@dudousxd/nestjs-catalog 0.5.0 → 0.7.0

package/dist/catalog.registry.js

@@ -27,6 +27,50 @@ const RELATION_KINDS = ['1:1', '1:m', 'm:1', 'm:n'];
 function isRelationKind(kind) {
     return RELATION_KINDS.includes(kind);
 }
+/**
+ * Which end of the link holds the key.
+ *
+ * Not simply `prop.owner`, and the difference matters. MikroORM sets that flag
+ * while resolving the *pair*, so it is dependable for `1:1` and `m:n` — where
+ * either side could plausibly own the key and only the mapping says which — and
+ * beside the point for the two kinds that have no choice: a `m:1` is the many
+ * end and therefore always holds the column, a `1:m` is the one end and
+ * therefore never does. Deriving those two from the kind rather than from a flag
+ * also means metadata assembled by hand (an `EntitySchema`, or a test) answers
+ * correctly without having to know the flag exists.
+ *
+ * `mappedBy` is checked first because it is unambiguous wherever it appears: the
+ * ORM only ever writes it on the inverse side.
+ */
+function isOwningSide(prop, kind) {
+    if (prop.mappedBy)
+        return false;
+    if (kind === '1:m')
+        return false;
+    if (kind === 'm:1')
+        return true;
+    return Boolean(prop.owner);
+}
+/**
+ * A key both ends of one link agree on, so the graph can draw it once.
+ *
+ * The owning end names the link — `Mvr.base` — and the inverse end, which knows
+ * the owner's property through `mappedBy`, arrives at the same string. That is
+ * the whole trick, and it is why `inverseName` is carried on the def at all.
+ *
+ * The fallback covers metadata that names neither end of the pair: both rows
+ * then reduce to the unordered pair plus the property name, which collapses the
+ * symmetric case (two `m:n` sides spelled alike) and leaves genuinely different
+ * names as two links. Guessing harder than that would mean pairing links by
+ * shape, and drawing one line where the schema has two is the worse error.
+ */
+function linkKey(holder, relation) {
+    if (relation.owner)
+        return `${holder}.${relation.name}`;
+    if (relation.inverseName)
+        return `${relation.targetType}.${relation.inverseName}`;
+    return `${[holder, relation.targetType].sort().join('::')}::${relation.name}`;
+}
 /** Classify one type name. Returns "unknown" when nothing matches. */
 function classify(raw) {
     const t = raw.toLowerCase();
@@ -156,7 +200,6 @@ let MikroOrmCatalogRegistry = MikroOrmCatalogRegistry_1 = class MikroOrmCatalogR
     }
     getGraph() {
         const snapshot = this.getSnapshot();
-        const known = new Set(snapshot.types.map((t) => t.name));
         const nodes = snapshot.types.map((t) => ({
             id: t.name,
             label: t.displayName,
@@ -165,29 +208,7 @@ let MikroOrmCatalogRegistry = MikroOrmCatalogRegistry_1 = class MikroOrmCatalogR
             propertyCount: t.properties.length,
             relationCount: t.relations.length,
         }));
-        // Both ends of a relation are declared, so every link shows up twice. Keep
-        // one edge per unordered pair per name so the graph does not double up.
-        const seen = new Set();
-        const edges = [];
-        for (const type of snapshot.types) {
-            for (const relation of type.relations) {
-                if (!known.has(relation.targetType))
-                    continue;
-                const pair = [type.name, relation.targetType].sort().join('::');
-                const key = `${pair}::${relation.name}`;
-                if (seen.has(key))
-                    continue;
-                seen.add(key);
-                edges.push({
-                    id: `${type.name}.${relation.name}`,
-                    source: type.name,
-                    target: relation.targetType,
-                    label: relation.displayName,
-                    kind: relation.kind,
-                });
-            }
-        }
-        return { nodes, edges };
+        return { nodes, edges: buildEdges(snapshot.types) };
     }
     /** Tier-0 edit on a type. Never touches the database. */
     async patchType(typeName, patch) {
@@ -245,13 +266,21 @@ let MikroOrmCatalogRegistry = MikroOrmCatalogRegistry_1 = class MikroOrmCatalogR
         // here yields an empty array and a catalog that silently contains nothing.
