@orthacms/content-server 0.4.2 → 0.4.3

package/dist/lib/extension/read-scope.js

@@ -0,0 +1,131 @@
+"use strict";
+/**
+ * The **read scope port** — the seam a downstream plugin uses to narrow what
+ * the public content API returns, without this package knowing why.
+ *
+ * Content-server declares the port and consults it from `PublicEntriesQuery`
+ * and `PublicExpansionQuery`; an implementing plugin
+ * (`@orthacms/segments-server`, for reader entitlements) registers a scope
+ * through {@link contentReadScopeRegistrar}. Every fragment returned is AND-ed
+ * onto the visibility predicate the public read already states, so a scope can
+ * only ever *subtract* rows — there is no shape of return value that widens a
+ * read.
+ *
+ * ## Why a registry rather than a DI token
+ *
+ * The port takes any number of independent narrowings, and Nest has **no
+ * multi-provider**: two dynamic modules binding the same token do not merge,
+ * the second silently replaces the first. A second scoping plugin would
+ * therefore switch the first one off, with nothing to notice it — which for a
+ * visibility rule means content quietly becoming visible. So registration is a
+ * runtime `register(...)` call against a registry this module owns, the same
+ * shape and the same reason as `copilotToolsRegistrar`.
+ *
+ * ## Why not `CONTENT_ENTRY_EXTENSION`
+ *
+ * That port is documented as a **single binding**: one provider per app, and
+ * i18n already holds it. Its own note suggests binding a composite when a
+ * second extension appears, and for a write-pipeline extension that composes
+ * cleanly — but "narrow a read" and "extend a write" are different
+ * responsibilities with different failure modes. A composite would fuse i18n
+ * and entitlements into one provider, where a fault in either silently drops
+ * the other's clause.
+ *
+ * ## Two constraints on an implementation
+ *
+ * **Synchronous.** The predicate is assembled inside the query builder, and
+ * making that path async would ripple through every public read for the benefit
+ * of one provider. A scope that needs I/O — resolving who the caller is, say —
+ * must do it earlier in the request (a guard, an interceptor, middleware) and
+ * read the result from its own request-scoped state here.
+ *
+ * **Public reads only.** These fragments are not applied to the admin's own
+ * entries list. An admin caller is a member of the workspace looking at their
+ * own CMS, while a reader entitlement is about who may *consume* published
+ * content, and scoping the editor's list by it would hide from an author the
+ * very rows they are responsible for. The same split content grants already
+ * make.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContentReadScopeRegistry = void 0;
+exports.contentReadScopeRegistrar = contentReadScopeRegistrar;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+/**
+ * Every registered narrowing, in registration order.
+ *
+ * Order does not affect the result — the fragments are AND-ed — but it is kept
+ * stable so a query log reads the same way twice.
+ */
+let ContentReadScopeRegistry = class ContentReadScopeRegistry {
+    scopes = [];
+    /** Adds a scope. Registering the same instance twice is a no-op. */
+    register(scope) {
+        if (!this.scopes.includes(scope)) {
+            this.scopes.push(scope);
+        }
+    }
+    /** Every registered scope. Empty on an installation with none. */
+    all() {
+        return this.scopes;
+    }
+    /**
+     * The fragments for one read, ready to be spread into `and(...)`.
+     *
+     * Returns an empty array — not a fragment matching everything — when
+     * nothing is registered, which is the state every installation without a
+     * scoping plugin stays in.
+     */
+    fragments(context) {
+        if (!this.scopes.length) {
+            return [];
+        }
+        return this.scopes.map((scope) => scope.scope(context));
+    }
+};
+exports.ContentReadScopeRegistry = ContentReadScopeRegistry;
+exports.ContentReadScopeRegistry = ContentReadScopeRegistry = tslib_1.__decorate([
+    (0, common_1.Injectable)()
+], ContentReadScopeRegistry);
+/** Registers a plugin's read scopes with content at bootstrap. */
+class ReadScopeBootstrapper {
+    label;
+    registry;
+    scopes;
+    logger = new common_1.Logger(ReadScopeBootstrapper.name);
+    constructor(label, registry, scopes) {
+        this.label = label;
+        this.registry = registry;
+        this.scopes = scopes;
+    }
+    onApplicationBootstrap() {
+        // A deployment that does not register `ContentPlugin` is not a real
+        // configuration, but a binding plugin should still boot rather than
+        // fail on an injection it cannot influence.
+        if (!this.registry) {
+            return;
+        }
+        for (const scope of this.scopes) {
+            this.registry.register(scope);
+        }
+        this.logger.log(`Registered the ${this.label} read scope with the content API.`);
+    }
+}
+/**
+ * Builds the DI provider that registers `scopes` with content's read-scope
+ * registry at bootstrap.
+ *
+ * A factory with an explicit `inject` list rather than a class with reflected
+ * parameters, for the reason `copilotToolsRegistrar` documents: an optional
+ * dependency typed as `Foo | null` emits `Object` for `design:paramtypes`, Nest
+ * injects `undefined` with no error, and the plugin ends up registering
+ * nothing. Here that failure would mean a visibility rule that silently stopped
+ * being applied.
+ */
+function contentReadScopeRegistrar(label, ...scopes) {
+    return {
+        provide: `CONTENT_READ_SCOPE_REGISTRAR_${label.toUpperCase()}`,
+        useFactory: (registry, ...resolved) => new ReadScopeBootstrapper(label, registry, resolved),
+        inject: [{ token: ContentReadScopeRegistry, optional: true }, ...scopes]
+    };
+}

