@orthacms/content-server 0.4.1 → 0.4.3

package/dist/lib/entries/infrastructure/persistence/entry-writer.service.js

@@ -10,6 +10,7 @@ const utils_server_1 = require("@orthacms/utils-server");
 const content_domain_1 = require("@orthacms/content-domain");
 const entry_extension_1 = require("../../../extension/entry-extension");
 const media_asset_resolver_1 = require("../../../extension/media-asset-resolver");
+const entry_write_extension_1 = require("../../../extension/entry-write-extension");
 const media_accept_1 = require("./media-accept");
 const content_type_1 = require("../../../types/content-type");
 const fields_1 = require("../../../types/fields");
@@ -58,19 +59,28 @@ let EntryWriterService = class EntryWriterService {
     validation;
     relations;
     revisionStore;
+    writeExtensions;
     extension;
     mediaResolver;
     constructor(db, 
     // The transaction boundary every write now runs inside, and the outbox
     // that joins it. Together they are what makes an entry's domain event
     // commit with — and never without — the row it describes.
-    uow, outbox, validation, relations, revisionStore, extension, mediaResolver) {
+    uow, outbox, validation, relations, revisionStore, 
+    // Every bound entry-write extension (segments' reader entitlements
+    // today) — state another plugin owns *about* the entry, written on this
+    // save's transaction and captured by its revision. A registry rather
+    // than a token because Nest cannot merge two bindings of one token, and
+    // an extension that silently stopped being called would silently stop
+    // restricting content.
+    writeExtensions, extension, mediaResolver) {
         this.db = db;
         this.uow = uow;
         this.outbox = outbox;
         this.validation = validation;
         this.relations = relations;
         this.revisionStore = revisionStore;
+        this.writeExtensions = writeExtensions;
         this.extension = extension;
         this.mediaResolver = mediaResolver;
     }
@@ -216,6 +226,17 @@ let EntryWriterService = class EntryWriterService {
     async appendRevision(tx, type, row, workspaceId, actorId) {
         const id = row['id'];
         const links = await this.relations.snapshotLinks(tx, type, row);
+        // Whatever the bound extensions hold for this row *now* — read on the
+        // save's own transaction, after any `apply` has run, so the version
+        // records what committed. Captured unconditionally, including for a
+        // sibling row this save only touched indirectly: a version that omitted
+        // the state it did not change would restore as a version that had none.
+        const extra = await this.writeExtensions.captureAll({
+            executor: tx,
+            type,
+            entryId: id,
+            workspaceId
+        });
         await this.revisionStore.lockEntry(tx, id);
         const number = await this.revisionStore.nextNumber(tx, id);
         const revision = revision_1.Revision.createDraft({
@@ -225,7 +246,7 @@ let EntryWriterService = class EntryWriterService {
             localeGroupId: row['localeGroupId'] ?? null,
             locale: row['locale'] ?? null,
             number,
-            snapshot: (0, revision_snapshot_1.buildSnapshot)(type, row, links),
+            snapshot: (0, revision_snapshot_1.buildSnapshot)(type, row, links, extra),
             createdBy: actorId
         });
         await this.revisionStore.append(tx, revision);
@@ -241,14 +262,50 @@ let EntryWriterService = class EntryWriterService {
      * advisory lock, and a stable order across concurrent savers is what keeps
      * two of them from deadlocking on the pair.
      */
-    async appendRevisionsFor(tx, type, rows, workspaceId, actorId) {
-        if (!rows?.length)
+    async appendRevisionsFor(tx, type, rows, workspaceId, actorId, 
+    /**
+     * Ids of further rows an **entry-write extension** changed, which it
+     * reports rather than returns whole — it wrote a table of its own, not
+     * these ones, so it has no row to hand back. Merged with `rows` and
+     * deduplicated by id: one save can reach a sibling through both paths
+     * (a shared field *and* an audience), and appending two revisions for it
+     * would read as two edits.
+     */
+    alsoChangedIds = []) {
+        const byId = new Map();
+        for (const row of rows ?? [])
+            byId.set(String(row['id']), row);
+        const missing = alsoChangedIds.filter((id) => !byId.has(id));
+        for (const row of await this.rowsByIds(tx, type, missing, workspaceId)) {
+            byId.set(String(row['id']), row);
+        }
+        if (!byId.size)
             return;
-        const ordered = [...rows].sort((a, b) => String(a['id']).localeCompare(String(b['id'])));
+        const ordered = [...byId.values()].sort((a, b) => String(a['id']).localeCompare(String(b['id'])));
         for (const row of ordered) {
             await this.appendRevision(tx, type, row, workspaceId, actorId);
         }
     }
+    /**
+     * The rows behind a set of ids, on this transaction.
+     *
+     * Soft-deleted rows are **included**: a locale in the trash is still a row
+     * whose state an extension just changed, and it comes back on restore
+     * expecting a timeline that says so.
+     */
+    async rowsByIds(tx, type, ids, workspaceId) {
+        if (!ids.length)
+            return [];
+        const columns = type.table;
+        const id = columns['id'];
+        const workspace = columns['workspaceId'];
+        if (!id || !workspace)
+            return [];
+        return (await tx
+            .select()
+            .from(type.table)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.inArray)(id, [...ids]), (0, drizzle_orm_1.eq)(workspace, workspaceId))));
+    }
     /**
      * Create an entry **owned by `workspaceId`** (stamped onto the row so the
      * reader's workspace filter and every later scoped write see it). A
@@ -266,8 +323,13 @@ let EntryWriterService = class EntryWriterService {
      * extension validates them and stamps the envelope columns (a
      * `localeGroupId` makes the row a **sibling** in that translation group). A
      * duplicate `(group, locale)` surfaces as a **409** via {@link uniqueGuarded}.
+     *
+     * `extensions` is the same kind of thing one plugin further out: an opaque