         const all = this.orm.getMetadata().getAll();
         const types = [];
+        // Two passes, because a relation cannot be described without knowing the
+        // whole catalog: whether its target is published is a fact about the
+        // catalog, not about the entity being read, and a single pass would answer
+        // it differently depending on discovery order.
         this.entityClasses.clear();
+        const included = [];
         for (const meta of all.values()) {
             if (!this.shouldInclude(meta))
                 continue;
             this.entityClasses.set(meta.className, meta.class);
-            types.push(this.buildType(meta));
+            included.push(meta);
         }
+        const published = new Set(included.map((meta) => meta.className));
+        for (const meta of included)
+            types.push(this.buildType(meta, published));
         types.sort((a, b) => a.group.localeCompare(b.group) || a.displayName.localeCompare(b.displayName));
         this.version += 1;
         this.snapshot = {
@@ -279,7 +308,7 @@ let MikroOrmCatalogRegistry = MikroOrmCatalogRegistry_1 = class MikroOrmCatalogR
             return false;
         return true;
     }
-    buildType(meta) {
+    buildType(meta, published) {
         const entityClass = meta.class;
         const declared = (0, catalog_decorators_1.readTypeOptions)(entityClass);
         const declaredProps = (0, catalog_decorators_1.readPropertyOptions)(entityClass);
@@ -298,16 +327,28 @@ let MikroOrmCatalogRegistry = MikroOrmCatalogRegistry_1 = class MikroOrmCatalogR
             const fromOverlay = overlayProps[prop.name];
             const { displayName, description, hidden, order } = resolveFieldPresentation(prop.name, index, fromDecorator, fromOverlay);
             if (isRelationKind(prop.kind)) {
+                const targetType = prop.targetMeta?.className ?? String(prop.type);
                 relations.push({
                     name: prop.name,
                     displayName,
                     description,
                     kind: prop.kind,
-                    targetType: prop.targetMeta?.className ?? String(prop.type),
+                    targetType,
                     localKey: prop.fieldNames?.[0],
                     nullable: Boolean(prop.nullable),
                     hidden,
                     order,
+                    owner: isOwningSide(prop, prop.kind),
+                    // Either name identifies the same thing — the property at the other
+                    // end — and only one of them is ever set, on the side the ORM decided
+                    // is inverse. Read as one field because callers pairing the two ends
+                    // do not care which of the two spellings carried it.
+                    inverseName: prop.mappedBy || prop.inversedBy || undefined,
+                    targetPublished: published.has(targetType),
+                    // A relation is enriched on the same terms as a scalar: somebody said
+                    // something about it. Structure is not enrichment — every relation
+                    // here was derived, so its existence proves nothing about curation.
+                    enriched: Boolean(fromDecorator || fromOverlay),
                 });
                 return;
             }
@@ -341,7 +382,12 @@ let MikroOrmCatalogRegistry = MikroOrmCatalogRegistry_1 = class MikroOrmCatalogR
             primaryKey: meta.primaryKeys ?? [],
             enriched: Object.keys(declared).length > 0 ||
                 Object.keys(overlay).length > 0 ||
-                properties.some((p) => p.enriched),
+                properties.some((p) => p.enriched) ||
+                // Relations count too. A type whose only human input is "this link is
+                // called Home base" has been worked on, and leaving it out of the tally
+                // put it back on the "nobody has named this" list the curator uses to
+                // decide what to do next.
+                relations.some((r) => r.enriched),
             properties,
             relations,
         };
@@ -354,6 +400,49 @@ exports.MikroOrmCatalogRegistry = MikroOrmCatalogRegistry = MikroOrmCatalogRegis
     __param(2, (0, common_1.Inject)(catalog_overlay_store_token_1.CATALOG_OVERLAY_STORE)),
     __metadata("design:paramtypes", [core_1.MikroORM, Object, Object])
 ], MikroOrmCatalogRegistry);
+/**
+ * The links, as lines to draw.