package/dist/lib/public-api/infrastructure/public-entries.query.d.ts

@@ -1,5 +1,6 @@
 import { type Database } from '@orthacms/database';
 import { type ContentEntryExtension } from '../../extension/entry-extension';
+import { ContentReadScopeRegistry } from '../../extension/read-scope';
 import { type AnyContentType } from '../../types/content-type';
 import { RelationLinkService } from '../../entries/infrastructure/persistence/relation-link.service';
 import type { PublicMediaFieldView, PublicRelationFieldView } from '../types/public-expansion';
@@ -49,7 +50,8 @@ export declare class PublicEntriesQuery {
     private readonly expansion;
     private readonly relationLinks;
     private readonly extension?;
-    constructor(db: Database, expansion: PublicExpansionQuery, relationLinks: RelationLinkService, extension?: ContentEntryExtension | undefined);
+    private readonly readScopes?;
+    constructor(db: Database, expansion: PublicExpansionQuery, relationLinks: RelationLinkService, extension?: ContentEntryExtension | undefined, readScopes?: ContentReadScopeRegistry | undefined);
     /**
      * One page of a type's publicly readable entries. Count and page share the
      * WHERE and run concurrently, so the request pays the slower of the two.
@@ -225,6 +227,17 @@ export declare class PublicEntriesQuery {
      * visibility rule in exactly one respect and inherits the rest verbatim.
      */
     private liveWhere;
+    /**
+     * The fragments contributed by the bound `CONTENT_READ_SCOPE` providers.
+     *
+     * Applied here, in {@link liveWhere}, rather than in `readableWhere`: this
+     * is the clause every public read shares — the list, the single-entry read
+     * and the translation lookup that deliberately steps around the locale
+     * scope all pass through it — so a scope cannot be missed by a read that
+     * chose the narrower helper. AND-ed like everything else around them, which
+     * is what makes a scope structurally incapable of widening a read.
+     */
+    private readScopeWhere;
     /**
      * The publish-state clause. `published` — the default and everything a
      * read-only token can ask for — is the API's headline rule; the other two

