@orthacms/activity-server 0.4.3 → 0.5.0

package/dist/lib/activity/activity-filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"activity-filter.d.ts","sourceRoot":"","sources":["../../../src/lib/activity/activity-filter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE5E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,EAAE,YASpC,CAAC"}
+{"version":3,"file":"activity-filter.d.ts","sourceRoot":"","sources":["../../../src/lib/activity/activity-filter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE5E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,sBAAsB,EAAE,YAWpC,CAAC"}

package/dist/lib/activity/activity-filter.js

@@ -19,7 +19,9 @@ exports.ACTIVITY_FILTER_SCHEMA = {
         subjectType: { type: utils_server_1.ScalarFieldType.String },
         subjectId: { type: utils_server_1.ScalarFieldType.String },
         actorId: { type: utils_server_1.ScalarFieldType.Uuid },
+        actorType: { type: utils_server_1.ScalarFieldType.String },
         actorEmail: { type: utils_server_1.ScalarFieldType.String },
+        workspaceId: { type: utils_server_1.ScalarFieldType.Uuid },
         at: { type: utils_server_1.ScalarFieldType.Date }
     }
 };

package/dist/lib/activity/activity.constants.d.ts

@@ -3,10 +3,15 @@ export declare const DEFAULT_PAGE_SIZE = 25;
 /** Upper bound on the requested page size (the largest option the UI offers). */
 export declare const MAX_PAGE_SIZE = 100;
 /**
- * Max length of the raw `?filter=` JSON string. A coarse first guard against
- * oversized payloads, ahead of the filter engine's node/depth caps.
+ * Max length of the raw `?filter=` JSON string — a coarse first guard against
+ * oversized payloads, ahead of the filter engine's own budgets.
+ *
+ * Re-exported rather than declared: the number belongs to the engine that
+ * enforces the rest of the filter's limits, and four packages each declaring
+ * their own copy is how one of them (`alarms`) came to say 8192 while the other
+ * three said 4096. See `filters/budgets.ts` in `@orthacms/utils-server`.
  */
-export declare const FILTER_MAX_LENGTH = 4096;
+export { FILTER_MAX_LENGTH } from '@orthacms/utils-server';
 /** Columns the read API permits sorting by (whitelist — keys are the wire values). */
 export declare const SORTABLE_FIELDS: readonly ["at", "kind"];
 /** A field the read API may sort by. */

package/dist/lib/activity/activity.constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"activity.constants.d.ts","sourceRoot":"","sources":["../../../src/lib/activity/activity.constants.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC,iFAAiF;AACjF,eAAO,MAAM,aAAa,MAAM,CAAC;AAEjC;;;GAGG;AACH,eAAO,MAAM,iBAAiB,OAAO,CAAC;AAEtC,sFAAsF;AACtF,eAAO,MAAM,eAAe,yBAA0B,CAAC;AAEvD,wCAAwC;AACxC,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D,4CAA4C;AAC5C,eAAO,MAAM,WAAW,0BAA2B,CAAC;AAEpD,iDAAiD;AACjD,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC"}
+{"version":3,"file":"activity.constants.d.ts","sourceRoot":"","sources":["../../../src/lib/activity/activity.constants.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC,iFAAiF;AACjF,eAAO,MAAM,aAAa,MAAM,CAAC;AAEjC;;;;;;;;GAQG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,sFAAsF;AACtF,eAAO,MAAM,eAAe,yBAA0B,CAAC;AAEvD,wCAAwC;AACxC,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7D,4CAA4C;AAC5C,eAAO,MAAM,WAAW,0BAA2B,CAAC;AAEpD,iDAAiD;AACjD,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC"}