+ *
+ * Two rules, and both exist because the naive version of this drew a picture
+ * that was wrong in a way nobody would notice:
+ *
+ * 1. **One edge per link.** A link declared at both ends produces two rows, and
+ *    keying the de-duplication on the property name only caught the case where
+ *    both ends happened to be spelled alike — so `Mvr.base` plus `Base.mvrs`,
+ *    the ordinary shape, drew two lines between the same pair of nodes. See
+ *    {@link linkKey}.
+ * 2. **Drawn from the end that holds the key**, so the arrow points the way a
+ *    join is written. Both ends are collected before either is chosen, because
+ *    otherwise the direction depends on which type was discovered first.
+ *
+ * Hidden relations are deliberately still drawn. Hiding is a statement about a
+ * table cell; a graph that quietly dropped edges would be a picture nobody could
+ * read as complete, which is the only thing a graph is for.
+ */
+function buildEdges(types) {
+    const byLink = new Map();
+    for (const type of types) {
+        for (const relation of type.relations) {
+            if (!relation.targetPublished)
+                continue;
+            const key = linkKey(type.name, relation);
+            const seen = byLink.get(key);
+            // Replace only when this row is the owning one and the row already held
+            // is not: anything else keeps the first, so the edge order stays the type
+            // order rather than shuffling with every rebuild.
+            if (seen && (seen.relation.owner || !relation.owner))
+                continue;
+            byLink.set(key, { holder: type.name, relation });
+        }
+    }
+    return [...byLink.values()].map(({ holder, relation }) => ({
+        id: `${holder}.${relation.name}`,
+        source: holder,
+        target: relation.targetType,
+        label: relation.displayName,
+        kind: relation.kind,
+    }));
+}
 /**
  * How one field is presented, resolved across the tiers.
  *

package/dist/catalog.service.d.ts

@@ -3,7 +3,7 @@ import { type CatalogQueryRelation, type CatalogQueryResult } from './catalog.qu
 import { CatalogRegistry } from './catalog.registry.base';
 import { type CatalogReadStore, type SnapshotRef } from './catalog.store';
 import type { CatalogGraph, CatalogObjectPage, CatalogObjectQuery, CatalogObjectTypeDef, CatalogOverlay, CatalogSnapshot } from './catalog.types';
-import { type AuditQuery, type CatalogAuditEvent, type CatalogWorkspaceStore, type Dashboard, type DashboardCard, type EmbeddedChart, type EmbeddedDashboard, type SaveQueryInput, type SavedQuery } from './catalog.workspace';
+import { type AuditQuery, type CatalogAuditEvent, type CatalogWorkspaceStore, type Dashboard, type DashboardCard, type EmbeddedChart, type EmbeddedChartPlacement, type EmbeddedDashboard, type SaveQueryInput, type SavedQuery } from './catalog.workspace';
 /**
  * Reads objects of any catalogued type through one endpoint.
  *
@@ -32,6 +32,17 @@ export declare class CatalogService {
     resetOverlay(): Promise<void>;
     /** Columns a generic UI may render: visible, and not a blob. */
     visibleColumns(type: CatalogObjectTypeDef): import("./catalog.types").CatalogPropertyDef[];
+    /**
+     * Rows of one type, paged.
+     *
+     * **No principal, and so no access control.** This applies the guardrails that
+     * hold for every caller — the type exists, the page is bounded, the sort names
+     * a real column — and none that depend on who is asking: a classified column
+     * comes back to whoever the host's guard let through the door. That is the
+     * library's declare-and-enforce split, written out at length above `mayWrite`
+     * in `catalog.principal.ts`. A host that wants per-principal reads passes this
+     * page through `readableObjectPage`.
