@orthacms/content-server 0.0.0-reserve.0

package/dist/lib/copilot/filter-schema.d.ts

@@ -0,0 +1,61 @@
+import type { FieldSchema } from '@orthacms/utils-server';
+import type { WireFilterField } from '../entries/types/filter-surface';
+/**
+ * The operators the filter engine accepts, as the model sees them. Mirrors
+ * `FilterOperator` in `@orthacms/utils-server` — restated rather than imported
+ * so the descriptions can be written *for a model* instead of for a developer.
+ */
+export declare const FILTER_OPERATORS: readonly ["eq", "ne", "gt", "gte", "lt", "lte", "in", "nin", "like", "ilike", "nilike", "null"];
+/**
+ * The JSON Schema for a filter tree, handed to the model as
+ * `admin_content_search`'s `filter` parameter.
+ *
+ * The grammar is the query builder's own — a node is either a group
+ * (`{and: […]}` / `{or: […]}`) or a rule (`{field, op, value}`) — so the model
+ * emits exactly what the admin's UI emits and the same parser validates both.
+ * **The model never writes SQL**: `parseFilterTree` checks every path against a
+ * schema derived from the content type, so an unknown field or an ungranted
+ * relation hop is a rejected filter, not a query.
+ *
+ * `$ref`/`$defs` are deliberately avoided — a recursive schema is exactly the
+ * thing small models handle worst, and our own `validateToolInput` ignores
+ * `$ref` anyway. Two literal levels of nesting cover every filter the admin's
+ * own query builder can produce, and a deeper one still *works*: the validator
+ * only checks what it is given, and the real depth limit is the parser's.
+ */
+export declare function filterTreeSchema(): Record<string, unknown>;
+/**
+ * The filterable paths, flattened for a model.
+ *
+ * `WireFilterField` carries a `group` breadcrumb for the admin's picker UI,
+ * which is noise here — a model wants the dotted path, the coercion type, and
+ * the allowed values for an enum. Trimming it also keeps `admin_content_types`
+ * affordable on a type with a wide relation graph.
+ *
+ * **`wire` alone is the picker's list, which is narrower than what SQL
+ * accepts** — and the gap is not cosmetic. `scalarWireOf` pushes `status` and
+ * the type's own fields; the envelope timestamps, `publishedAt` above all, are
+ * whitelisted for SQL and deliberately kept out of the admin UI. A person does
+ * not need `publishedAt` in a picker — they have a **Modified** badge in front
+ * of them. A model has no badge, and without this path cannot express
+ * "published content with unpublished changes" at all: it falls back to
+ * `status eq draft` and counts never-published drafts as edits, or invents
+ * `status eq "modified"` and gets an enum error. Both answers are confidently
+ * wrong, which is exactly what the filter grammar's "only paths listed by
+ * admin_content_types are accepted" is supposed to prevent.
+ *
+ * So `sqlFields` — the ROOT level of the very `FilterSchema` that is the
+ * security boundary — is unioned in. Reading the boundary is the opposite of
+ * a second source of truth: a field added to `scalarFieldsOf` later is offered
+ * here automatically, with {@link PARAMETER_BACKED_FIELDS} the one stated
+ * exception. Relation-level envelope paths (`author.publishedAt`) stay
+ * unadvertised: SQL still accepts them, and listing every hop's envelope would
+ * cost more prompt than it buys.
+ */
+export declare function describeFilterFields(fields: readonly WireFilterField[], sqlFields?: FieldSchema): Array<{
+    path: string;
+    type: string;
+    values?: readonly string[];
+    relationTo?: string;
+}>;
+//# sourceMappingURL=filter-schema.d.ts.map

package/dist/lib/copilot/filter-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filter-schema.d.ts","sourceRoot":"","sources":["../../../src/lib/copilot/filter-schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAEvE;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,iGAanB,CAAC;AAEX;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAwC1D;AAiBD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,oBAAoB,CAChC,MAAM,EAAE,SAAS,eAAe,EAAE,EAClC,SAAS,CAAC,EAAE,WAAW,GACxB,KAAK,CAAC;IACL,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC,CAoBD"}

