@kernhq/module-quire 0.2.1 → 0.3.0

package/dist/server/services/versions.js

@@ -0,0 +1,182 @@
+import { KernError, uuidv7 } from '@kernhq/kernel';
+import { and, desc, eq, lt } from 'drizzle-orm';
+import { pages, pageVersions } from '../schema.js';
+import { documentNameOf } from './pages.js';
+/** How much of the prose a version list shows without loading the document. */
+const PREVIEW = 160;
+export function toVersion(row, publishedId) {
+    return {
+        id: row.id,
+        workspaceId: row.workspaceId,
+        pageId: row.pageId,
+        kind: row.kind,
+        label: row.label,
+        preview: row.text.slice(0, PREVIEW),
+        size: row.size,
+        authorId: row.authorId,
+        createdAt: row.createdAt.toISOString(),
+        published: publishedId === row.id,
+    };
+}
+export function quireVersions(kernel, access) {
+    /** The document's current state and a snapshot of it, from the collab service. */
+    async function snapshotOf(workspaceId, pageId) {
+        return kernel.call('collab.document.snapshot', {
+            name: documentNameOf({ workspaceId, id: pageId }),
+        });
+    }
+    return {
+        /**
+         * Write down what the page says now.
+         *
+         * Returns null when the document has never been written to — a page created and never opened
+         * has nothing to version, and an empty row in the history would be a lie about somebody having
+         * saved something.
+         */
+        async capture(tx, workspaceId, pageId, opts) {
+            const taken = await snapshotOf(workspaceId, pageId).catch((err) => {
+                kernel.log.warn({ err: String(err), pageId }, 'could not snapshot the document');
+                return null;
+            });
+            if (!taken)
+                return null;
+            const [row] = await tx
+                .select({ text: pages.text })
+                .from(pages)
+                .where(and(eq(pages.workspaceId, workspaceId), eq(pages.id, pageId)))
+                .limit(1);
+            const state = Buffer.from(taken.state, 'base64');
+            const [version] = await tx
+                .insert(pageVersions)
+                .values({
+                id: uuidv7(),
+                workspaceId,
+                pageId,
+                kind: opts.kind,
+                label: opts.label ?? null,
+                state,
+                snapshot: Buffer.from(taken.snapshot, 'base64'),
+                text: row?.text ?? '',
+                size: state.length,
+                authorId: opts.authorId ?? null,
+            })
+                .returning();
+            return version ?? null;
+        },
+        async list(tx, workspaceId, pageId, limit, cursor) {
+            const page = await access.pageRow(tx, workspaceId, pageId);
+            const rows = await tx
+                .select()
+                .from(pageVersions)
+                .where(and(eq(pageVersions.workspaceId, workspaceId), eq(pageVersions.pageId, pageId), cursor ? lt(pageVersions.id, cursor) : undefined))
+                .orderBy(desc(pageVersions.id))
+                .limit(limit + 1);
+            const items = rows.slice(0, limit).map((r) => toVersion(r, page.publishedVersionId));
+            return { items, nextCursor: rows.length > limit ? (items.at(-1)?.id ?? null) : null };
+        },
+        async row(tx, workspaceId, versionId) {
+            const [row] = await tx
+                .select()
+                .from(pageVersions)
+                .where(and(eq(pageVersions.workspaceId, workspaceId), eq(pageVersions.id, versionId)))
+                .limit(1);
+            if (!row)
+                throw KernError.notFound('Version');
+            return row;
+        },
+        /**
+         * Put an older version back.
+         *
+         * Two things make this safe to offer. The state it is about to replace is captured first, so
+         * restoring is never itself the thing that loses work; and the replacement goes through the
+         * collab service rather than the database, because `applyUpdate` would merge the two and bring
+         * every deleted paragraph back alongside the ones that replaced it.