+     * bag forwarded to the bound {@link EntryWriteExtensionRegistry}, so a plugin
+     * that owns state *about* an entry (segments' audiences) writes it inside
+     * this transaction and has it captured by the same version.
      */
-    async create(type, values, workspaceId, relations, locale, localeGroupId, actor) {
+    async create(type, values, workspaceId, relations, locale, localeGroupId, actor, extensions) {
         const actorId = actor?.id ?? null;
         // `coerceValues` stamps every declared field onto the bag, so the
         // "sent in both places" check below has to read the RAW body — after
@@ -342,12 +404,36 @@ let EntryWriterService = class EntryWriterService {
             // group must land consistent with the group's shared values.
             // A no-op for a fresh, sibling-less group.
             const touched = await this.extension?.afterUpdate(tx, type, inserted, coerced, workspaceId, { created: true });
+            // Anything a bound plugin was asked to store about this
+            // entry — the row exists now, so it finally has something to
+            // hang off, and it lands before the snapshot below reads it
+            // back. A create is the case that forced this into the write
+            // at all: until the insert there is no id to write against.
+            const alsoChanged = await this.writeExtensions.applyAll({
+                executor: tx,
+                type,
+                entryId: id,
+                workspaceId
+            }, extensions);
+            // …and, for a row joining an existing locale group, whatever
+            // that group already holds. `applyAll` runs only for keys
+            // the caller sent, and "create a translation" sends none —
+            // so without this a translation of a restricted article was
+            // a public copy of it. After `applyAll`, so an extension the
+            // caller just told what to store is not overwritten.
+            await this.writeExtensions.inheritAll({
+                executor: tx,
+                type,
+                entryId: id,
+                workspaceId
+            });
             // Snapshot the just-created document as its first revision,
             // inside this same transaction.
             await this.appendRevision(tx, type, inserted, workspaceId, actorId ?? null);
-            // …and one for every sibling the extension rewrote, so a
-            // shared value landing on them is in their history too.
-            await this.appendRevisionsFor(tx, type, touched, workspaceId, actorId ?? null);
+            // …and one for every sibling either extension path rewrote,
+            // so a shared value — or an audience — landing on them is in
+            // their history too.
+            await this.appendRevisionsFor(tx, type, touched, workspaceId, actorId ?? null, alsoChanged);
             // Inside the transaction, so the fact and the row it
             // describes commit together or not at all — the whole point
             // of the outbox.
@@ -504,14 +590,25 @@ let EntryWriterService = class EntryWriterService {
             // locale siblings) run inside the same transaction — a failure
             // rolls the whole save back.
             const touched = await this.extension?.afterUpdate(tx, type, updated, coerced, workspaceId, { created: false });
+            // Whatever a bound plugin was asked to store about this entry, on
+            // this transaction and before the snapshot reads it back — so the
+            // version records the audiences the save actually applied rather
+            // than the ones it replaced. This runs even when no version is
+            // appended (publish-a-version): the state is the entry's, not the
+            // revision's.
+            const alsoChanged = await this.writeExtensions.applyAll({ executor: tx, type, entryId: id, workspaceId }, options?.extensions);
             // Snapshot the updated document as a new draft revision, inside this
             // same transaction — unless the caller is re-applying a version that
             // already exists in the timeline (publish-a-version).
             if (options?.appendRevision ?? true) {
                 await this.appendRevision(tx, type, updated, workspaceId, actorId ?? null);
             }
-            // …and one for every sibling the extension rewrote.
-            await this.appendRevisionsFor(tx, type, touched, workspaceId, actorId ?? null);
+            // …and one for every sibling either extension path rewrote — the
+            // rows i18n synced a shared field to, and the rows a write extension
+            // reports it also changed (segments writes an entry's audiences to
+            // its whole locale group). Both are the same defect if skipped: a
+            // row whose state moved while its timeline did not.
+            await this.appendRevisionsFor(tx, type, touched, workspaceId, actorId ?? null, alsoChanged);
             // A save that changed no field value raises nothing: it is a round
             // trip, not an editorial change, and the log is read by people.
             const fields = this.changedFields(type, before, updated);
@@ -1221,12 +1318,12 @@ exports.EntryWriterService = EntryWriterService = tslib_1.__decorate([
     (0, common_1.Injectable)(),
     tslib_1.__param(0, (0, database_1.InjectDatabase)()),
     tslib_1.__param(5, (0, revision_store_1.InjectRevisionStore)()),
-    tslib_1.__param(6, (0, common_1.Optional)()),
-    tslib_1.__param(6, (0, common_1.Inject)(entry_extension_1.CONTENT_ENTRY_EXTENSION)),
     tslib_1.__param(7, (0, common_1.Optional)()),
-    tslib_1.__param(7, (0, media_asset_resolver_1.InjectMediaAssetResolver)()),
+    tslib_1.__param(7, (0, common_1.Inject)(entry_extension_1.CONTENT_ENTRY_EXTENSION)),
+    tslib_1.__param(8, (0, common_1.Optional)()),
+    tslib_1.__param(8, (0, media_asset_resolver_1.InjectMediaAssetResolver)()),
     tslib_1.__metadata("design:paramtypes", [Object, database_1.UnitOfWork,
         database_1.OutboxWriter,
         entry_validation_service_1.EntryValidationService,
-        relation_link_service_1.RelationLinkService, Object, Object, Object])
+        relation_link_service_1.RelationLinkService, Object, entry_write_extension_1.EntryWriteExtensionRegistry, Object, Object])
 ], EntryWriterService);