package/dist/lib/copilot/filter-schema.js

@@ -0,0 +1,139 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FILTER_OPERATORS = void 0;
+exports.filterTreeSchema = filterTreeSchema;
+exports.describeFilterFields = describeFilterFields;
+/**
+ * The operators the filter engine accepts, as the model sees them. Mirrors
+ * `FilterOperator` in `@orthacms/utils-server` — restated rather than imported
+ * so the descriptions can be written *for a model* instead of for a developer.
+ */
+exports.FILTER_OPERATORS = [
+    'eq',
+    'ne',
+    'gt',
+    'gte',
+    'lt',
+    'lte',
+    'in',
+    'nin',
+    'like',
+    'ilike',
+    'nilike',
+    'null'
+];
+/**
+ * The JSON Schema for a filter tree, handed to the model as
+ * `admin_content_search`'s `filter` parameter.
+ *
+ * The grammar is the query builder's own — a node is either a group
+ * (`{and: […]}` / `{or: […]}`) or a rule (`{field, op, value}`) — so the model
+ * emits exactly what the admin's UI emits and the same parser validates both.
+ * **The model never writes SQL**: `parseFilterTree` checks every path against a
+ * schema derived from the content type, so an unknown field or an ungranted
+ * relation hop is a rejected filter, not a query.
+ *
+ * `$ref`/`$defs` are deliberately avoided — a recursive schema is exactly the
+ * thing small models handle worst, and our own `validateToolInput` ignores
+ * `$ref` anyway. Two literal levels of nesting cover every filter the admin's
+ * own query builder can produce, and a deeper one still *works*: the validator
+ * only checks what it is given, and the real depth limit is the parser's.
+ */
+function filterTreeSchema() {
+    const rule = {
+        type: 'object',
+        properties: {
+            field: {
+                type: 'string',
+                description: 'A filterable path from admin_content_types → filterableFields, e.g. "status" or "author.name".'
+            },
+            op: {
+                type: 'string',
+                enum: [...exports.FILTER_OPERATORS],
+                description: 'like/ilike/nilike match text only — they are rejected on a date, number, boolean or uuid field. Use eq/ne, the ordering operators, or in/nin there.'
+            },
+            value: {
+                description: 'The comparison value. An array for in/nin; a boolean for null (true = IS NULL); omitted values are rejected.'
+            }
+        },
+        required: ['field', 'op'],
+        additionalProperties: false
+    };
+    const group = (of) => ({
+        type: 'object',
+        properties: {
+            and: { type: 'array', items: of },
+            or: { type: 'array', items: of }
+        },
+        additionalProperties: false
+    });
+    return {
+        ...group({ anyOf: [rule, group(rule)] }),
+        description: 'A filter tree. Either a group — {"and":[…]} or {"or":[…]} — or, nested inside one, ' +
+            'rules of the form {"field":"status","op":"eq","value":"published"}. ' +
+            'Only paths listed by admin_content_types are accepted.'
+    };
+}
+/**
+ * Root envelope columns the SQL whitelist accepts but that must NOT be
+ * advertised, because each already has a dedicated tool **parameter**.
+ *
+ * `admin_content_search` takes `locale`, which the bound entry extension
+ * validates and scopes with; a model that filtered `locale eq "de"` instead
+ * would AND that onto the extension's own scope — already pinned to the
+ * default locale — and read zero rows from a perfectly valid query. Offering
+ * both spellings of one idea is how a model picks the broken one.
+ */
+const PARAMETER_BACKED_FIELDS = new Set([
+    'locale',
+    'localeGroupId'
+]);
+/**
+ * The filterable paths, flattened for a model.
+ *
+ * `WireFilterField` carries a `group` breadcrumb for the admin's picker UI,
+ * which is noise here — a model wants the dotted path, the coercion type, and
+ * the allowed values for an enum. Trimming it also keeps `admin_content_types`
+ * affordable on a type with a wide relation graph.
+ *
+ * **`wire` alone is the picker's list, which is narrower than what SQL
+ * accepts** — and the gap is not cosmetic. `scalarWireOf` pushes `status` and
+ * the type's own fields; the envelope timestamps, `publishedAt` above all, are
+ * whitelisted for SQL and deliberately kept out of the admin UI. A person does
+ * not need `publishedAt` in a picker — they have a **Modified** badge in front
+ * of them. A model has no badge, and without this path cannot express
+ * "published content with unpublished changes" at all: it falls back to
+ * `status eq draft` and counts never-published drafts as edits, or invents
+ * `status eq "modified"` and gets an enum error. Both answers are confidently
+ * wrong, which is exactly what the filter grammar's "only paths listed by
+ * admin_content_types are accepted" is supposed to prevent.
+ *
+ * So `sqlFields` — the ROOT level of the very `FilterSchema` that is the
+ * security boundary — is unioned in. Reading the boundary is the opposite of
+ * a second source of truth: a field added to `scalarFieldsOf` later is offered
+ * here automatically, with {@link PARAMETER_BACKED_FIELDS} the one stated
+ * exception. Relation-level envelope paths (`author.publishedAt`) stay
+ * unadvertised: SQL still accepts them, and listing every hop's envelope would
+ * cost more prompt than it buys.
+ */
+function describeFilterFields(fields, sqlFields) {
+    const described = fields.map((field) => ({
+        path: field.path,
+        type: field.type,
+        ...(field.enumValues ? { values: field.enumValues } : {}),
+        ...(field.relationTarget ? { relationTo: field.relationTarget } : {})
+    }));
+    if (!sqlFields)
+        return described;
+    const advertised = new Set(described.map((field) => field.path));
+    for (const [name, spec] of Object.entries(sqlFields)) {
+        if (advertised.has(name) || PARAMETER_BACKED_FIELDS.has(name))
+            continue;
+        described.push({
+            path: name,
+            type: spec.type,
+            ...(spec.enumValues ? { values: spec.enumValues } : {})
+        });
+    }
+    return described;
+}

