). Default:
-   *  `${R.slug}-${YYYY-MM-DD}.${format}`. */
-  filename?: string | ((ctx: ActionContext) => string)
-  /** Output format. Default `'csv'`. */
-  format?: ExportFormat
-  /** Records scope:
-   *  - `'all'`      — ignore the current URL state (filters/search/sort)
-   *  - `'filtered'` — apply the current URL state (default; matches the
-   *                   list page the user is looking at)
-   *  - `'page'`     — only export the visible page
-   *
-   *  Bulk variant ignores `scope` and always uses `ctx.records`.
-   */
-  scope?: 'all' | 'filtered' | 'page'
-  /** Hard cap on the row count. Aborts with an error notification when
-   *  exceeded. Default `50_000`. */
-  maxRows?: number
-  /** Pagination chunk size when walking the records handler. Default
-   *  `1_000`. */
-  chunkSize?: number
-}
-
-interface ResolvedColumn {
-  key:    string
-  label:  string
-  format?: (value: unknown, record: Record<string, unknown>) => string
-}
-
-const DEFAULT_MAX_ROWS  = 50_000
-const DEFAULT_CHUNK     = 1_000
-
-/**
- * Resolve the column spec into a uniform `{ key, label, format? }[]`,
- * defaulting to every `Column` child on `R.table(Table.make())` when
- * the spec is omitted.
- */
-export function resolveExportColumns(
-  spec:    ExportOptions['columns'],
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  R:       { table?(t: any): any },
-): ResolvedColumn[] {
-  if (spec && spec.length > 0) {
-    return spec.map(s => typeof s === 'string'
-      ? { key: s, label: s }
-      : { key: s.key, label: s.label ?? s.key, ...(s.format ? { format: s.format } : {}) })
-  }
-  const tableInst = R.table?.(Table.make())
-  if (!tableInst) return []
-  const cols: Column[] = tableInst.getColumns?.() ?? []
-  return cols.map(c => ({ key: c.name, label: c.getLabel?.() ?? c.name }))
-}
-
-/**
- * Read the URL query record off `ctx.request`. Routes pass a Hono-like
- * request object whose `.query` is a `Record<string, string>`. Fall
- * back to `{}` when missing (programmatic dispatches in tests).
- */
-export function readRequestQuery(ctx: ActionContext): QueryParams {
-  const req = ctx.request as { query?: unknown } | undefined
-  const q = req?.query
-  if (q && typeof q === 'object') return q as QueryParams
-  return {}
-}
-
-/**
- * Drive the table's `records()` handler in pages until we run out of
- * rows or hit `maxRows`. Returns the collected raw records (not yet
- * mapped to row objects).
- *
- * Scope behavior:
- *  - `'all'`:      empty TableContext (no filters/search/sort applied)
- *  - `'filtered'`: TableContext built from the URL query (filters /
- *                  search / sort all flow through)
- *  - `'page'`:     same as `'filtered'` but only the visible page
- */
-export async function collectExportRows(
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  table:    any,
-  ctx:      ActionContext,
-  scope:    ExportOptions['scope'] = 'filtered',
-  maxRows:  number = DEFAULT_MAX_ROWS,
-  chunkSize: number = DEFAULT_CHUNK,
-): Promise<unknown[]> {
-  const handler = table.getRecords?.()
-  if (!handler) {
-    throw new Error('Resource table has no records() handler — cannot export. Set R.model or Table.records(fn).')
-  }
-
-  const baseCtx = scope === 'all' ? {} : buildTableCtxFromQuery(readRequestQuery(ctx), table)
-
-  const collected: unknown[] = []
-  let page = scope === 'page' ? (baseCtx.page ?? 1) : 1
-  const effectivePerPage = scope === 'page' ? (baseCtx.perPage ?? chunkSize) : chunkSize
-
-  while (collected.length <= maxRows) {
-    const result = await handler({ ...baseCtx, page, perPage: effectivePerPage })
-    const rows: unknown[] = Array.isArray(result) ? result : (result?.rows ?? [])
-    collected.push(...rows)
-    if (rows.length < effectivePerPage) break
-    if (scope === 'page') break
-    page++
-  }
-
-  return collected
-}
-
-/**
- * Build a `TableContext` from a URL-query record by reusing the same
- * parsing the list page does. Filters mirror onto the table's Filter
- * children so any `Filter.query()` overrides see them on subsequent
- * runs (defensive — `loadTableRecords` does the same).