package/dist/lib/activity/activity.constants.js

@@ -6,10 +6,16 @@ exports.DEFAULT_PAGE_SIZE = 25;
 /** Upper bound on the requested page size (the largest option the UI offers). */
 exports.MAX_PAGE_SIZE = 100;
 /**
- * Max length of the raw `?filter=` JSON string. A coarse first guard against
- * oversized payloads, ahead of the filter engine's node/depth caps.
+ * Max length of the raw `?filter=` JSON string — a coarse first guard against
+ * oversized payloads, ahead of the filter engine's own budgets.
+ *
+ * Re-exported rather than declared: the number belongs to the engine that
+ * enforces the rest of the filter's limits, and four packages each declaring
+ * their own copy is how one of them (`alarms`) came to say 8192 while the other
+ * three said 4096. See `filters/budgets.ts` in `@orthacms/utils-server`.
  */
-exports.FILTER_MAX_LENGTH = 4096;
+var utils_server_1 = require("@orthacms/utils-server");
+Object.defineProperty(exports, "FILTER_MAX_LENGTH", { enumerable: true, get: function () { return utils_server_1.FILTER_MAX_LENGTH; } });
 /** Columns the read API permits sorting by (whitelist — keys are the wire values). */
 exports.SORTABLE_FIELDS = ['at', 'kind'];
 /** Sort directions the read API accepts. */

package/dist/lib/activity/controllers/dead-letters.controller.d.ts

@@ -0,0 +1,36 @@
+import { OutboxDispatcher, type DeadLetter } from '@orthacms/database';
+import { DeadLettersQueryDto } from '../dto/dead-letters-query.dto';
+/** The parked events, as `GET /api/activity/dead-letters` returns them. */
+export interface DeadLetterListView {
+    /** How many events have given up in total, ignoring `limit`. */
+    total: number;
+    /** The most recent of them. */
+    items: DeadLetter[];
+}
+/**
+ * `GET /api/activity/dead-letters` — the events that should have been recorded
+ * and could not be.
+ *
+ * **This is the gap-in-the-trail route, and it belongs here rather than
+ * anywhere else.** A parked outbox row is an event no subscriber accepted after
+ * {@link MAX_DELIVERY_ATTEMPTS} tries, and the subscriber it was most often
+ * bound for is this plugin's: an audit row. The dispatcher already logs the
+ * moment one parks — but a log line is loud only to somebody tailing logs right
+ * then, and afterwards "is anything stuck, and why" had no answer short of a
+ * `psql` session. A hole in an audit trail that is only visible to a person who
+ * thinks to go looking is barely a hole that has been noticed.
+ *
+ * Gated on `activity:read`, the same key as the log itself: the question "what
+ * is missing from the trail" is the same question as "what is in it", and the
+ * answer names event kinds and aggregate ids.
+ *
+ * It reports rather than repairs. Replaying a parked row means clearing its
+ * `attempts` — a deliberate operator action against a fixed cause, not a button
+ * that re-runs whatever failed fifteen times.
+ */
+export declare class DeadLettersController {
+    private readonly dispatcher;
+    constructor(dispatcher: OutboxDispatcher);
+    list(query: DeadLettersQueryDto): Promise<DeadLetterListView>;
+}
+//# sourceMappingURL=dead-letters.controller.d.ts.map

package/dist/lib/activity/controllers/dead-letters.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dead-letters.controller.d.ts","sourceRoot":"","sources":["../../../../src/lib/activity/controllers/dead-letters.controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAMvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEpE,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IAC/B,gEAAgE;IAChE,KAAK,EAAE,MAAM,CAAC;IACd,+BAA+B;IAC/B,KAAK,EAAE,UAAU,EAAE,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAIa,qBAAqB;IAClB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,gBAAgB;IAQnD,IAAI,CACG,KAAK,EAAE,mBAAmB,GACpC,OAAO,CAAC,kBAAkB,CAAC;CAMjC"}