package/dist/lib/copilot/project-entry.d.ts

@@ -0,0 +1,23 @@
+import type { EntryRecord } from '../entries/types/entry-list-view';
+/**
+ * Narrows an entry's `values` to the named fields, leaving the envelope alone.
+ *
+ * **This is what makes "list all the articles" possible at all.** A full
+ * `EntryRecord` carries every field including richtext bodies, so a page of 25
+ * can be tens of thousands of tokens — the run hits its token ceiling long
+ * before it hits the row cap. Asking for `["text","status"]` turns the same page
+ * into something a model can actually reason over.
+ *
+ * The envelope (`id`, `status`, `locale`, timestamps, …) is always kept: `id` is
+ * what makes an entry addressable for a follow-up `admin_content_get`, and a
+ * projection that could drop it would be a trap. Same rule the public API's
+ * sparse fieldsets follow.
+ *
+ * An unknown name is **ignored** rather than rejected. The public API 400s one,
+ * because there a typo is a developer's bug worth surfacing; here the names come
+ * from a model that may have mis-remembered a field, and failing the whole call
+ * over one bad name costs a round trip to learn something the response itself
+ * shows. The returned `values` say what was actually found.
+ */
+export declare function projectEntry(entry: EntryRecord, fields: readonly string[] | undefined): EntryRecord;
+//# sourceMappingURL=project-entry.d.ts.map

package/dist/lib/copilot/project-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-entry.d.ts","sourceRoot":"","sources":["../../../src/lib/copilot/project-entry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CACxB,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACtC,WAAW,CAYb"}