package/dist/lib/entries/infrastructure/persistence/relation-link.service.d.ts

@@ -1,6 +1,7 @@
 import { type Database } from '@orthacms/database';
 import { type AnyContentType } from '../../../types/content-type';
 import { type AnyFieldSpec } from '../../../types/fields';
+import { ContentReadScopeRegistry } from '../../../extension/read-scope';
 import type { RelationDelta, RelationFieldView, RelationRef } from '../../types/entry-list-view';
 /**
  * Reject any target row that lives in a different locale from the source.
@@ -35,7 +36,16 @@ export declare const RELATION_PAGE_SIZE = 20;
  * links to drafts and needs to see them.
  */
 export interface RelationTargetVisibility {
-    /** Restrict targets to entries that are currently published. */
+    /**
+     * Restrict targets to entries that are currently published.
+     *
+     * It also turns on the bound **read scopes** — segments' reader
+     * entitlements — against the target type. The two ride one flag because
+     * they answer one question ("may this caller reach this target?") and are
+     * needed at exactly the same call sites: every public read passes it, and
+     * no admin read does. A second flag would be a second thing to remember on
+     * a path where forgetting it means counting links a reader cannot follow.
+     */
     publishedOnly?: boolean;
 }
 /**
@@ -65,7 +75,8 @@ export type QueryRunner = Pick<Database, 'select'>;
  */
 export declare class RelationLinkService {
     private readonly db;
-    constructor(db: Database);
+    private readonly readScopes?;
+    constructor(db: Database, readScopes?: ContentReadScopeRegistry | undefined);
     /**
      * First page (+ total) of **every** relation field of `type` for one entry,
      * keyed by field name — what the editor loads on open. Each field is read
@@ -208,11 +219,33 @@ export declare class RelationLinkService {
     /**
      * The visibility predicate applied to a relation's target rows: the
      * workspace scope, the soft-delete guard, and — only when the caller asks
-     * for it — the published-only restriction. One definition, so the row read
-     * (`refsFor`) and the windowed link reads that must *count* correctly can't
-     * disagree on what a visible target is.
+     * for it — the published-only restriction plus the bound read scopes.
+     *
+     * **One definition**, and that is the load-bearing part. Every path that
+     * reads a target goes through it: the row read (`refsFor`), the windowed
+     * link reads whose `count(*) over` must not over-report, and the sub-select
+     * the join-table reads restrict their window by. So `items` and `total`
+     * cannot disagree about what a visible target is — which is exactly what
+     * they did while the read scopes were applied only when *hydrating* the
+     * items: a reader denied three of five linked records saw two items under a
+     * `total` of five, and could infer three restricted records existed.
      */
     private targetVisibleWhere;
+    /**
+     * The bound read scopes' fragments for a relation's **target** type, on a
+     * public read.
+     *
+     * Asked about the target rather than the type the request named: a reader
+     * allowed to see an article is not thereby allowed to see everything it
+     * points at, and a scope keyed to the source would leave every target
+     * unguarded.
+     *
+     * Gated on `publishedOnly`, which is the flag that marks a public read. The
+     * admin's calls pass no visibility and are untouched — an editor must see
+     * the records their entry links to in order to manage them, including ones
+     * no reader may fetch.
+     */
+    private readScopeWhere;
     /**
      * The id sub-select of a target's visible rows — how a link read that reads
      * only the JOIN table (so has no target columns of its own) restricts to