+     */
     readObjects(typeName: string, query: CatalogObjectQuery & {
         snapshot?: string;
     }): Promise<CatalogObjectPage>;
@@ -68,9 +79,22 @@ export declare class CatalogService {
     private requireWorkspace;
     listSavedQueries(): Promise<SavedQuery[]>;
     getSavedQuery(id: string): Promise<SavedQuery>;
+    /**
+     * @param createdBy who saved it — the row's author and the audit entry's
+     * actor. The host's resolved principal id where the host resolves one; see
+     * the enforcement note in `catalog.principal.ts` for why this library cannot
+     * work it out itself.
+     */
     saveQuery(input: SaveQueryInput, createdBy: string): Promise<SavedQuery>;
-    updateSavedQuery(id: string, input: Partial<SaveQueryInput>): Promise<SavedQuery>;
-    deleteSavedQuery(id: string): Promise<boolean>;
+    /** @param changedBy who made the change, for the audit trail. */
+    updateSavedQuery(id: string, input: Partial<SaveQueryInput>, changedBy: string): Promise<SavedQuery>;
+    /**
+     * @param deletedBy who deleted it, for the audit trail. Required rather than
+     * defaulted, matching `saveQuery` and `updateSavedQuery`: a default would
+     * quietly attribute revocations to nobody in every caller that was not
+     * updated, and the trail's whole value here is that it names somebody.
+     */
+    deleteSavedQuery(id: string, deletedBy: string): Promise<boolean>;
     /** Runs a saved query, honouring the TTL it was saved with. */
     runSavedQuery(id: string, maxRows?: number): Promise<{
         savedQuery: SavedQuery;
@@ -78,17 +102,31 @@ export declare class CatalogService {
     }>;
     listDashboards(): Promise<Dashboard[]>;
     getDashboard(id: string): Promise<Dashboard>;
+    /**
+     * `shared` is declared here, and that is not cosmetic.
+     *
+     * The store has always accepted it, so it worked as long as the body reached
+     * the store untouched. A host with a whitelisting `ValidationPipe` — the
+     * normal, recommended configuration — strips a property no type declares, and
+     * the symptom is a dashboard that cannot be shared with no error anywhere:
+     * the toggle saves, the response says `shared: false`, and the embed API
+     * keeps answering 403 for a board somebody just shared.
+     */
     saveDashboard(input: {
         name: string;
         description?: string;
         cards?: DashboardCard[];
+        shared?: boolean;
     }, createdBy: string): Promise<Dashboard>;
+    /** @param changedBy who made the change, for the audit trail. */
     updateDashboard(id: string, input: Partial<{
         name: string;
         description: string;
         cards: DashboardCard[];
-    }>): Promise<Dashboard>;
-    deleteDashboard(id: string): Promise<boolean>;
+        shared: boolean;
+    }>, changedBy: string): Promise<Dashboard>;
+    /** @param deletedBy who deleted it. See {@link deleteSavedQuery}. */
+    deleteDashboard(id: string, deletedBy: string): Promise<boolean>;
     /** Everything shared, so a consumer can discover what it may render. */
     listEmbeddable(): Promise<{
         dashboards: Array<{
@@ -104,11 +142,16 @@ export declare class CatalogService {
             kind: string;
         }>;
     }>;
-    /** One chart, rendered. */
-    embedChart(savedQueryId: string, layout?: {
-        width: number;
-        position: number;
-    }): Promise<EmbeddedChart>;
+    /**
+     * One chart, rendered.
+     *
+     * `placement` is what the dashboard card said, and it is honoured rather than
+     * merely carried: a card's `title` and `library` exist to override the saved
+     * query on THIS board, so an embed that ignored them would show a different
+     * heading and a different chart from the console for the same dashboard —
+     * silently, with nothing thrown and nothing logged.