package/dist/lib/activity/controllers/dead-letters.controller.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeadLettersController = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const database_1 = require("@orthacms/database");
+const identity_server_1 = require("@orthacms/identity-server");
+const dead_letters_query_dto_1 = require("../dto/dead-letters-query.dto");
+/**
+ * `GET /api/activity/dead-letters` — the events that should have been recorded
+ * and could not be.
+ *
+ * **This is the gap-in-the-trail route, and it belongs here rather than
+ * anywhere else.** A parked outbox row is an event no subscriber accepted after
+ * {@link MAX_DELIVERY_ATTEMPTS} tries, and the subscriber it was most often
+ * bound for is this plugin's: an audit row. The dispatcher already logs the
+ * moment one parks — but a log line is loud only to somebody tailing logs right
+ * then, and afterwards "is anything stuck, and why" had no answer short of a
+ * `psql` session. A hole in an audit trail that is only visible to a person who
+ * thinks to go looking is barely a hole that has been noticed.
+ *
+ * Gated on `activity:read`, the same key as the log itself: the question "what
+ * is missing from the trail" is the same question as "what is in it", and the
+ * answer names event kinds and aggregate ids.
+ *
+ * It reports rather than repairs. Replaying a parked row means clearing its
+ * `attempts` — a deliberate operator action against a fixed cause, not a button
+ * that re-runs whatever failed fifteen times.
+ */
+let DeadLettersController = class DeadLettersController {
+    dispatcher;
+    constructor(dispatcher) {
+        this.dispatcher = dispatcher;
+    }
+    async list(query) {
+        return this.dispatcher.deadLetters({
+            limit: query.limit,
+            newerThan: query.since ? new Date(query.since) : undefined
+        });
+    }
+};
+exports.DeadLettersController = DeadLettersController;
+tslib_1.__decorate([
+    (0, common_1.Get)('dead-letters'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Events that could not be recorded',
+        description: 'Outbox events that exhausted their delivery attempts and are no longer retried. Most often an audit row that was never written, so a non-zero `total` means the activity log is incomplete. Reports only — replaying one is an operator action against a fixed cause.'
+    }),
+    tslib_1.__param(0, (0, common_1.Query)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [dead_letters_query_dto_1.DeadLettersQueryDto]),
+    tslib_1.__metadata("design:returntype", Promise)
+], DeadLettersController.prototype, "list", null);
+exports.DeadLettersController = DeadLettersController = tslib_1.__decorate([
+    (0, swagger_1.ApiTags)('Activity'),
+    (0, common_1.UseGuards)(identity_server_1.PermissionsGuard),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.ACTIVITY_READ),
+    (0, common_1.Controller)('activity'),
+    tslib_1.__metadata("design:paramtypes", [database_1.OutboxDispatcher])
+], DeadLettersController);

package/dist/lib/activity/controllers/entry-activity.controller.d.ts

@@ -0,0 +1,32 @@
+import { ActivityService } from '../services/activity.service';
+import { EntryActivityQueryDto } from '../dto/entry-activity-query.dto';
+import type { ActivityListView } from '../types/activity-view';
+/**
+ * `GET /api/activity/entries/:entryId` — one entry's own audit trail.
+ *
+ * **Why this exists next to `GET /activity` rather than as a filter on it.**
+ * The full log is gated on `activity:read`, which is admin-only in the v1 role
+ * matrix and correctly so: it carries invites, role changes and sign-in
+ * failures across the whole deployment. The consequence was that an editor
+ * could not see the history of their **own** content — the entry editor's
+ * History tab shows version snapshots, which record what the words were and
+ * say nothing about who published it, who took it down, or who changed who may
+ * read it. Those are different facts and they live here.
+ *
+ * So this route asks a different question with a different key. `content:read`
+ * is the permission that already decides whether you may look at an entry at
+ * all, and everything returned is about an entry you may look at.
+ *
+ * **It is scoped by workspace, and fails closed.** `WorkspaceGuard` proves
+ * membership, and the query requires the row's `workspace_id` to match — so an
+ * entry id from another workspace reads as an empty history rather than as
+ * somebody else's. Rows written before `workspace_id` existed carry `null` and
+ * are therefore excluded: losing old history on this narrow route is the right
+ * side to err on, and the full log still has them.
+ */
+export declare class EntryActivityController {
+    private readonly activity;
+    constructor(activity: ActivityService);
+    list(entryId: string, workspaceId: string, query: EntryActivityQueryDto): Promise<ActivityListView>;
+}
+//# sourceMappingURL=entry-activity.controller.d.ts.map