package/dist/lib/public-api/infrastructure/public-entries.query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public-entries.query.d.ts","sourceRoot":"","sources":["../../../../src/lib/public-api/infrastructure/public-entries.query.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,EAEH,KAAK,qBAAqB,EAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gEAAgE,CAAC;AACrG,OAAO,KAAK,EACR,oBAAoB,EACpB,uBAAuB,EAC1B,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,EAGH,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EACjC,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAc9E;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAClB;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACvB;IAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBACa,kBAAkB;IAEL,OAAO,CAAC,QAAQ,CAAC,EAAE;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAK9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAPQ,EAAE,EAAE,QAAQ,EAC9B,SAAS,EAAE,oBAAoB,EAC/B,aAAa,EAAE,mBAAmB,EAKlC,SAAS,CAAC,EAAE,qBAAqB,YAAA;IAGtD;;;OAGG;IACG,IAAI,CACN,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,yBAAyB,EAChC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,GAClC,OAAO,CAAC,mBAAmB,CAAC;IAiE/B;;;;;OAKG;YACW,gBAAgB;IAqE9B;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAWzB,0EAA0E;IAC1E,OAAO,CAAC,eAAe;IAQvB;;;;;;;;;;;;;;OAcG;YACW,sBAAsB;IAqDpC;;;;;OAKG;IACG,cAAc,CAChB,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,YAAY,EACrB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,mBAAmB,GAC3B,OAAO,CAAC,WAAW,EAAE,CAAC;IAoBzB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,UAAU;IAyClB;;;;;;;;;;;;;;;;OAgBG;IACG,MAAM,CACR,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,YAAY,EACrB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,mBAAmB,EAC1B,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,GAClC,OAAO,CAAC,WAAW,CAAC;IA0DvB;;;;;;;;;;;;;;OAcG;IACG,kBAAkB,CACpB,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,YAAY,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQnC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,OAAO,CAAC,UAAU;IA6BlB,mEAAmE;IACnE,OAAO,CAAC,WAAW;IAMnB;;;;OAIG;IACG,aAAa,CACf,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,YAAY,EACrB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,EACjC,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,eAAe,GAC7B,OAAO,CAAC,uBAAuB,CAAC;IAyCnC,yEAAyE;IACnE,OAAO,CACT,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,YAAY,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,SAA0B,EAC/B,UAAU,CAAC,EAAE,eAAe,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAyBhD;;;;;OAKG;YACW,WAAW;IAoBzB;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,eAAe;IAoB7B;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAcrB;;;;;;OAMG;IACH,OAAO,CAAC,SAAS;IAajB;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;IAcnB;;;;;;;OAOG;IACH,OAAO,CAAC,OAAO;CAmBlB"}
+{"version":3,"file":"public-entries.query.d.ts","sourceRoot":"","sources":["../../../../src/lib/public-api/infrastructure/public-entries.query.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,EAEH,KAAK,qBAAqB,EAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gEAAgE,CAAC;AACrG,OAAO,KAAK,EACR,oBAAoB,EACpB,uBAAuB,EAC1B,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,EAGH,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EACjC,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAc9E;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAClB;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACvB;IAAE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBACa,kBAAkB;IAEL,OAAO,CAAC,QAAQ,CAAC,EAAE;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAK9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAK3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAZO,EAAE,EAAE,QAAQ,EAC9B,SAAS,EAAE,oBAAoB,EAC/B,aAAa,EAAE,mBAAmB,EAKlC,SAAS,CAAC,EAAE,qBAAqB,YAAA,EAKjC,UAAU,CAAC,EAAE,wBAAwB,YAAA;IAG1D;;;OAGG;IACG,IAAI,CACN,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,yBAAyB,EAChC,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,GAClC,OAAO,CAAC,mBAAmB,CAAC;IAiE/B;;;;;OAKG;YACW,gBAAgB;IAqE9B;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAWzB,0EAA0E;IAC1E,OAAO,CAAC,eAAe;IAQvB;;;;;;;;;;;;;;OAcG;YACW,sBAAsB;IAqDpC;;;;;OAKG;IACG,cAAc,CAChB,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,YAAY,EACrB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,mBAAmB,GAC3B,OAAO,CAAC,WAAW,EAAE,CAAC;IAoBzB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,UAAU;IAyClB;;;;;;;;;;;;;;;;OAgBG;IACG,MAAM,CACR,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,YAAY,EACrB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,mBAAmB,EAC1B,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,GAClC,OAAO,CAAC,WAAW,CAAC;IA0DvB;;;;;;;;;;;;;;OAcG;IACG,kBAAkB,CACpB,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,YAAY,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAQnC;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,OAAO,CAAC,UAAU;IA6BlB,mEAAmE;IACnE,OAAO,CAAC,WAAW;IAMnB;;;;OAIG;IACG,aAAa,CACf,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,YAAY,EACrB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,EACjC,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,eAAe,GAC7B,OAAO,CAAC,uBAAuB,CAAC;IAyCnC,yEAAyE;IACnE,OAAO,CACT,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,YAAY,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,MAAM,EACf,KAAK,SAA0B,EAC/B,UAAU,CAAC,EAAE,eAAe,GAC7B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAyBhD;;;;;OAKG;YACW,WAAW;IAoBzB;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,eAAe;IAoB7B;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAcrB;;;;;;OAMG;IACH,OAAO,CAAC,SAAS;IAcjB;;;;;;;;;OASG;IACH,OAAO,CAAC,cAAc;IAOtB;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;IAcnB;;;;;;;OAOG;IACH,OAAO,CAAC,OAAO;CAmBlB"}