package/dist/lib/entries/infrastructure/persistence/relation-link.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relation-link.service.d.ts","sourceRoot":"","sources":["../../../../../src/lib/entries/infrastructure/persistence/relation-link.service.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAEH,KAAK,cAAc,EAEtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,KAAK,EACR,aAAa,EACb,iBAAiB,EACjB,WAAW,EACd,MAAM,6BAA6B,CAAC;AAMrC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAC5B,IAAI,EAAE,GAAG,EAAE,EACX,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GAAG,SAAS,GACjC,IAAI,CAcN;AASD,wEAAwE;AACxE,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;;;;;GASG;AACH,MAAM,WAAW,wBAAwB;IACrC,gEAAgE;IAChE,aAAa,CAAC,EAAE,OAAO,CAAC;CAC3B;AAqBD;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,CAClC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC,CAAC,CAAC,CAAC;AAEL;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AA0BnD;;;;;;;;;;;;GAYG;AACH,qBACa,mBAAmB;IACE,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ;IAI3D;;;;;;;;;OASG;IACG,OAAO,CACT,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,QAAQ,SAAqB,GAC9B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IA2C7C;;;;;;;;;;;;;;;;;OAiBG;IACG,iBAAiB,CACnB,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,MAAM,EAAE,EAChB,IAAI,EAAE,GAAG,EAAE,EACX,WAAW,EAAE,MAAM,EACnB,QAAQ,SAAqB,EAC7B,UAAU,CAAC,EAAE,wBAAwB,GACtC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAsD1D;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IA2CpB;;;;;OAKG;YACW,aAAa;IAgD3B;;;;;OAKG;YACW,WAAW;IA6DzB;;;;OAIG;YACW,cAAc;IAsD5B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IA0BpB;;;;;OAKG;IACG,SAAS,CACX,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,wBAAwB,GACtC,OAAO,CAAC,iBAAiB,CAAC;IAgG7B;;;;;;;;;;;OAWG;IACG,aAAa,CACf,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,GACT,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAqBpC;;;;;;;OAOG;IACG,UAAU,CACZ,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,aAAa,EACpB,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC;IA8GhB;;;;;;;;;OASG;IACG,UAAU,CACZ,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC;IA+ChB;;;;;;OAMG;IACG,UAAU,CACZ,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,YAAY,EAClB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC;IAgClB;;;;;;OAMG;YACW,UAAU;IAWxB,sEAAsE;YACxD,YAAY;IAc1B;;;;;;;;OAQG;IACG,WAAW,CACb,MAAM,EAAE,cAAc,EACtB,GAAG,EAAE,SAAS,MAAM,EAAE,EACtB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,GACZ,OAAO,CAAC,WAAW,EAAE,CAAC;IAIzB;;;;;;OAMG;YACW,OAAO;IA6BrB;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAe1B;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;IAUjC,kDAAkD;IAClD,OAAO,CAAC,QAAQ;IAWhB;;;;;;;;;;;;;;OAcG;IACG,mBAAmB,CACrB,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,MAAM,EAAE,EAClB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IA+C/B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,qBAAqB,CACvB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,cAAc,EACtB,GAAG,EAAE,SAAS,MAAM,EAAE,EACtB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IA+D5C;;;;;;;;;;;OAWG;IACG,YAAY,CACd,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,SAAS,MAAM,EAAE,GAC7B,OAAO,CAAC,OAAO,CAAC;IAyCnB;;;;;OAKG;IACG,SAAS,CACX,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,EAAE,CAAC;IAapB,wEAAwE;YAC1D,oBAAoB;IA+BlC;;;;;;;;;;;;;;;;;;OAkBG;YACW,aAAa;IAqC3B;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IA8BnB;;;;OAIG;IACH,OAAO,CAAC,cAAc;CAezB"}