package/dist/lib/copilot/project-entry.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.projectEntry = projectEntry;
+/**
+ * Narrows an entry's `values` to the named fields, leaving the envelope alone.
+ *
+ * **This is what makes "list all the articles" possible at all.** A full
+ * `EntryRecord` carries every field including richtext bodies, so a page of 25
+ * can be tens of thousands of tokens — the run hits its token ceiling long
+ * before it hits the row cap. Asking for `["text","status"]` turns the same page
+ * into something a model can actually reason over.
+ *
+ * The envelope (`id`, `status`, `locale`, timestamps, …) is always kept: `id` is
+ * what makes an entry addressable for a follow-up `admin_content_get`, and a
+ * projection that could drop it would be a trap. Same rule the public API's
+ * sparse fieldsets follow.
+ *
+ * An unknown name is **ignored** rather than rejected. The public API 400s one,
+ * because there a typo is a developer's bug worth surfacing; here the names come
+ * from a model that may have mis-remembered a field, and failing the whole call
+ * over one bad name costs a round trip to learn something the response itself
+ * shows. The returned `values` say what was actually found.
+ */
+function projectEntry(entry, fields) {
+    if (!fields || fields.length === 0) {
+        return entry;
+    }
+    const wanted = new Set(fields);
+    const values = {};
+    for (const [key, value] of Object.entries(entry.values ?? {})) {
+        if (wanted.has(key)) {
+            values[key] = value;
+        }
+    }
+    return { ...entry, values };
+}

package/dist/lib/copilot/proposal-kinds.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The proposal kinds this plugin declares and applies.
+ *
+ * Named once here rather than spelled as literals in the tool and again in the
+ * applier: the two halves are in different files and a typo between them
+ * produces a proposal nothing can carry out — which surfaces only when a human
+ * clicks Accept, long after the mistake.
+ *
+ * They are namespaced like tool names for the same reason MCP tools are
+ * (ADR-0005 §8): the registry refuses a duplicate `kind`, so a flat name like
+ * `update` would be a collision waiting for the second plugin that wants it.
+ */
+export declare const CONTENT_PROPOSAL_KINDS: {
+    /** A new draft entry of a content type. */
+    readonly createEntry: "content.entry.create";
+    /** A change to an existing entry's field values. */
+    readonly updateEntry: "content.entry.update";
+    /**
+     * A batch of creates and updates on one content type, carried out as one
+     * change.
+     *
+     * Its own kind rather than a repeated `createEntry`/`updateEntry`, because
+     * a proposal row is the receipt for **one tool call**: a batch that wrote
+     * itself as twelve rows would be twelve cards in the transcript for a
+     * change the user asked for once, and no row would say what the other
+     * eleven were.
+     */
+    readonly bulkSaveEntries: "content.entry.bulk-save";
+};
+//# sourceMappingURL=proposal-kinds.d.ts.map

package/dist/lib/copilot/proposal-kinds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proposal-kinds.d.ts","sourceRoot":"","sources":["../../../src/lib/copilot/proposal-kinds.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB;IAC/B,2CAA2C;;IAE3C,oDAAoD;;IAEpD;;;;;;;;;OASG;;CAEG,CAAC"}

package/dist/lib/copilot/proposal-kinds.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONTENT_PROPOSAL_KINDS = void 0;
+/**
+ * The proposal kinds this plugin declares and applies.
+ *
+ * Named once here rather than spelled as literals in the tool and again in the
+ * applier: the two halves are in different files and a typo between them
+ * produces a proposal nothing can carry out — which surfaces only when a human
+ * clicks Accept, long after the mistake.
+ *
+ * They are namespaced like tool names for the same reason MCP tools are
+ * (ADR-0005 §8): the registry refuses a duplicate `kind`, so a flat name like
+ * `update` would be a collision waiting for the second plugin that wants it.
+ */
+exports.CONTENT_PROPOSAL_KINDS = {
+    /** A new draft entry of a content type. */
+    createEntry: 'content.entry.create',
+    /** A change to an existing entry's field values. */
+    updateEntry: 'content.entry.update',
+    /**
+     * A batch of creates and updates on one content type, carried out as one
+     * change.
+     *
+     * Its own kind rather than a repeated `createEntry`/`updateEntry`, because
+     * a proposal row is the receipt for **one tool call**: a batch that wrote
+     * itself as twelve rows would be twelve cards in the transcript for a
+     * change the user asked for once, and no row would say what the other
+     * eleven were.
+     */
+    bulkSaveEntries: 'content.entry.bulk-save'
+};