- */
-function buildTableCtxFromQuery(
-  query: QueryParams,
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  table: any,
-): {
-  search?:  string
-  sort?:    { column: string; direction: 'asc' | 'desc' }
-  filters?: Record<string, string>
-  page?:    number
-  perPage?: number
-} {
-  const { search, sort, page, perPage } = parseTableQuery(query)
-
-  const tableFilters = table.getFilters?.() ?? []
-  const filterValues: Record<string, string> = {}
-  const reserved = new Set(['search', 'sort', 'page', 'perPage', 'group', 'groupKey'])
-  for (const f of tableFilters) {
-    const name = f.name as string
-    if (reserved.has(name)) continue
-    const v = (query as Record<string, unknown>)[name]
-    if (typeof v === 'string' && v !== '') filterValues[name] = v
-  }
-  for (const f of tableFilters) {
-    const v = filterValues[f.name as string]
-    if (v !== undefined && typeof f.withValue === 'function') f.withValue(v)
-  }
-
-  const out: ReturnType<typeof buildTableCtxFromQuery> = {}
-  if (search !== undefined) out.search = search
-  if (sort !== undefined)   out.sort   = sort
-  if (Object.keys(filterValues).length > 0) out.filters = filterValues
-  if (page !== undefined)    out.page    = page
-  if (perPage !== undefined) out.perPage = perPage
-  return out
-}
-
-/** Build a single CSV/JSON-shaped row by reading each resolved column's
- *  key off the record (with `format` applied when set). */
-export function buildExportRow(
-  record: unknown,
-  cols:   ReadonlyArray<ResolvedColumn>,
-): Record<string, unknown> {
-  const r = record as Record<string, unknown>
-  const out: Record<string, unknown> = {}
-  for (const col of cols) {
-    const raw = r[col.key]
-    out[col.key] = col.format ? col.format(raw, r) : raw
-  }
-  return out
-}
-
-/** Encode `rows` as the requested format. Object values that survive
- *  to here go through the CSV escape rules / `JSON.stringify`. */
-export function encodeExport(
-  rows:   ReadonlyArray<Record<string, unknown>>,
-  cols:   ReadonlyArray<ResolvedColumn>,
-  format: ExportFormat,
-): { body: string; contentType: string } {
-  if (format === 'json') {
-    return { body: JSON.stringify(rows, null, 2), contentType: 'application/json' }
-  }
-  const csvCols: CsvColumn[] = cols.map(c => ({ key: c.key, label: c.label }))
-  return { body: encodeCsv(rows, csvCols), contentType: 'text/csv; charset=utf-8' }
-}
-
-/** Default filename: `${slug}-${YYYY-MM-DD}.${ext}`. */
-export function defaultExportFilename(slug: string, format: ExportFormat): string {
-  const date = new Date().toISOString().slice(0, 10)
-  const ext  = format === 'json' ? 'json' : 'csv'
-  return `${slug}-${date}.${ext}`
-}

package/src/actions/factoryHelpers.ts

@@ -1,177 +0,0 @@
-/**
- * Shared helpers for the Action factory modules — `crudFactories.ts`,
- * `bulkFactories.ts`, `relationFactories.ts`, `m2mFactories.ts`.
- *
- * Lives in its own file so the per-phase factory modules stay focused
- * on their own factory bodies. Anything consumed by 2+ phase files
- * lands here; phase-local helpers stay alongside their phase's
- * factories.
- *
- * See `docs/plans/action-split.md` for the split plan.