+     */
+    embedChart(savedQueryId: string, placement?: EmbeddedChartPlacement): Promise<EmbeddedChart>;
     /** A whole dashboard, every chart resolved. */
     embedDashboard(dashboardId: string): Promise<EmbeddedDashboard>;
     listEvents(query: AuditQuery): Promise<CatalogAuditEvent[]>;

package/dist/catalog.service.js

@@ -14,6 +14,7 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CatalogService = void 0;
 const common_1 = require("@nestjs/common");
+const catalog_events_1 = require("./catalog.events");
 const catalog_options_1 = require("./catalog.options");
 const catalog_query_1 = require("./catalog.query");
 const catalog_query_cache_1 = require("./catalog.query-cache");
@@ -79,6 +80,17 @@ let CatalogService = class CatalogService {
     visibleColumns(type) {
         return type.properties.filter((p) => !p.hidden && p.type !== 'json');
     }
+    /**
+     * Rows of one type, paged.
+     *
+     * **No principal, and so no access control.** This applies the guardrails that
+     * hold for every caller — the type exists, the page is bounded, the sort names
+     * a real column — and none that depend on who is asking: a classified column
+     * comes back to whoever the host's guard let through the door. That is the
+     * library's declare-and-enforce split, written out at length above `mayWrite`
+     * in `catalog.principal.ts`. A host that wants per-principal reads passes this
+     * page through `readableObjectPage`.
+     */
     async readObjects(typeName, query) {
         const type = this.registry.getType(typeName);
         if (!type)
@@ -213,23 +225,120 @@ let CatalogService = class CatalogService {
             throw new common_1.NotFoundException(`No saved query ${id}`);
         return found;
     }
-    saveQuery(input, createdBy) {
+    // ---------------------------------------------------------------------------
+    // Sharing is audited, and the six methods below are where.
+    //
+    // `shared` on a saved query or a dashboard is the entire embed boundary: it is
+    // the one field that hands another company's frontend rows out of this
+    // catalog, and it is set by a person clicking a toggle. So it is emitted the
+    // way every other governance decision here is — `type.curated`,
+    // `transform.changed` — rather than being the one that is not.
+    //
+    // Two rules hold across all six, and both are load-bearing:
+    //
+    // *On the transition, never on the write.* A save that leaves the flag where
+    // it was is not a sharing decision. A trail that recorded one per keystroke
+    // would be a trail people learn to scroll past, which costs more than the
+    // entries are worth. Un-sharing is emitted too, under the same event name with
+    // `shared: false` — a trail that records only grants cannot answer "was this
+    // still shared last Tuesday".
+    //
+    // *Against what the store returned, never against what the caller asked for.*
+    // A store that ignores `shared` must not produce an entry claiming access was
+    // granted when nothing was.
+    //
+    // **Deleting is a transition.** For a while the first rule was applied only to
+    // the writes, so revoking access with the delete button — which is how it
+    // actually gets revoked — left nothing at all, and the only way to date the
+    // revocation was to notice that a thing had stopped appearing. Deleting
+    // something shared now emits `shared: false` with `deleted: true`, under the
+    // same event name, so the one filter anybody runs answers the whole question.
+    //
+    // Deleting something *un*shared emits nothing, and that is the first rule
+    // rather than an exception to it: an unshared query was not reachable from
+    // outside before and is not reachable after, so no access changed. Recording
+    // it would put entries carrying no grant and no revocation on the one channel
+    // whose entries all carry one. A host that wants every deletion in the trail
+    // wants a workspace-lifecycle event, which is a different event and not this
+    // one.
+    // ---------------------------------------------------------------------------
+    /**
+     * @param createdBy who saved it — the row's author and the audit entry's
+     * actor. The host's resolved principal id where the host resolves one; see
+     * the enforcement note in `catalog.principal.ts` for why this library cannot
+     * work it out itself.
+     */
+    async saveQuery(input, createdBy) {
         if (!input?.name?.trim()) {
             throw new common_1.BadRequestException('A saved query needs a name.');
         }
         (0, catalog_query_1.assertReadOnlyShape)(input.sql ?? '');
-        return this.requireWorkspace().saveQuery(input, createdBy);
+        const saved = await this.requireWorkspace().saveQuery(input, createdBy);
+        // Born shared is a grant with nothing to transition from: an outside
+        // application can fetch it the moment this returns. Born unshared is not an
+        // event at all.