package/dist/lib/copilot/revision-tool.provider.d.ts

@@ -0,0 +1,56 @@
+import { type OnModuleInit } from '@nestjs/common';
+import { ToolRegistry } from '@orthacms/tools-server';
+import type { ToolDefinition, ToolProvider } from '@orthacms/tools-server';
+import type { ContentTypeRegistry } from '../registry/content-type-registry';
+import { WorkspaceGrantsQuery } from '../content-types/queries/workspace-grants.query';
+import { type RevisionStore } from '../revisions/application/ports/revision-store';
+/**
+ * The content plugin's **version-history** tools — `admin_content_revisions` and
+ * `admin_content_diff`.
+ *
+ * A second provider rather than more methods on
+ * {@link ContentCopilotToolProvider}: revisions are their own feature folder
+ * with their own port, and the registry takes any number of providers, so the
+ * split costs one `register(...)` call and keeps each file about one thing.
+ *
+ * Both re-check the workspace's content grants for the same reason the entry
+ * tools do — the type name arrives from the *model*. The revision store is
+ * workspace-scoped on every read besides, so an entry id from another workspace
+ * reads as absent rather than as a leak.
+ */
+export declare class RevisionCopilotToolProvider implements ToolProvider, OnModuleInit {
+    private readonly registry;
+    private readonly revisions;
+    private readonly grants;
+    private readonly toolRegistry?;
+    constructor(registry: ContentTypeRegistry, revisions: RevisionStore, grants: WorkspaceGrantsQuery, toolRegistry?: ToolRegistry | undefined);
+    /**
+     * Register with the shared tool registry once the DI graph is built —
+     * the same catalogue the MCP endpoint serves, narrowed to the `copilot`
+     * surface by each tool's `surfaces`. `@Optional()` because a deployment
+     * may run neither consumer, in which case these simply go unregistered.
+     */
+    onModuleInit(): void;
+    /** The two history tools, in the order the model sees them. */
+    tools(): readonly ToolDefinition[];
+    /**
+     * Resolves a model-supplied type name to a granted, registered type, or
+     * throws. Same uniform message as the entry tools, for the same reason:
+     * distinguishing "not granted" from "does not exist" would let a run in one
+     * workspace enumerate the deployment's other content types.
+     */
+    private resolveGranted;
+    /** `admin_content_revisions` — an entry's version timeline, newest first. */
+    private listRevisions;
+    /**
+     * `admin_content_diff` — what changed between two versions.
+     *
+     * The tool returns **only the changed fields**, plus a count of the
+     * unchanged ones. A full side-by-side of every field is what the admin's
+     * dialog renders, because a person wants unchanged rows for context; a
+     * model gets nothing from them but a bigger prompt, and on a wide type the
+     * unchanged richtext bodies alone would dominate the run's token budget.
+     */
+    private diffRevisions;
+}
+//# sourceMappingURL=revision-tool.provider.d.ts.map