+{"version":3,"file":"relation-link.service.d.ts","sourceRoot":"","sources":["../../../../../src/lib/entries/infrastructure/persistence/relation-link.service.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAEH,KAAK,cAAc,EAEtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,KAAK,EACR,aAAa,EACb,iBAAiB,EACjB,WAAW,EACd,MAAM,6BAA6B,CAAC;AAMrC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAC5B,IAAI,EAAE,GAAG,EAAE,EACX,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GAAG,SAAS,GACjC,IAAI,CAcN;AASD,wEAAwE;AACxE,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;;;;;GASG;AACH,MAAM,WAAW,wBAAwB;IACrC;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CAC3B;AAqBD;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,CAClC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC,CAAC,CAAC,CAAC;AAEL;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AA0BnD;;;;;;;;;;;;GAYG;AACH,qBACa,mBAAmB;IAEN,OAAO,CAAC,QAAQ,CAAC,EAAE;IAMrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;gBANO,EAAE,EAAE,QAAQ,EAM9B,UAAU,CAAC,EAAE,wBAAwB,YAAA;IAK1D;;;;;;;;;OASG;IACG,OAAO,CACT,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,QAAQ,SAAqB,GAC9B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IA2C7C;;;;;;;;;;;;;;;;;OAiBG;IACG,iBAAiB,CACnB,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,MAAM,EAAE,EAChB,IAAI,EAAE,GAAG,EAAE,EACX,WAAW,EAAE,MAAM,EACnB,QAAQ,SAAqB,EAC7B,UAAU,CAAC,EAAE,wBAAwB,GACtC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAsD1D;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IA2CpB;;;;;OAKG;YACW,aAAa;IAgD3B;;;;;OAKG;YACW,WAAW;IA6DzB;;;;OAIG;YACW,cAAc;IAsD5B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IA0BpB;;;;;OAKG;IACG,SAAS,CACX,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,wBAAwB,GACtC,OAAO,CAAC,iBAAiB,CAAC;IAgG7B;;;;;;;;;;;OAWG;IACG,aAAa,CACf,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,GACT,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAqBpC;;;;;;;OAOG;IACG,UAAU,CACZ,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,aAAa,EACpB,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC;IA8GhB;;;;;;;;;OASG;IACG,UAAU,CACZ,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC;IA+ChB;;;;;;OAMG;IACG,UAAU,CACZ,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,YAAY,EAClB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC;IAgClB;;;;;;OAMG;YACW,UAAU;IAWxB,sEAAsE;YACxD,YAAY;IAc1B;;;;;;;;OAQG;IACG,WAAW,CACb,MAAM,EAAE,cAAc,EACtB,GAAG,EAAE,SAAS,MAAM,EAAE,EACtB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,GACZ,OAAO,CAAC,WAAW,EAAE,CAAC;IAIzB;;;;;;OAMG;YACW,OAAO;IA6BrB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,kBAAkB;IAgB1B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,cAAc;IAStB;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAexB;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;IAUjC,kDAAkD;IAClD,OAAO,CAAC,QAAQ;IAWhB;;;;;;;;;;;;;;OAcG;IACG,mBAAmB,CACrB,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,MAAM,EAAE,EAClB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IA+C/B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,qBAAqB,CACvB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,cAAc,EACtB,GAAG,EAAE,SAAS,MAAM,EAAE,EACtB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IA+D5C;;;;;;;;;;;OAWG;IACG,YAAY,CACd,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,SAAS,MAAM,EAAE,GAC7B,OAAO,CAAC,OAAO,CAAC;IAyCnB;;;;;OAKG;IACG,SAAS,CACX,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,EAAE,CAAC;IAapB,wEAAwE;YAC1D,oBAAoB;IA+BlC;;;;;;;;;;;;;;;;;;OAkBG;YACW,aAAa;IAqC3B;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IA8BnB;;;;OAIG;IACH,OAAO,CAAC,cAAc;CAezB"}