+         */
+        async restore(tx, principal, workspaceId, versionId) {
+            const version = await this.row(tx, workspaceId, versionId);
+            await access.pageRow(tx, workspaceId, version.pageId);
+            await this.capture(tx, workspaceId, version.pageId, {
+                kind: 'auto',
+                label: null,
+                authorId: principal.userId,
+            });
+            await kernel.call('collab.document.replace', {
+                name: documentNameOf({ workspaceId, id: version.pageId }),
+                state: Buffer.from(version.state).toString('base64'),
+            });
+            const restored = await this.capture(tx, workspaceId, version.pageId, {
+                kind: 'restore',
+                label: version.label,
+                authorId: principal.userId,
+            });
+            if (!restored)
+                throw KernError.badRequest('The document could not be restored');
+            return restored;
+        },
+        /** What a reader is served, once somebody decides it is ready. */
+        async publish(tx, principal, workspaceId, pageId, label) {
+            const page = await access.pageRow(tx, workspaceId, pageId);
+            if (page.kind !== 'page')
+                throw KernError.badRequest('Only a page has a published version; a live doc is always live');
+            const version = await this.capture(tx, workspaceId, pageId, {
+                kind: 'publish',
+                label,
+                authorId: principal.userId,
+            });
+            if (!version)
+                throw KernError.badRequest('There is nothing written to publish');
+            const [updated] = await tx
+                .update(pages)
+                .set({
+                publishedVersionId: version.id,
+                hasUnpublishedChanges: false,
+                updatedBy: principal.userId,
+                updatedAt: new Date(),
+            })
+                .where(and(eq(pages.workspaceId, workspaceId), eq(pages.id, pageId)))
+                .returning();
+            return updated;
+        },
+        /** Throw the draft away and go back to what readers can already see. */
+        async revert(tx, principal, workspaceId, pageId) {
+            const page = await access.pageRow(tx, workspaceId, pageId);
+            if (!page.publishedVersionId)
+                throw KernError.badRequest('This page has never been published, so there is nothing to go back to');
+            const published = await this.row(tx, workspaceId, page.publishedVersionId);
+            // The draft being discarded is kept, because "revert" should not be a way to lose an
+            // afternoon's writing with no way back.
+            await this.capture(tx, workspaceId, pageId, {
+                kind: 'auto',
+                label: null,
+                authorId: principal.userId,
+            });
+            await kernel.call('collab.document.replace', {
+                name: documentNameOf({ workspaceId, id: pageId }),
+                state: Buffer.from(published.state).toString('base64'),
+            });
+            const [updated] = await tx
+                .update(pages)
+                .set({ hasUnpublishedChanges: false, updatedBy: principal.userId, updatedAt: new Date() })
+                .where(and(eq(pages.workspaceId, workspaceId), eq(pages.id, pageId)))
+                .returning();
+            return updated;
+        },
+        /** When the newest version was taken, so an automatic one is not taken every keystroke. */
+        async lastCapturedAt(tx, workspaceId, pageId) {
+            const [row] = await tx
+                .select({ createdAt: pageVersions.createdAt })
+                .from(pageVersions)
+                .where(and(eq(pageVersions.workspaceId, workspaceId), eq(pageVersions.pageId, pageId)))
+                .orderBy(desc(pageVersions.id))
+                .limit(1);
+            return row?.createdAt ?? null;
+        },
+        /** The current state, for anything that needs the document without opening a socket. */