- */
-
-import type { ResourceLike } from './Action.js'
-import type { RelationManagerContext } from '../RelationManager.js'
-
-/** Cluster-aware resource base path. Mirrors `clusterPaths.resourceBasePath`
- *  but uses the structural `ResourceLike` shape so `Action.ts` stays
- *  cycle-free against `Resource.ts`. */
-export function resourceBase(basePath: string, R: ResourceLike): string {
-  if (R.cluster) return `${basePath}/${R.cluster.getSlug()}/${R.getSlug()}`
-  return `${basePath}/${R.getSlug()}`
-}
-
-/** Call a (possibly undefined) Resource predicate. When unset, the
- * predicate is treated as "allowed" (returns true) so the factory
- * doesn't hide actions on Resources that haven't opted into Plan #10. */
-export function callPredicate(
-  fn: ((user: unknown, record?: unknown) => boolean | Promise<boolean>) | undefined,
-  user: unknown,
-  record?: unknown,
-): boolean | Promise<boolean> {
-  if (!fn) return true
-  return fn(user, record)
-}
-
-/** Read `record[R.deletedAtColumn ?? 'deletedAt']` and return true when
- *  the row is currently trashed (soft-deleted). Permissive on shape —
- *  bare `null` / `undefined` count as live; any other truthy value is
- *  trashed. */
-export function isTrashed(record: unknown, R: ResourceLike): boolean {
-  if (!record || typeof record !== 'object') return false
-  const col = R.deletedAtColumn ?? 'deletedAt'
-  const v = (record as Record<string, unknown>)[col]
-  return v !== null && v !== undefined
-}
-
-/** True when a `RelationManagerContext.mode` denotes a pivot-mutation
- *  shape — i.e. a many-to-many relation. All three modes share the
- *  `attach` / `detach` / `sync` accessor surface (the rudder ORM stamps
- *  + filters the polymorphic discriminator transparently for the morph
- *  variants). The `relationCreate / Edit / Delete` factories auto-hide
- *  under any of these modes because per-pivot-row create / edit / delete
- *  is meaningless — users create the related record via its own Resource,
- *  then attach via `relationAttach`. */
-export function isM2MMode(mode: RelationManagerContext['mode']): boolean {
-  return mode === 'belongsToMany' || mode === 'morphToMany' || mode === 'morphedByMany'
-}
-
-/**
- * Build the URL prefix for a relation factory action. Without
- * a `chain` (depth-1 manager), this is the familiar
- * `${base}/${parentSlug}/${parentId}/${relationship}`. With a chain
- * (depth-2 nested manager), it threads the outer record + relationship
- * between the parent slug and the leaf parent id:
- *
- *   `${base}/${parentSlug}/${chain[0].recordId}/${chain[0].relationship}/${parentId}/${relationship}`
- *
- * Pure; takes a `RelationManagerContext` and emits a string. The leaf
- * record id (and trailing `/edit`, `/delete`, etc.) gets appended by
- * the caller.
- */
-export function relationUrlPrefix(ctx: RelationManagerContext): string {
-  const head = `${ctx.basePath}/${ctx.parentSlug}`
-  const chain = ctx.chain ?? []
-  let mid = ''
-  for (const step of chain) {
-    mid += `/${step.recordId}/${step.relationship}`
-  }
-  return `${head}${mid}/${ctx.parentId}/${ctx.relationship}`
-}
-
-/** Options bag for `buildReplica`. Optional fields explicitly accept
- *  `undefined` so call sites can pass `opts.excludeAttributes` through
- *  unconditionally under `exactOptionalPropertyTypes: true`. */
-export interface BuildReplicaOptions {
-  /** Attribute keys to drop from the replicated payload IN ADDITION TO
-   *  the model's primary key and soft-delete column. */
-  excludeAttributes?: readonly string[] | undefined
-  /** Soft-delete column name on the source Resource. Defaults to
-   *  `'deletedAt'`. Read separately from the model because the column
-   *  lives on the Resource shape (`R.deletedAtColumn`) rather than on
-   *  the model itself. */
-  deletedAtColumn?: string | undefined
-  /** Force-pinned columns applied AFTER the strip and BEFORE the user
-   *  `beforeReplicaSaved` mutator. Used by the relation replicate
-   *  factories to re-stamp the parent attachment FK / morph columns
-   *  so a tampered source row can't slip a different parent in. */
-  pin?: Record<string, unknown> | undefined
-  /** Optional user mutator. Runs after the strip + pin. */
-  beforeReplicaSaved?: ((
-    replica: Record<string, unknown>,
-    source:  unknown,
-  ) => Record<string, unknown> | Promise<Record<string, unknown>>) | undefined
-}
-
-/**
- * Build a replica payload from a source record. Used by every replicate
- * factory (`replicateAction / bulkReplicateAction / relationReplicateAction
- * / relationBulkReplicateAction`).