package/dist/lib/copilot/revision-tool.provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revision-tool.provider.d.ts","sourceRoot":"","sources":["../../../src/lib/copilot/revision-tool.provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEzE,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE3E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AACvF,OAAO,EAEH,KAAK,aAAa,EACrB,MAAM,+CAA+C,CAAC;AAMvD;;;;;;;;;;;;;GAaG;AACH,qBACa,2BAA4B,YAAW,YAAY,EAAE,YAAY;IAGtE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACX,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAJzB,QAAQ,EAAE,mBAAmB,EAE7B,SAAS,EAAE,aAAa,EACxB,MAAM,EAAE,oBAAoB,EAChB,YAAY,CAAC,EAAE,YAAY,YAAA;IAG5D;;;;;OAKG;IACH,YAAY,IAAI,IAAI;IAIpB,+DAA+D;IAC/D,KAAK,IAAI,SAAS,cAAc,EAAE;IAIlC;;;;;OAKG;YACW,cAAc;IAW5B,6EAA6E;IAC7E,OAAO,CAAC,aAAa;IA2ErB;;;;;;;;OAQG;IACH,OAAO,CAAC,aAAa;CA0GxB"}

package/dist/lib/copilot/revision-tool.provider.js

@@ -0,0 +1,215 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RevisionCopilotToolProvider = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const identity_server_1 = require("@orthacms/identity-server");
+const tools_server_1 = require("@orthacms/tools-server");
+const content_tokens_1 = require("../content.tokens");
+const workspace_grants_query_1 = require("../content-types/queries/workspace-grants.query");
+const revision_store_1 = require("../revisions/application/ports/revision-store");
+const diff_snapshots_1 = require("./diff-snapshots");
+/** Revisions a single `admin_content_revisions` call may return. */
+const MAX_REVISION_PAGE_SIZE = 25;
+/**
+ * The content plugin's **version-history** tools — `admin_content_revisions` and
+ * `admin_content_diff`.
+ *
+ * A second provider rather than more methods on
+ * {@link ContentCopilotToolProvider}: revisions are their own feature folder
+ * with their own port, and the registry takes any number of providers, so the
+ * split costs one `register(...)` call and keeps each file about one thing.
+ *
+ * Both re-check the workspace's content grants for the same reason the entry
+ * tools do — the type name arrives from the *model*. The revision store is
+ * workspace-scoped on every read besides, so an entry id from another workspace
+ * reads as absent rather than as a leak.
+ */
+let RevisionCopilotToolProvider = class RevisionCopilotToolProvider {
+    registry;
+    revisions;
+    grants;
+    toolRegistry;
+    constructor(registry, revisions, grants, toolRegistry) {
+        this.registry = registry;
+        this.revisions = revisions;
+        this.grants = grants;
+        this.toolRegistry = toolRegistry;
+    }
+    /**
+     * Register with the shared tool registry once the DI graph is built —
+     * the same catalogue the MCP endpoint serves, narrowed to the `copilot`
+     * surface by each tool's `surfaces`. `@Optional()` because a deployment
+     * may run neither consumer, in which case these simply go unregistered.
+     */
+    onModuleInit() {
+        this.toolRegistry?.register(this);
+    }
+    /** The two history tools, in the order the model sees them. */
+    tools() {
+        return [this.listRevisions(), this.diffRevisions()];
+    }
+    /**
+     * Resolves a model-supplied type name to a granted, registered type, or
+     * throws. Same uniform message as the entry tools, for the same reason:
+     * distinguishing "not granted" from "does not exist" would let a run in one
+     * workspace enumerate the deployment's other content types.
+     */
+    async resolveGranted(typeName, workspaceId) {
+        const type = this.registry.get(typeName);
+        const granted = await this.grants.grantedSlugs(workspaceId);
+        if (!type || !granted.has(type.name)) {
+            throw new Error(`Unknown content type "${typeName}" in this workspace.`);
+        }
+        return type;
+    }
+    /** `admin_content_revisions` — an entry's version timeline, newest first. */
+    listRevisions() {
+        return {
+            name: 'admin_content_revisions',
+            title: 'List an entry’s versions',
+            description: 'List an entry’s saved versions, newest first — version number, status ' +
+                '(draft / published / superseded), when it was captured and by whom. Use this ' +
+                'to answer “when did this change?” or “what version is live?”, and to find the ' +
+                'two version numbers to pass to admin_content_diff. Each locale of a ' +
+                'localized entry has its own timeline, keyed by that locale’s entry id.',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    typeName: {
+                        type: 'string',
+                        description: 'The entry’s content type.'
+                    },
+                    id: {
+                        type: 'string',
+                        description: 'The entry’s id, as returned by admin_content_search.'
+                    },
+                    page: {
+                        type: 'integer',
+                        minimum: 1,
+                        description: '1-based page number.'
+                    },
+                    pageSize: {
+                        type: 'integer',
+                        minimum: 1,
+                        maximum: MAX_REVISION_PAGE_SIZE,
+                        description: `Versions per page (max ${MAX_REVISION_PAGE_SIZE}).`
+                    }
+                },
+                required: ['typeName', 'id'],
+                additionalProperties: false
+            },
+            requires: [identity_server_1.PERMISSIONS.CONTENT_READ],