package/dist/lib/entries/infrastructure/persistence/relation-link.service.js

@@ -8,6 +8,7 @@ const drizzle_orm_1 = require("drizzle-orm");
 const database_1 = require("@orthacms/database");
 const content_type_1 = require("../../../types/content-type");
 const fields_1 = require("../../../types/fields");
+const read_scope_1 = require("../../../extension/read-scope");
 const entry_row_1 = require("./entry-row");
 /**
  * Reject any target row that lives in a different locale from the source.
@@ -76,8 +77,10 @@ const RELATION_APPEND_LOCK_CLASS = 0x524c; // 'RL'
  */
 let RelationLinkService = class RelationLinkService {
     db;
-    constructor(db) {
+    readScopes;
+    constructor(db, readScopes) {
         this.db = db;
+        this.readScopes = readScopes;
     }
     // ---- reads -------------------------------------------------------------
     /**
@@ -644,15 +647,41 @@ let RelationLinkService = class RelationLinkService {
     /**
      * The visibility predicate applied to a relation's target rows: the
      * workspace scope, the soft-delete guard, and — only when the caller asks
-     * for it — the published-only restriction. One definition, so the row read
-     * (`refsFor`) and the windowed link reads that must *count* correctly can't
-     * disagree on what a visible target is.
+     * for it — the published-only restriction plus the bound read scopes.
+     *
+     * **One definition**, and that is the load-bearing part. Every path that
+     * reads a target goes through it: the row read (`refsFor`), the windowed
+     * link reads whose `count(*) over` must not over-report, and the sub-select
+     * the join-table reads restrict their window by. So `items` and `total`
+     * cannot disagree about what a visible target is — which is exactly what
+     * they did while the read scopes were applied only when *hydrating* the
+     * items: a reader denied three of five linked records saw two items under a
+     * `total` of five, and could infer three restricted records existed.
      */
     targetVisibleWhere(target, workspaceId, visibility) {
         const cols = target.table;
         return (0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(cols['workspaceId'], workspaceId), cols['deletedAt'] ? (0, drizzle_orm_1.isNull)(cols['deletedAt']) : undefined, visibility?.publishedOnly && target.publishable
             ? (0, drizzle_orm_1.eq)(cols['status'], content_type_1.ENTRY_STATUS.Published)
-            : undefined);
+            : undefined, ...this.readScopeWhere(target, workspaceId, visibility));
+    }
+    /**
+     * The bound read scopes' fragments for a relation's **target** type, on a
+     * public read.
+     *
+     * Asked about the target rather than the type the request named: a reader
+     * allowed to see an article is not thereby allowed to see everything it
+     * points at, and a scope keyed to the source would leave every target
+     * unguarded.
+     *
+     * Gated on `publishedOnly`, which is the flag that marks a public read. The
+     * admin's calls pass no visibility and are untouched — an editor must see
+     * the records their entry links to in order to manage them, including ones
+     * no reader may fetch.
+     */
+    readScopeWhere(target, workspaceId, visibility) {
+        if (!visibility?.publishedOnly)
+            return [];
+        return this.readScopes?.fragments({ type: target, workspaceId }) ?? [];
     }
     /**
      * The id sub-select of a target's visible rows — how a link read that reads
@@ -661,6 +690,8 @@ let RelationLinkService = class RelationLinkService {
      * when no extra restriction applies, so the predicate collapses away.
      */
     visibleTargetIds(target, workspaceId, visibility) {
+        // `publishedOnly` is the public-read marker, so it also gates the read
+        // scopes (see {@link targetVisibleWhere}) — one check covers both.
         if (!visibility?.publishedOnly)
             return undefined;
         const cols = target.table;
@@ -981,7 +1012,8 @@ exports.RelationLinkService = RelationLinkService;
 exports.RelationLinkService = RelationLinkService = tslib_1.__decorate([
     (0, common_1.Injectable)(),
     tslib_1.__param(0, (0, database_1.InjectDatabase)()),
-    tslib_1.__metadata("design:paramtypes", [Object])
+    tslib_1.__param(1, (0, common_1.Optional)()),
+    tslib_1.__metadata("design:paramtypes", [Object, read_scope_1.ContentReadScopeRegistry])
 ], RelationLinkService);
 /**
  * The composite map key for "this translation group, in this locale".

package/dist/lib/entries/infrastructure/queries/entries.service.d.ts

@@ -1,5 +1,6 @@
 import { type Database } from '@orthacms/database';
 import { type ContentEntryExtension } from '../../../extension/entry-extension';
+import { EntryFilterProviderRegistry } from '../../../extension/entry-filter-provider';
 import type { AnyContentType } from '../../../types/content-type';
 import { type ListEntriesQueryDto } from '../../http/dto/list-entries-query.dto';
 import type { EntryListView } from '../../types/entry-list-view';
@@ -14,8 +15,9 @@ import { RelationLinkService } from '../persistence/relation-link.service';
 export declare class EntriesService {
     private readonly db;
     private readonly relationLinks;
+    private readonly filterProviders;
     private readonly extension?;
-    constructor(db: Database, relationLinks: RelationLinkService, extension?: ContentEntryExtension | undefined);
+    constructor(db: Database, relationLinks: RelationLinkService, filterProviders: EntryFilterProviderRegistry, extension?: ContentEntryExtension | undefined);
     /**
      * One page of a collection's entries: search → filter → sort → paginate, run
      * in SQL against the type's generated table, returned as the