package/dist/lib/activity/controllers/entry-activity.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-activity.controller.d.ts","sourceRoot":"","sources":["../../../../src/lib/activity/controllers/entry-activity.controller.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAGa,uBAAuB;IACpB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,eAAe;IAStD,IAAI,CACiC,OAAO,EAAE,MAAM,EAC5B,WAAW,EAAE,MAAM,EAC9B,KAAK,EAAE,qBAAqB,GACtC,OAAO,CAAC,gBAAgB,CAAC;CAS/B"}

package/dist/lib/activity/controllers/entry-activity.controller.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EntryActivityController = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const identity_server_1 = require("@orthacms/identity-server");
+const workspaces_server_1 = require("@orthacms/workspaces-server");
+const activity_service_1 = require("../services/activity.service");
+const entry_activity_query_dto_1 = require("../dto/entry-activity-query.dto");
+/**
+ * `GET /api/activity/entries/:entryId` — one entry's own audit trail.
+ *
+ * **Why this exists next to `GET /activity` rather than as a filter on it.**
+ * The full log is gated on `activity:read`, which is admin-only in the v1 role
+ * matrix and correctly so: it carries invites, role changes and sign-in
+ * failures across the whole deployment. The consequence was that an editor
+ * could not see the history of their **own** content — the entry editor's
+ * History tab shows version snapshots, which record what the words were and
+ * say nothing about who published it, who took it down, or who changed who may
+ * read it. Those are different facts and they live here.
+ *
+ * So this route asks a different question with a different key. `content:read`
+ * is the permission that already decides whether you may look at an entry at
+ * all, and everything returned is about an entry you may look at.
+ *
+ * **It is scoped by workspace, and fails closed.** `WorkspaceGuard` proves
+ * membership, and the query requires the row's `workspace_id` to match — so an
+ * entry id from another workspace reads as an empty history rather than as
+ * somebody else's. Rows written before `workspace_id` existed carry `null` and
+ * are therefore excluded: losing old history on this narrow route is the right
+ * side to err on, and the full log still has them.
+ */
+let EntryActivityController = class EntryActivityController {
+    activity;
+    constructor(activity) {
+        this.activity = activity;
+    }
+    list(entryId, workspaceId, query) {
+        return this.activity.list({
+            subjectType: 'content_entry',
+            subjectId: entryId,
+            workspaceId,
+            page: query.page,
+            pageSize: query.pageSize
+        });
+    }
+};
+exports.EntryActivityController = EntryActivityController;
+tslib_1.__decorate([
+    (0, common_1.Get)(':entryId'),
+    (0, identity_server_1.RequirePermissions)(identity_server_1.PERMISSIONS.CONTENT_READ),
+    (0, swagger_1.ApiOperation)({
+        summary: 'One entry’s audit trail',
+        description: 'Every recorded action on this entry — created, edited, published, deleted, restored, and who may read it — newest first. Scoped to the open workspace; an id from another one reads as an empty history. Gated on `content:read` rather than `activity:read`, so an editor can see the history of content they can already open.'
+    }),
+    tslib_1.__param(0, (0, common_1.Param)('entryId', common_1.ParseUUIDPipe)),
+    tslib_1.__param(1, (0, workspaces_server_1.CurrentWorkspace)()),
+    tslib_1.__param(2, (0, common_1.Query)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String, entry_activity_query_dto_1.EntryActivityQueryDto]),
+    tslib_1.__metadata("design:returntype", Promise)
+], EntryActivityController.prototype, "list", null);
+exports.EntryActivityController = EntryActivityController = tslib_1.__decorate([
+    (0, swagger_1.ApiTags)('Activity'),
+    (0, common_1.UseGuards)(identity_server_1.PermissionsGuard, workspaces_server_1.WorkspaceGuard),
+    (0, common_1.Controller)('activity/entries'),
+    tslib_1.__metadata("design:paramtypes", [activity_service_1.ActivityService])
+], EntryActivityController);