+            readOnly: true,
+            effect: 'read',
+            surfaces: ['copilot'],
+            handler: async (input, ctx) => {
+                const args = (input ?? {});
+                const type = await this.resolveGranted(args.typeName, ctx.workspaceId);
+                // Clamped in `run` as well as declared: the schema validator is
+                // defence in depth, not the boundary.
+                const pageSize = Math.min(Math.max(args.pageSize ?? 10, 1), MAX_REVISION_PAGE_SIZE);
+                const result = await this.revisions.list(type.name, args.id, ctx.workspaceId, Math.max(args.page ?? 1, 1), pageSize);
+                return {
+                    ...result,
+                    page: Math.max(args.page ?? 1, 1),
+                    pageSize
+                };
+            }
+        };
+    }
+    /**
+     * `admin_content_diff` — what changed between two versions.
+     *
+     * The tool returns **only the changed fields**, plus a count of the
+     * unchanged ones. A full side-by-side of every field is what the admin's
+     * dialog renders, because a person wants unchanged rows for context; a
+     * model gets nothing from them but a bigger prompt, and on a wide type the
+     * unchanged richtext bodies alone would dominate the run's token budget.
+     */
+    diffRevisions() {
+        return {
+            name: 'admin_content_diff',
+            title: 'Compare two versions',
+            description: 'Compare two saved versions of an entry and report which fields differ, with ' +
+                'the before and after value of each. Only changed fields are returned (the ' +
+                'number of unchanged ones is reported separately). Get the version numbers ' +
+                'from admin_content_revisions.',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    typeName: {
+                        type: 'string',
+                        description: 'The entry’s content type.'
+                    },
+                    id: { type: 'string', description: 'The entry’s id.' },
+                    from: {
+                        type: 'integer',
+                        minimum: 1,
+                        description: 'The older version number — the baseline to compare against.'
+                    },
+                    to: {
+                        type: 'integer',
+                        minimum: 1,
+                        description: 'The newer version number.'
+                    }
+                },
+                required: ['typeName', 'id', 'from', 'to'],
+                additionalProperties: false
+            },
+            requires: [identity_server_1.PERMISSIONS.CONTENT_READ],
+            readOnly: true,
+            effect: 'read',
+            surfaces: ['copilot'],
+            handler: async (input, ctx) => {
+                const args = (input ?? {});
+                const type = await this.resolveGranted(args.typeName, ctx.workspaceId);
+                const [before, after] = await Promise.all([
+                    this.revisions.get(type.name, args.id, ctx.workspaceId, args.from),
+                    this.revisions.get(type.name, args.id, ctx.workspaceId, args.to)
+                ]);
+                // Naming the missing one matters: "version 7 does not exist"
+                // is recoverable by re-reading the timeline, "not found" is
+                // not. Neither reveals anything — the store is already
+                // workspace-scoped, so an entry the caller cannot reach has no
+                // versions to enumerate either.
+                const missing = [
+                    ...(before ? [] : [args.from]),
+                    ...(after ? [] : [args.to])
+                ];
+                if (!before || !after) {
+                    throw new Error(`No version ${missing.join(' or ')} of this entry.`);
+                }
+                // `serialize` is `T | undefined` for an unregistered name;
+                // `resolveGranted` already proved this one is registered, so
+                // the fallback is unreachable rather than a real branch — an
+                // empty field list would diff to "nothing changed", which is
+                // why it isn't left implicit.
+                const schema = this.registry.serialize(type.name);
+                if (!schema) {
+                    throw new Error(`Unknown content type "${args.typeName}" in this workspace.`);
+                }
+                const { changes, unchangedFields } = (0, diff_snapshots_1.diffSnapshots)(schema, before.snapshot, after.snapshot);
+                return {
+                    typeName: type.name,
+                    from: {
+                        number: before.number,
+                        createdAt: before.createdAt
+                    },
+                    to: { number: after.number, createdAt: after.createdAt },
+                    changes,
+                    unchangedFields
+                };
+            }
+        };
+    }
+};
+exports.RevisionCopilotToolProvider = RevisionCopilotToolProvider;
+exports.RevisionCopilotToolProvider = RevisionCopilotToolProvider = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(0, (0, content_tokens_1.InjectContentRegistry)()),
+    tslib_1.__param(1, (0, revision_store_1.InjectRevisionStore)()),
+    tslib_1.__param(3, (0, common_1.Optional)()),
+    tslib_1.__metadata("design:paramtypes", [Function, Object, workspace_grants_query_1.WorkspaceGrantsQuery,
+        tools_server_1.ToolRegistry])
+], RevisionCopilotToolProvider);