package/dist/lib/entries/infrastructure/queries/entries.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entries.service.d.ts","sourceRoot":"","sources":["../../../../../src/lib/entries/infrastructure/queries/entries.service.ts"],"names":[],"mappings":"AAYA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,EAEH,KAAK,qBAAqB,EAE7B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAGH,KAAK,mBAAmB,EAC3B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAMjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AA+B3E;;;;;;GAMG;AACH,qBACa,cAAc;IAED,OAAO,CAAC,QAAQ,CAAC,EAAE;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAK9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBANQ,EAAE,EAAE,QAAQ,EAC9B,aAAa,EAAE,mBAAmB,EAKlC,SAAS,CAAC,EAAE,qBAAqB,YAAA;IAGtD;;;;;;OAMG;IACG,IAAI,CACN,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,mBAAmB,EAC1B,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,aAAa,CAAC;IAgDzB;;;;;;;OAOG;YACW,SAAS;IA0CvB;;;;;;;OAOG;YACW,eAAe;IAyB7B;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAWxB;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;CAsBlB"}
+{"version":3,"file":"entries.service.d.ts","sourceRoot":"","sources":["../../../../../src/lib/entries/infrastructure/queries/entries.service.ts"],"names":[],"mappings":"AAYA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,EAEH,KAAK,qBAAqB,EAE7B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAGH,KAAK,mBAAmB,EAC3B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAMjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AA+B3E;;;;;;GAMG;AACH,qBACa,cAAc;IAED,OAAO,CAAC,QAAQ,CAAC,EAAE;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAI9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAKhC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAVQ,EAAE,EAAE,QAAQ,EAC9B,aAAa,EAAE,mBAAmB,EAIlC,eAAe,EAAE,2BAA2B,EAK5C,SAAS,CAAC,EAAE,qBAAqB,YAAA;IAGtD;;;;;;OAMG;IACG,IAAI,CACN,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,mBAAmB,EAC1B,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,aAAa,CAAC;IAgDzB;;;;;;;OAOG;YACW,SAAS;IAiDvB;;;;;;;OAOG;YACW,eAAe;IAyB7B;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAWxB;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;CAsBlB"}

package/dist/lib/entries/infrastructure/queries/entries.service.js

@@ -7,6 +7,7 @@ const drizzle_orm_1 = require("drizzle-orm");
 const database_1 = require("@orthacms/database");
 const utils_server_1 = require("@orthacms/utils-server");
 const entry_extension_1 = require("../../../extension/entry-extension");
+const entry_filter_provider_1 = require("../../../extension/entry-filter-provider");
 const fields_1 = require("../../../types/fields");
 const list_entries_query_dto_1 = require("../../http/dto/list-entries-query.dto");
 const entries_constants_1 = require("../../entries.constants");
@@ -43,10 +44,16 @@ function previewFields(type, raw) {
 let EntriesService = class EntriesService {
     db;
     relationLinks;
+    filterProviders;
     extension;
-    constructor(db, relationLinks, extension) {
+    constructor(db, relationLinks, 
+    // Virtual filter fields contributed by plugins other than the single
+    // bound extension — segments' audience fields today. A registry rather
+    // than a token, for the reason its own file documents.
+    filterProviders, extension) {
         this.db = db;
         this.relationLinks = relationLinks;
+        this.filterProviders = filterProviders;
         this.extension = extension;
     }
     /**
@@ -105,7 +112,11 @@ let EntriesService = class EntriesService {
         // into the schema, resolved to its own SQL) and an extra scope
         // predicate (e.g. the active locale). Both are no-ops for types the
         // extension doesn't apply to.
-        const filterExtension = this.extension?.filterExtension(type);
+        // The bound extension (i18n) plus every registered provider (segments'
+        // audience fields), folded into one contribution — see
+        // `EntryFilterProviderRegistry`, which exists because that port is a
+        // single binding and a second plugin would otherwise replace it.
+        const filterExtension = this.filterProviders.compose(type, this.extension?.filterExtension(type));
         // Building the surface walks the type's whole relation graph to the
         // hop budget, so only pay for it when there is actually a filter to
         // translate — an unfiltered list (the common case) skips it entirely.
@@ -196,7 +207,8 @@ exports.EntriesService = EntriesService;
 exports.EntriesService = EntriesService = tslib_1.__decorate([
     (0, common_1.Injectable)(),
     tslib_1.__param(0, (0, database_1.InjectDatabase)()),
-    tslib_1.__param(2, (0, common_1.Optional)()),
-    tslib_1.__param(2, (0, common_1.Inject)(entry_extension_1.CONTENT_ENTRY_EXTENSION)),
-    tslib_1.__metadata("design:paramtypes", [Object, relation_link_service_1.RelationLinkService, Object])
+    tslib_1.__param(3, (0, common_1.Optional)()),
+    tslib_1.__param(3, (0, common_1.Inject)(entry_extension_1.CONTENT_ENTRY_EXTENSION)),
+    tslib_1.__metadata("design:paramtypes", [Object, relation_link_service_1.RelationLinkService,
+        entry_filter_provider_1.EntryFilterProviderRegistry, Object])
 ], EntriesService);