package/dist/lib/activity/dto/dead-letters-query.dto.d.ts

@@ -0,0 +1,14 @@
+/** Query parameters for `GET /api/activity/dead-letters`. */
+export declare class DeadLettersQueryDto {
+    /**
+     * How many parked events to return, newest first.
+     *
+     * Capped rather than paginated: `total` already answers "how bad is it",
+     * and a dead-letter list long enough to page through is a different
+     * problem from the one this route exists to surface.
+     */
+    limit?: number;
+    /** Only events that occurred at or after this time (ISO 8601). */
+    since?: string;
+}
+//# sourceMappingURL=dead-letters-query.dto.d.ts.map

package/dist/lib/activity/dto/dead-letters-query.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dead-letters-query.dto.d.ts","sourceRoot":"","sources":["../../../../src/lib/activity/dto/dead-letters-query.dto.ts"],"names":[],"mappings":"AAIA,6DAA6D;AAC7D,qBAAa,mBAAmB;IAC5B;;;;;;OAMG;IAaH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,kEAAkE;IASlE,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB"}

package/dist/lib/activity/dto/dead-letters-query.dto.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeadLettersQueryDto = void 0;
+const tslib_1 = require("tslib");
+const swagger_1 = require("@nestjs/swagger");
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/** Query parameters for `GET /api/activity/dead-letters`. */
+class DeadLettersQueryDto {
+    /**
+     * How many parked events to return, newest first.
+     *
+     * Capped rather than paginated: `total` already answers "how bad is it",
+     * and a dead-letter list long enough to page through is a different
+     * problem from the one this route exists to surface.
+     */
+    limit;
+    /** Only events that occurred at or after this time (ISO 8601). */
+    since;
+}
+exports.DeadLettersQueryDto = DeadLettersQueryDto;
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: 'integer',
+        minimum: 1,
+        maximum: 200,
+        default: 50,
+        description: 'How many parked events to return, newest first.'
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_transformer_1.Type)(() => Number),
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.Min)(1),
+    (0, class_validator_1.Max)(200),
+    tslib_1.__metadata("design:type", Number)
+], DeadLettersQueryDto.prototype, "limit", void 0);
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: String,
+        format: 'date-time',
+        description: 'Only events that occurred at or after this time — for a caller that has already acknowledged older failures.'
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsISO8601)(),
+    tslib_1.__metadata("design:type", String)
+], DeadLettersQueryDto.prototype, "since", void 0);

package/dist/lib/activity/dto/entry-activity-query.dto.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Query parameters for `GET /api/activity/entries/:entryId`.
+ *
+ * Paging only. The subject is the URL, the workspace is the header, and every
+ * other filter the full log offers — actor, kind, date range — would be a way
+ * of asking a narrower question about a history short enough to read.
+ */
+export declare class EntryActivityQueryDto {
+    /** 1-based page number. */
+    page?: number;
+    /** Rows per page, capped at {@link MAX_PAGE_SIZE}. */
+    pageSize?: number;
+}
+//# sourceMappingURL=entry-activity-query.dto.d.ts.map

package/dist/lib/activity/dto/entry-activity-query.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-activity-query.dto.d.ts","sourceRoot":"","sources":["../../../../src/lib/activity/dto/entry-activity-query.dto.ts"],"names":[],"mappings":"AAKA;;;;;;GAMG;AACH,qBAAa,qBAAqB;IAC9B,2BAA2B;IAW3B,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,sDAAsD;IAatD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB"}