package/dist/lib/docs/content-schemas.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The OpenAPI schemas this plugin contributes: one set **per registered content
+ * type** (generated from the registry) plus the fixed shapes its routes share.
+ *
+ * Content types are code-defined runtime data, not decorated classes, so
+ * `@nestjs/swagger` cannot see them. This module is how they become visible.
+ */
+import type { SerializedContentType } from '../registry/content-type-registry';
+import { type OpenApiSchema } from './field-schema';
+/** Schema names of one content type's generated trio. */
+export interface TypeSchemaNames {
+    /** The `values` bag — one property per column-backed field. */
+    values: string;
+    /** One entry: the storage envelope wrapping {@link values}. */
+    entry: string;
+    /** One page of entries. */
+    listPage: string;
+}
+/** `#/components/schemas/<name>`. */
+export declare function ref(name: string): OpenApiSchema;
+/**
+ * `article` → `Article`, `seo_meta` → `SeoMeta`. Content-type names are
+ * snake_case machine names; schema names are the PascalCase convention the rest
+ * of the document uses.
+ */
+export declare function pascalCase(name: string): string;
+/** The three schema names a content type contributes. */
+export declare function schemaNamesOf(type: SerializedContentType): TypeSchemaNames;
+/**
+ * Every schema this plugin contributes: the shared shapes plus, for each
+ * registered content type, its `Values` / `Entry` / `ListPage` trio.
+ */
+export declare function buildContentSchemas(types: readonly SerializedContentType[]): Record<string, OpenApiSchema>;
+//# sourceMappingURL=content-schemas.d.ts.map

package/dist/lib/docs/content-schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-schemas.d.ts","sourceRoot":"","sources":["../../../src/lib/docs/content-schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,EAA6B,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/E,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC5B,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAC;IACd,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,CAAC;CACpB;AAKD,qCAAqC;AACrC,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAE/C;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM/C;AAED,yDAAyD;AACzD,wBAAgB,aAAa,CAAC,IAAI,EAAE,qBAAqB,GAAG,eAAe,CAO1E;AAomBD;;;GAGG;AACH,wBAAgB,mBAAmB,CAC/B,KAAK,EAAE,SAAS,qBAAqB,EAAE,GACxC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAS/B"}