+        if (saved.shared) {
+            (0, catalog_events_1.emitCatalog)('query.shared', {
+                savedQueryId: saved.id,
+                name: saved.name,
+                shared: true,
+                principalId: createdBy,
+            });
+        }
+        return saved;
     }
-    async updateSavedQuery(id, input) {
+    /** @param changedBy who made the change, for the audit trail. */
+    async updateSavedQuery(id, input, changedBy) {
         if (input.sql !== undefined)
             (0, catalog_query_1.assertReadOnlyShape)(input.sql);
+        // Read the old value only when the flag is in play. A transition needs both
+        // ends, and every other edit — a rename, a new chart type — should not pay
+        // for a round trip it does not need.
+        const before = input.shared === undefined ? undefined : await this.requireWorkspace().getSavedQuery(id);
         const updated = await this.requireWorkspace().updateSavedQuery(id, input);
         if (!updated)
             throw new common_1.NotFoundException(`No saved query ${id}`);
+        // `before` missing while the update succeeded means a store that disagrees
+        // with itself about whether this query exists. The transition is then
+        // unknowable, and an audit trail should over-record a grant rather than
+        // miss one, so it is emitted.
+        if (input.shared !== undefined && before?.shared !== updated.shared) {
+            (0, catalog_events_1.emitCatalog)('query.shared', {
+                savedQueryId: updated.id,
+                name: updated.name,
+                shared: updated.shared,
+                principalId: changedBy,
+            });
+        }
         return updated;
     }
-    deleteSavedQuery(id) {
-        return this.requireWorkspace().deleteSavedQuery(id);
+    /**
+     * @param deletedBy who deleted it, for the audit trail. Required rather than
+     * defaulted, matching `saveQuery` and `updateSavedQuery`: a default would
+     * quietly attribute revocations to nobody in every caller that was not
+     * updated, and the trail's whole value here is that it names somebody.
+     */
+    async deleteSavedQuery(id, deletedBy) {
+        // Read unconditionally, unlike `updateSavedQuery` which reads only when the
+        // flag is in play. A delete carries no statement of intent about `shared`,
+        // so there is nothing to branch on — whether this revokes access is a
+        // property of the row, and the row is about to stop existing.
+        const before = await this.requireWorkspace().getSavedQuery(id);
+        const deleted = await this.requireWorkspace().deleteSavedQuery(id);
+        // Only when the store says it went, and only when it was reachable from
+        // outside beforehand. A delete that removed nothing revoked nothing, and an
+        // unshared query's deletion is not an access event.
+        if (deleted && before?.shared) {
+            (0, catalog_events_1.emitCatalog)('query.shared', {
+                savedQueryId: before.id,
+                // The name as it last read. Nothing can look it up after this.
+                name: before.name,
+                shared: false,
+                principalId: deletedBy,
+                deleted: true,
+            });
+        }
+        return deleted;
     }
     /** Runs a saved query, honouring the TTL it was saved with. */
     async runSavedQuery(id, maxRows) {
@@ -250,20 +359,61 @@ let CatalogService = class CatalogService {
             throw new common_1.NotFoundException(`No dashboard ${id}`);
         return found;
     }
-    saveDashboard(input, createdBy) {
+    /**
+     * `shared` is declared here, and that is not cosmetic.
+     *
+     * The store has always accepted it, so it worked as long as the body reached
+     * the store untouched. A host with a whitelisting `ValidationPipe` — the
+     * normal, recommended configuration — strips a property no type declares, and
+     * the symptom is a dashboard that cannot be shared with no error anywhere:
+     * the toggle saves, the response says `shared: false`, and the embed API
+     * keeps answering 403 for a board somebody just shared.