package/dist/lib/activity/dto/entry-activity-query.dto.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EntryActivityQueryDto = void 0;
+const tslib_1 = require("tslib");
+const swagger_1 = require("@nestjs/swagger");
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const activity_constants_1 = require("../activity.constants");
+/**
+ * Query parameters for `GET /api/activity/entries/:entryId`.
+ *
+ * Paging only. The subject is the URL, the workspace is the header, and every
+ * other filter the full log offers — actor, kind, date range — would be a way
+ * of asking a narrower question about a history short enough to read.
+ */
+class EntryActivityQueryDto {
+    /** 1-based page number. */
+    page;
+    /** Rows per page, capped at {@link MAX_PAGE_SIZE}. */
+    pageSize;
+}
+exports.EntryActivityQueryDto = EntryActivityQueryDto;
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: 'integer',
+        minimum: 1,
+        default: 1,
+        description: '1-based page number.'
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_transformer_1.Type)(() => Number),
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.Min)(1),
+    tslib_1.__metadata("design:type", Number)
+], EntryActivityQueryDto.prototype, "page", void 0);
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: 'integer',
+        minimum: 1,
+        maximum: activity_constants_1.MAX_PAGE_SIZE,
+        default: activity_constants_1.DEFAULT_PAGE_SIZE,
+        description: `Rows per page, capped at ${activity_constants_1.MAX_PAGE_SIZE}.`
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_transformer_1.Type)(() => Number),
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.Min)(1),
+    (0, class_validator_1.Max)(activity_constants_1.MAX_PAGE_SIZE),
+    tslib_1.__metadata("design:type", Number)
+], EntryActivityQueryDto.prototype, "pageSize", void 0);

package/dist/lib/activity/dto/list-activity-query.dto.d.ts

@@ -13,6 +13,22 @@ export declare class ListActivityQueryDto {
     subjectId?: string;
     /** Restrict to one actor. */
     actorId?: string;
+    /**
+     * Restrict to actions performed by one kind of principal — `user` or
+     * `api_token`. Free text rather than an enum for the same reason `kind` is:
+     * the values are owned by `@orthacms/database`'s `EVENT_ACTOR_TYPE`, and a
+     * copy here would be a second catalogue to keep in step.
+     */
+    actorType?: string;
+    /**
+     * Restrict to one workspace's history.
+     *
+     * Narrows, never widens: the log is deployment-wide and `activity:read`
+     * is what bounds it, so this is a question a reader may ask rather than a
+     * boundary imposed on them. Rows belonging to no workspace (invites, role
+     * changes, workspace creation) are excluded by it, which is the point.
+     */
+    workspaceId?: string;
     /**
      * Restrict to one or more event kinds. Accepts a comma-separated list
      * (`?kind=user.invited,user.suspended`) → matched with `IN`. Kinds are

package/dist/lib/activity/dto/list-activity-query.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-activity-query.dto.d.ts","sourceRoot":"","sources":["../../../../src/lib/activity/dto/list-activity-query.dto.ts"],"names":[],"mappings":"AAcA,OAAO,EAMH,KAAK,aAAa,EAClB,KAAK,SAAS,EACjB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;GAMG;AACH,qBAAa,oBAAoB;IAC7B,oDAAoD;IAUpD,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,gEAAgE;IAUhE,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,6BAA6B;IAQ7B,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;;;OAKG;IAmBH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,uEAAuE;IAUvE,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;OAMG;IAYH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,0DAA0D;IAS1D,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,0DAA0D;IAS1D,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ,2BAA2B;IAW3B,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,sDAAsD;IAatD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,yDAAyD;IAQzD,IAAI,CAAC,EAAE,aAAa,CAAC;IAErB,0CAA0C;IAQ1C,KAAK,CAAC,EAAE,SAAS,CAAC;CACrB"}
+{"version":3,"file":"list-activity-query.dto.d.ts","sourceRoot":"","sources":["../../../../src/lib/activity/dto/list-activity-query.dto.ts"],"names":[],"mappings":"AAcA,OAAO,EAMH,KAAK,aAAa,EAClB,KAAK,SAAS,EACjB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;GAMG;AACH,qBAAa,oBAAoB;IAC7B,oDAAoD;IAUpD,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,gEAAgE;IAUhE,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,6BAA6B;IAQ7B,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;;;OAKG;IAWH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;;OAOG;IASH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;OAKG;IAmBH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,uEAAuE;IAUvE,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;OAMG;IAYH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,0DAA0D;IAS1D,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,0DAA0D;IAS1D,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ,2BAA2B;IAW3B,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd,sDAAsD;IAatD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,yDAAyD;IAQzD,IAAI,CAAC,EAAE,aAAa,CAAC;IAErB,0CAA0C;IAQ1C,KAAK,CAAC,EAAE,SAAS,CAAC;CACrB"}