+        documentState(workspaceId, pageId) {
+            return kernel.call('collab.document.state', {
+                name: documentNameOf({ workspaceId, id: pageId }),
+            });
+        },
+    };
+}
+//# sourceMappingURL=versions.js.map

package/dist/server/services/versions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"versions.js","sourceRoot":"","sources":["../../../src/server/services/versions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAwB,MAAM,EAAE,MAAM,gBAAgB,CAAA;AACxE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAE/C,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAElD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAI3C,+EAA+E;AAC/E,MAAM,OAAO,GAAG,GAAG,CAAA;AAEnB,MAAM,UAAU,SAAS,CAAC,GAAe,EAAE,WAA0B;IACnE,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,WAAW,EAAE,GAAG,CAAC,WAAyC;QAC1D,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,GAAG,CAAC,IAA2B;QACrC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC;QACnC,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,GAAG,CAAC,QAAmC;QACjD,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,SAAS,EAAE,WAAW,KAAK,GAAG,CAAC,EAAE;KAClC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,MAAmB;IAC/D,kFAAkF;IAClF,KAAK,UAAU,UAAU,CAAC,WAAmB,EAAE,MAAc;QAC3D,OAAO,MAAM,CAAC,IAAI,CAAsC,0BAA0B,EAAE;YAClF,IAAI,EAAE,cAAc,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;SAClD,CAAC,CAAA;IACJ,CAAC;IAED,OAAO;QACL;;;;;;WAMG;QACH,KAAK,CAAC,OAAO,CACX,EAAM,EACN,WAAmB,EACnB,MAAc,EACd,IAAoF;YAEpF,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAChE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAA;gBAChF,OAAO,IAAI,CAAA;YACb,CAAC,CAAC,CAAA;YACF,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAA;YAEvB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;iBAC5B,IAAI,CAAC,KAAK,CAAC;iBACX,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;iBACpE,KAAK,CAAC,CAAC,CAAC,CAAA;YAEX,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;YAChD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;iBACvB,MAAM,CAAC,YAAY,CAAC;iBACpB,MAAM,CAAC;gBACN,EAAE,EAAE,MAAM,EAAE;gBACZ,WAAW;gBACX,MAAM;gBACN,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;gBACzB,KAAK;gBACL,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC;gBAC/C,IAAI,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;gBACrB,IAAI,EAAE,KAAK,CAAC,MAAM;gBAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI;aAChC,CAAC;iBACD,SAAS,EAAE,CAAA;YACd,OAAO,OAAO,IAAI,IAAI,CAAA;QACxB,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAM,EAAE,WAAmB,EAAE,MAAc,EAAE,KAAa,EAAE,MAAqB;YAC1F,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;YAC1D,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,EAAE;iBACR,IAAI,CAAC,YAAY,CAAC;iBAClB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,WAAW,CAAC,EACzC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CACjD,CACF;iBACA,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;iBAC9B,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;YACnB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAA;YACpF,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACvF,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,EAAM,EAAE,WAAmB,EAAE,SAAiB;YACtD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,EAAE;iBACR,IAAI,CAAC,YAAY,CAAC;iBAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;iBACrF,KAAK,CAAC,CAAC,CAAC,CAAA;YACX,IAAI,CAAC,GAAG;gBAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YAC7C,OAAO,GAAG,CAAA;QACZ,CAAC;QAED;;;;;;;WAOG;QACH,KAAK,CAAC,OAAO,CAAC,EAAM,EAAE,SAAoB,EAAE,WAAmB,EAAE,SAAiB;YAChF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,CAAA;YAC1D,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;YAErD,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE;gBAClD,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,SAAS,CAAC,MAAM;aAC3B,CAAC,CAAA;YACF,MAAM,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;gBAC3C,IAAI,EAAE,cAAc,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;gBACzD,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;aACrD,CAAC,CAAA;YACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE;gBACnE