- *
- * Strips the model's primary key (`model.primaryKey`, defaulting to
- * `'id'`), the soft-delete column (defaulting to `'deletedAt'`), and any
- * `excludeAttributes` keys. Applies `pin` columns (parent attachment
- * for relation factories), then runs the optional `beforeReplicaSaved`
- * user mutator. Returns the replica AND the resolved primary-key column
- * name (callers need it to read `created[pkCol]` for redirect URLs).
- *
- * Does NOT call `model.create` — callers wrap their own create + error
- * handling around the returned replica.
- */
-export async function buildReplica(
-  source: unknown,
-  model:  { primaryKey?: string },
-  opts:   BuildReplicaOptions = {},
-): Promise<{ replica: Record<string, unknown>; pkCol: string }> {
-  const pkCol      = model.primaryKey ?? 'id'
-  const trashedCol = opts.deletedAtColumn ?? 'deletedAt'
-  const skip       = new Set<string>([pkCol, trashedCol, ...(opts.excludeAttributes ?? [])])
-  let replica: Record<string, unknown> = {}
-  for (const [k, v] of Object.entries(source as Record<string, unknown>)) {
-    if (skip.has(k)) continue
-    replica[k] = v
-  }
-  if (opts.pin) Object.assign(replica, opts.pin)
-  if (opts.beforeReplicaSaved) {
-    replica = await opts.beforeReplicaSaved(replica, source)
-  }
-  return { replica, pkCol }
-}
-
-/**
- * Iterate `records`, run the policy probe in parallel up-front (only
- * allowed rows enter the serial work loop), call `op(id, record)` per
- * allowed row, swallow per-row throws (the aggregate notification shows
- * the count succeeded). Returns the success count.
- *
- * Used by every bulk handler (`bulkDeleteAction / bulkRestoreAction /
- * bulkForceDeleteAction / bulkReplicateAction / relationBulkReplicateAction
- * / relationBulkDetachAction`-style pattern).
- *
- * Rows whose `record.id` coerces to an empty string are skipped without
- * counting them as an attempt. The policy probe runs via `Promise.all`
- * so backend round-trips parallelize, but the write loop stays serial
- * (no transaction in v1 — concurrent writes would muddy failure
- * semantics).
- */
-export async function forEachAllowed(
-  records:   readonly unknown[],
-  isAllowed: (record: unknown, index: number) => boolean | Promise<boolean>,
-  op:        (id: string, record: unknown, index: number) => Promise<void>,
-): Promise<number> {
-  const allowedFlags = await Promise.all(
-    records.map((r, i) => isAllowed(r, i)),
-  )
-  let n = 0
-  for (let i = 0; i < records.length; i++) {
-    if (!allowedFlags[i]) continue
-    const record = records[i]
-    const id = String((record as { id?: unknown } | null | undefined)?.id ?? '')
-    if (!id) continue
-    try {
-      await op(id, record, i)
-      n++
-    } catch { /* skip — agg notify shows total */ }
-  }
-  return n
-}