package/dist/lib/activity/dto/list-activity-query.dto.js

@@ -20,6 +20,22 @@ class ListActivityQueryDto {
     subjectId;
     /** Restrict to one actor. */
     actorId;
+    /**
+     * Restrict to actions performed by one kind of principal — `user` or
+     * `api_token`. Free text rather than an enum for the same reason `kind` is:
+     * the values are owned by `@orthacms/database`'s `EVENT_ACTOR_TYPE`, and a
+     * copy here would be a second catalogue to keep in step.
+     */
+    actorType;
+    /**
+     * Restrict to one workspace's history.
+     *
+     * Narrows, never widens: the log is deployment-wide and `activity:read`
+     * is what bounds it, so this is a question a reader may ask rather than a
+     * boundary imposed on them. Rows belonging to no workspace (invites, role
+     * changes, workspace creation) are excluded by it, which is the point.
+     */
+    workspaceId;
     /**
      * Restrict to one or more event kinds. Accepts a comma-separated list
      * (`?kind=user.invited,user.suspended`) → matched with `IN`. Kinds are
@@ -84,6 +100,28 @@ tslib_1.__decorate([
     (0, class_validator_1.IsUUID)(),
     tslib_1.__metadata("design:type", String)
 ], ListActivityQueryDto.prototype, "actorId", void 0);
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: String,
+        maxLength: 255,
+        example: 'api_token',
+        description: 'Restrict to actions performed by one kind of principal (`user` / `api_token`).'
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(255),
+    tslib_1.__metadata("design:type", String)
+], ListActivityQueryDto.prototype, "actorType", void 0);
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: String,
+        format: 'uuid',
+        description: "Restrict to one workspace's history. Rows that belong to no workspace are excluded."
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsUUID)(),
+    tslib_1.__metadata("design:type", String)
+], ListActivityQueryDto.prototype, "workspaceId", void 0);
 tslib_1.__decorate([
     (0, swagger_1.ApiPropertyOptional)({
         type: String,