package/dist/lib/entries/infrastructure/queries/entry-match.query.d.ts

@@ -0,0 +1,82 @@
+import { type Database } from '@orthacms/database';
+import { type ContentEntryExtension } from '../../../extension/entry-extension';
+import { EntryFilterProviderRegistry } from '../../../extension/entry-filter-provider';
+import type { AnyContentType } from '../../../types/content-type';
+/** Options narrowing a {@link EntryMatchQuery.matchingIds} scan. */
+export interface EntryMatchOptions {
+    /**
+     * Restrict the scan to these entry ids. This is what turns a
+     * collection-wide predicate into the point check an event-driven caller
+     * needs — "does *this* row match?" is the same SQL with an extra
+     * `id IN (...)`, so one code path serves both and they cannot disagree
+     * about what a filter means.
+     */
+    entryIds?: readonly string[];
+    /** Upper bound on returned ids. */
+    limit?: number;
+    /** Rows to skip — for batching a full-collection scan. */
+    offset?: number;
+}
+/**
+ * Answers "which entries of this type match this filter?" against the same
+ * surface, parser and translator the records list uses.
+ *
+ * It exists so a downstream plugin can reuse content's filter semantics
+ * without reaching for the database or rebuilding the surface: the filterable
+ * paths, the relation-hop budget, the workspace scoping of every relation
+ * subquery, and the 400 on a malformed tree are all inherited rather than
+ * re-implemented. `@orthacms/alarms-server` evaluates its rules through this,
+ * which is what makes "the rule I saved from the list means what the list
+ * showed me" true by construction rather than by review.
+ *
+ * Two deliberate differences from the list query:
+ *
+ * - **No locale scoping.** The entries extension's `listScope` narrows a list
+ *   to the active locale; a rule is a statement about the collection, so it
+ *   must see every translation. The extension's *virtual filter fields* are
+ *   still wired, so a rule may filter on them explicitly.
+ * - **Trashed rows are excluded, always.** There is no trash view here, and a
+ *   tombstoned row is not something anyone can act on.
+ */
+export declare class EntryMatchQuery {
+    private readonly db;
+    private readonly filterProviders;
+    private readonly extension?;
+    constructor(db: Database, filterProviders: EntryFilterProviderRegistry, extension?: ContentEntryExtension | undefined);
+    /**
+     * Parses `filter` against `type`'s surface without running it, throwing a
+     * `FilterException` when it does not hold up. Callers store filters that
+     * will be replayed by a background subscriber for months, so the parse
+     * belongs at the moment the filter is written — a tree that only fails at
+     * evaluation time fails somewhere nobody is looking.
+     */
+    assertParses(type: AnyContentType, filter: unknown, workspaceId: string): void;
+    /**
+     * Ids of `type` in `workspaceId` matching `filter`, oldest-id first so a
+     * batched scan is stable across calls.
+     */
+    matchingIds(type: AnyContentType, filter: unknown, workspaceId: string, options?: EntryMatchOptions): Promise<string[]>;
+    /** How many entries of `type` match `filter` right now. */
+    countMatching(type: AnyContentType, filter: unknown, workspaceId: string): Promise<number>;
+    /**
+     * How many entries of `type` the workspace holds at all — the denominator
+     * the rule editor shows beside a match count ("14 of 312"), which is what
+     * turns a number into a judgement about whether the rule is too broad.
+     */
+    countAll(type: AnyContentType, workspaceId: string): Promise<number>;
+    /**
+     * The workspace an entry belongs to, or `null` when no such row exists.
+     *
+     * A domain event names an entry and its content type but not its workspace
+     * — every content table carries its own `workspace_id`, so there is nothing
+     * for the envelope to add that a one-column lookup cannot answer. Exposed
+     * here rather than left to each subscriber, so a downstream plugin never
+     * has a reason to query a `content_<name>` table directly.
+     */
+    workspaceOf(type: AnyContentType, entryId: string): Promise<string | null>;
+    /** The workspace + not-trashed guard every scan starts from. */
+    private scope;
+    /** Scope + translated filter + optional id restriction. */
+    private predicate;
+}
+//# sourceMappingURL=entry-match.query.d.ts.map

package/dist/lib/entries/infrastructure/queries/entry-match.query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-match.query.d.ts","sourceRoot":"","sources":["../../../../../src/lib/entries/infrastructure/queries/entry-match.query.ts"],"names":[],"mappings":"AAGA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,EAEH,KAAK,qBAAqB,EAC7B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAalE,oEAAoE;AACpE,MAAM,WAAW,iBAAiB;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBACa,eAAe;IAEF,OAAO,CAAC,QAAQ,CAAC,EAAE;IAIrC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAGhC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAPQ,EAAE,EAAE,QAAQ,EAI9B,eAAe,EAAE,2BAA2B,EAG5C,SAAS,CAAC,EAAE,qBAAqB,YAAA;IAGtD;;;;;;OAMG;IACH,YAAY,CACR,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,MAAM,GACpB,IAAI;IAWP;;;OAGG;IACG,WAAW,CACb,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,iBAAsB,GAChC,OAAO,CAAC,MAAM,EAAE,CAAC;IAmBpB,2DAA2D;IACrD,aAAa,CACf,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC;IASlB;;;;OAIG;IACG,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ1E;;;;;;;;OAQG;IACG,WAAW,CACb,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUzB,gEAAgE;IAChE,OAAO,CAAC,KAAK;IAQb,2DAA2D;YAC7C,SAAS;CAoC1B"}