+     */
+    async saveDashboard(input, createdBy) {
         if (!input?.name?.trim()) {
             throw new common_1.BadRequestException('A dashboard needs a name.');
         }
-        return this.requireWorkspace().saveDashboard(input, createdBy);
+        const saved = await this.requireWorkspace().saveDashboard(input, createdBy);
+        if (saved.shared) {
+            (0, catalog_events_1.emitCatalog)('dashboard.shared', {
+                dashboardId: saved.id,
+                name: saved.name,
+                shared: true,
+                principalId: createdBy,
+            });
+        }
+        return saved;
     }
-    async updateDashboard(id, input) {
+    /** @param changedBy who made the change, for the audit trail. */
+    async updateDashboard(id, input, changedBy) {
+        const before = input.shared === undefined ? undefined : await this.requireWorkspace().getDashboard(id);
         const updated = await this.requireWorkspace().updateDashboard(id, input);
         if (!updated)
             throw new common_1.NotFoundException(`No dashboard ${id}`);
+        if (input.shared !== undefined && before?.shared !== updated.shared) {
+            (0, catalog_events_1.emitCatalog)('dashboard.shared', {
+                dashboardId: updated.id,
+                name: updated.name,
+                shared: updated.shared,
+                principalId: changedBy,
+            });
+        }
         return updated;
     }
-    deleteDashboard(id) {
-        return this.requireWorkspace().deleteDashboard(id);
+    /** @param deletedBy who deleted it. See {@link deleteSavedQuery}. */
+    async deleteDashboard(id, deletedBy) {
+        const before = await this.requireWorkspace().getDashboard(id);
+        const deleted = await this.requireWorkspace().deleteDashboard(id);
+        if (deleted && before?.shared) {
+            (0, catalog_events_1.emitCatalog)('dashboard.shared', {
+                dashboardId: before.id,
+                name: before.name,
+                shared: false,
+                principalId: deletedBy,
+                deleted: true,
+            });
+        }
+        return deleted;
     }
     // ---------------------------------------------------------------------------
     // Embed: what another application's frontend gets.
@@ -298,8 +448,16 @@ let CatalogService = class CatalogService {
             })),
         };
     }
-    /** One chart, rendered. */
-    async embedChart(savedQueryId, layout) {
+    /**
+     * One chart, rendered.
+     *
+     * `placement` is what the dashboard card said, and it is honoured rather than
+     * merely carried: a card's `title` and `library` exist to override the saved
+     * query on THIS board, so an embed that ignored them would show a different
+     * heading and a different chart from the console for the same dashboard —
+     * silently, with nothing thrown and nothing logged.
+     */
+    async embedChart(savedQueryId, placement) {
         const saved = await this.getSavedQuery(savedQueryId);
         if (!saved.shared) {
             throw new common_1.ForbiddenException(`"${saved.name}" has not been shared. Mark it shared in the console to make it embeddable.`);
@@ -308,12 +466,15 @@ let CatalogService = class CatalogService {
             sql: saved.sql,
             cacheTtlSeconds: saved.cacheTtlSeconds,
         });
+        // A card whose title was cleared falls back to the query's name rather than
+        // embedding a blank heading — an empty override is the absence of one.
+        const overridden = placement?.title?.trim();
         return {
             id: saved.id,
-            title: saved.name,
+            title: overridden ? overridden : saved.name,
             description: saved.description,
-            visualization: saved.visualization,
-            layout,
+            visualization: (0, catalog_workspace_1.embeddedVisualization)(saved.visualization, placement?.library),
+            layout: placement ? { width: placement.width, position: placement.position } : undefined,
             columns: result.columns,
             rows: result.rows,
             rowCount: result.rowCount,
@@ -336,6 +497,10 @@ let CatalogService = class CatalogService {
                 charts.push(await this.embedChart(card.savedQueryId, {
                     width: card.width,
                     position: card.position,
+                    // Everything the card says about this chart, not only where it
+                    // sits. See `EmbeddedChartPlacement`.
+                    ...(card.title !== undefined ? { title: card.title } : {}),
+                    ...(card.library !== undefined ? { library: card.library } : {}),
                 }));
             }
             catch {