package/dist/lib/activity/infrastructure/audit-event-mapping.d.ts

@@ -17,8 +17,22 @@ export interface AuditRow {
     subjectId: string;
     /** Who performed it, or `null` for a system-initiated event. */
     actorId: string | null;
+    /**
+     * What {@link actorId} names — `'user'`, `'api_token'`, or `null` when
+     * there is no actor. Defaults to `'user'` for an event whose actor predates
+     * the field, which is every actor the product had until API tokens could be
+     * one.
+     */
+    actorType: string | null;
     /** Frozen actor email snapshot, or `null`. */
     actorEmail: string | null;
+    /**
+     * The workspace the action happened in, or `null` when it happened in none
+     * (an invite, a role change, a workspace being created). Read from the
+     * event's own `payload.workspaceId` — a producer that has a workspace puts
+     * it there.
+     */
+    workspaceId: string | null;
     /** Open per-kind payload, or `null` when the kind carries none. */
     meta: Record<string, unknown> | null;
     /** Logical event time (the event's `occurredAt`). */
@@ -42,8 +56,40 @@ export declare class UnmappableAuditEventError extends Error {
 /**
  * Every event kind the activity subscriber audits — the dispatcher delivers
  * only these to it.
+ *
+ * These are the mappers' **inputs**. For the `kind` values they produce — the
+ * strings that reach the wire and that a client renders — see
+ * {@link AUDIT_KINDS}, which is a different and slightly shorter list
+ * (`member.*` and `user.disabled` collapse onto `user.*` audit kinds).
  */
 export declare const AUDITED_EVENT_KINDS: readonly string[];
+/**
+ * Every audit `kind` this mapper can **produce** — the catalogue a client has
+ * to be able to render.
+ *
+ * It is declared rather than derived because deriving it would mean running
+ * every mapper, and several legitimately throw on a payload that cannot name
+ * their subject. `audit-event-mapping.spec.ts` drives each mapper once and
+ * asserts the two agree in both directions, so a kind added to `FACET_MAPPERS`
+ * and forgotten here fails a test rather than reaching the admin as a raw
+ * dotted token.
+ *
+ * That failure is the whole reason this exists. The admin restates these
+ * strings locally (it cannot import a server plugin), the mapper casts
+ * `dto.kind as ActivityKind` without checking, and a kind with no descriptor
+ * falls back to printing the wire token. No type error, no runtime error, no
+ * failing test — six `workspace.*` kinds, `user.activated`, all seven `media.*`
+ * kinds and all three `user.sso_*` kinds shipped that way.
+ */
+export declare const AUDIT_KINDS: readonly ["user.invited", "user.invite_resent", "user.invite_revoked", "user.password_reset_issued", "user.activated", "user.profile_updated", "user.role_changed", "user.suspended", "user.reactivated", "user.password_changed", "user.signed_in", "user.signed_out", "user.sign_in_failed", "user.session_revoked", "user.sso_linked", "user.sso_provisioned", "user.sso_role_mapped", "workspace.created", "workspace.updated", "workspace.archived", "workspace.unarchived", "workspace.deleted", "workspace.member_added", "workspace.member_removed", "workspace.content_granted", "workspace.content_revoked", "entry.created", "entry.updated", "entry.published", "entry.unpublished", "entry.deleted", "entry.restored", "entry.purged", "token.created", "token.revoked", "token.used", "media.asset.uploaded", "media.asset.updated", "media.asset.moved", "media.asset.deleted", "media.folder.created", "media.folder.renamed", "media.folder.deleted", "transfer.content.exported", "transfer.content.imported", "segment.created", "segment.updated", "segment.deleted", "segment.entry_access_changed", "alarm.rule.created", "alarm.rule.updated", "alarm.rule.deleted", "alarm.rule.rescanned", "saved_view.created", "saved_view.updated", "saved_view.deleted", "copilot.skill.created", "copilot.skill.updated", "copilot.skill.deleted", "copilot.tool_permission.decided"];
+/**
+ * Every `subject_type` this mapper can stamp — the column's whole range.
+ *
+ * Restated in the admin for the same reason as {@link AUDIT_KINDS}, and pinned
+ * by the same spec: the raw values are snake_cased machine tokens that a client
+ * has to translate into something a person reads.
+ */
+export declare const AUDIT_SUBJECT_TYPES: readonly ["user", "workspace", "content_entry", "content_type", "api_token", "media_asset", "media_folder", "login_attempt", "segment", "alarm_rule", "saved_view", "copilot_skill", "copilot_run"];
 /**
  * Maps a domain event to the audit row it should produce, or `null` when the
  * kind is not audited. Pure and DB-free — the safety-net unit test asserts each

package/dist/lib/activity/infrastructure/audit-event-mapping.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-event-mapping.d.ts","sourceRoot":"","sources":["../../../../src/lib/activity/infrastructure/audit-event-mapping.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACrB,uEAAuE;IACvE,EAAE,EAAE,MAAM,CAAC;IACX,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,8CAA8C;IAC9C,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACrC,qDAAqD;IACrD,EAAE,EAAE,IAAI,CAAC;CACZ;AAgKD;;;;;;;;;;;GAWG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACpC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM;CAMjD;AAkRD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAE3B,SAAS,MAAM,EAAE,CAAC;AAgBvB;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,QAAQ,GAAG,IAAI,CAiB9D"}
+{"version":3,"file":"audit-event-mapping.d.ts","sourceRoot":"","sources":["../../../../src/lib/activity/infrastructure/audit-event-mapping.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACrB,uEAAuE;IACvE,EAAE,EAAE,MAAM,CAAC;IACX,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;;;;OAKG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,8CAA8C;IAC9C,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;OAKG;IACH,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACrC,qDAAqD;IACrD,EAAE,EAAE,IAAI,CAAC;CACZ;AAsRD;;;;;;;;;;;GAWG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACpC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM;CAMjD;AA6gBD;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAE3B,SAAS,MAAM,EAAE,CAAC;AAEvB;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,WAAW,q0CA6Dc,CAAC;AAEvC;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,qMAcM,CAAC;AAiDvC;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,QAAQ,GAAG,IAAI,CAyB9D"}