,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,SAAS,CAAC,MAAM;aAC3B,CAAC,CAAA;YACF,IAAI,CAAC,QAAQ;gBAAE,MAAM,SAAS,CAAC,UAAU,CAAC,oCAAoC,CAAC,CAAA;YAC/E,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,kEAAkE;QAClE,KAAK,CAAC,OAAO,CAAC,EAAM,EAAE,SAAoB,EAAE,WAAmB,EAAE,MAAc,EAAE,KAAoB;YACnG,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;YAC1D,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;gBACtB,MAAM,SAAS,CAAC,UAAU,CAAC,gEAAgE,CAAC,CAAA;YAE9F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE;gBAC1D,IAAI,EAAE,SAAS;gBACf,KAAK;gBACL,QAAQ,EAAE,SAAS,CAAC,MAAM;aAC3B,CAAC,CAAA;YACF,IAAI,CAAC,OAAO;gBAAE,MAAM,SAAS,CAAC,UAAU,CAAC,qCAAqC,CAAC,CAAA;YAE/E,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;iBACvB,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC;gBACH,kBAAkB,EAAE,OAAO,CAAC,EAAE;gBAC9B,qBAAqB,EAAE,KAAK;gBAC5B,SAAS,EAAE,SAAS,CAAC,MAAM;gBAC3B,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC;iBACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;iBACpE,SAAS,EAAE,CAAA;YACd,OAAO,OAAQ,CAAA;QACjB,CAAC;QAED,wEAAwE;QACxE,KAAK,CAAC,MAAM,CAAC,EAAM,EAAE,SAAoB,EAAE,WAAmB,EAAE,MAAc;YAC5E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;YAC1D,IAAI,CAAC,IAAI,CAAC,kBAAkB;gBAC1B,MAAM,SAAS,CAAC,UAAU,CAAC,uEAAuE,CAAC,CAAA;YAErG,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAA;YAC1E,qFAAqF;YACrF,wCAAwC;YACxC,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE;gBAC1C,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,IAAI;gBACX,QAAQ,EAAE,SAAS,CAAC,MAAM;aAC3B,CAAC,CAAA;YACF,MAAM,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE;gBAC3C,IAAI,EAAE,cAAc,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;gBACjD,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;aACvD,CAAC,CAAA;YACF,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;iBACvB,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,qBAAqB,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;iBACzF,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;iBACpE,SAAS,EAAE,CAAA;YACd,OAAO,OAAQ,CAAA;QACjB,CAAC;QAED,2FAA2F;QAC3F,KAAK,CAAC,cAAc,CAAC,EAAM,EAAE,WAAmB,EAAE,MAAc;YAC9D,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC;iBAC7C,IAAI,CAAC,YAAY,CAAC;iBAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;iBACtF,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;iBAC9B,KAAK,CAAC,CAAC,CAAC,CAAA;YACX,OAAO,GAAG,EAAE,SAAS,IAAI,IAAI,CAAA;QAC/B,CAAC;QAED,wFAAwF;QACxF,aAAa,CAAC,WAAmB,EAAE,MAAc;YAC/C,OAAO,MAAM,CAAC,IAAI,CAAsB,uBAAuB,EAAE;gBAC/D,IAAI,EAAE,cAAc,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;aAClD,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC"}

package/migrations/0002_page_versions.sql

@@ -0,0 +1,25 @@
+CREATE TABLE IF NOT EXISTS "mod_quire"."page_versions" (
+	"id" uuid PRIMARY KEY DEFAULT uuidv7() NOT NULL,
+	"workspace_id" uuid NOT NULL,
+	"page_id" uuid NOT NULL,
+	"kind" text DEFAULT 'auto' NOT NULL,
+	"label" text,
+	"state" "bytea" NOT NULL,
+	"snapshot" "bytea",
+	"text" text DEFAULT '' NOT NULL,
+	"size" integer DEFAULT 0 NOT NULL,
+	"author_id" uuid,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "page_versions_ws_page_idx" ON "mod_quire"."page_versions" USING btree ("workspace_id","page_id","created_at");--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "page_versions_ws_created_idx" ON "mod_quire"."page_versions" USING btree ("workspace_id","created_at");--> statement-breakpoint
+
+-- Row-level security, the same triple every tenant table gets. `force` matters because the table
+-- owner would otherwise bypass the policy, and the owner is the role the service connects as.
+ALTER TABLE "mod_quire"."page_versions" ENABLE ROW LEVEL SECURITY;--> statement-breakpoint
+ALTER TABLE "mod_quire"."page_versions" FORCE ROW LEVEL SECURITY;--> statement-breakpoint
+DROP POLICY IF EXISTS "page_versions_ws_isolation" ON "mod_quire"."page_versions";--> statement-breakpoint
+CREATE POLICY "page_versions_ws_isolation" ON "mod_quire"."page_versions"
+  USING (workspace_id::text = current_setting('app.workspace_id', true))
+  WITH CHECK (workspace_id::text = current_setting('app.workspace_id', true));