package/dist/lib/public-api/infrastructure/public-entries.query.js

@@ -7,6 +7,7 @@ const drizzle_orm_1 = require("drizzle-orm");
 const database_1 = require("@orthacms/database");
 const utils_server_1 = require("@orthacms/utils-server");
 const entry_extension_1 = require("../../extension/entry-extension");
+const read_scope_1 = require("../../extension/read-scope");
 const content_type_1 = require("../../types/content-type");
 const fields_1 = require("../../types/fields");
 const relation_link_service_1 = require("../../entries/infrastructure/persistence/relation-link.service");
@@ -48,11 +49,13 @@ let PublicEntriesQuery = class PublicEntriesQuery {
     expansion;
     relationLinks;
     extension;
-    constructor(db, expansion, relationLinks, extension) {
+    readScopes;
+    constructor(db, expansion, relationLinks, extension, readScopes) {
         this.db = db;
         this.expansion = expansion;
         this.relationLinks = relationLinks;
         this.extension = extension;
+        this.readScopes = readScopes;
     }
     /**
      * One page of a type's publicly readable entries. Count and page share the
@@ -500,7 +503,20 @@ let PublicEntriesQuery = class PublicEntriesQuery {
      */
     liveWhere(type, workspaceId, visibility = 'published') {
         const table = type.table;
-        return (0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(table['workspaceId'], workspaceId), this.statusWhere(type, visibility), type.paranoid ? (0, drizzle_orm_1.isNull)(table['deletedAt']) : undefined);
+        return (0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(table['workspaceId'], workspaceId), this.statusWhere(type, visibility), type.paranoid ? (0, drizzle_orm_1.isNull)(table['deletedAt']) : undefined, ...this.readScopeWhere(type, workspaceId));
+    }
+    /**
+     * The fragments contributed by the bound `CONTENT_READ_SCOPE` providers.
+     *
+     * Applied here, in {@link liveWhere}, rather than in `readableWhere`: this
+     * is the clause every public read shares — the list, the single-entry read
+     * and the translation lookup that deliberately steps around the locale
+     * scope all pass through it — so a scope cannot be missed by a read that
+     * chose the narrower helper. AND-ed like everything else around them, which
+     * is what makes a scope structurally incapable of widening a read.
+     */
+    readScopeWhere(type, workspaceId) {
+        return this.readScopes?.fragments({ type, workspaceId }) ?? [];
     }
     /**
      * The publish-state clause. `published` — the default and everything a
@@ -552,6 +568,7 @@ exports.PublicEntriesQuery = PublicEntriesQuery = tslib_1.__decorate([
     tslib_1.__param(0, (0, database_1.InjectDatabase)()),
     tslib_1.__param(3, (0, common_1.Optional)()),
     tslib_1.__param(3, (0, common_1.Inject)(entry_extension_1.CONTENT_ENTRY_EXTENSION)),
+    tslib_1.__param(4, (0, common_1.Optional)()),
     tslib_1.__metadata("design:paramtypes", [Object, public_expansion_query_1.PublicExpansionQuery,
-        relation_link_service_1.RelationLinkService, Object])
+        relation_link_service_1.RelationLinkService, Object, read_scope_1.ContentReadScopeRegistry])
 ], PublicEntriesQuery);

package/dist/lib/public-api/infrastructure/public-expansion.query.d.ts

@@ -1,6 +1,7 @@
 import { type Database } from '@orthacms/database';
 import { type AnyContentType } from '../../types/content-type';
 import { type MediaAssetResolver } from '../../extension/media-asset-resolver';
+import { ContentReadScopeRegistry } from '../../extension/read-scope';
 import { RelationLinkService } from '../../entries/infrastructure/persistence/relation-link.service';
 import type { PublicMediaFieldView, PublicRelationFieldView } from '../types/public-expansion';
 /** A generated content row seen as a bag of values by property name. */
@@ -31,7 +32,16 @@ export declare class PublicExpansionQuery {
     private readonly db;
     private readonly relationLinks;
     private readonly media?;
-    constructor(db: Database, relationLinks: RelationLinkService, media?: MediaAssetResolver | undefined);
+    private readonly readScopes?;
+    constructor(db: Database, relationLinks: RelationLinkService, media?: MediaAssetResolver | undefined, readScopes?: ContentReadScopeRegistry | undefined);
+    /**
+     * The read-scope fragments for one hop's target type.
+     *
+     * The target is a different content type from the one the request named, so
+     * the scope is asked about **it** — a scope keyed to the requested type
+     * would leave every relation target unguarded.
+     */
+    private readScopeWhere;
     /**
      * Validate a `?relationFields=` list: every name must be a relation field
      * on the type, and its target must be a content type the workspace was
@@ -47,9 +57,11 @@ export declare class PublicExpansionQuery {
      * One capped page of links per requested relation field, for every row on
      * the page, keyed by entry id.
      *
-     * `publishedOnly` is the public difference: a draft target is neither shown
-     * nor counted, so `total` is the number of links a caller can actually
-     * reach.
+     * `publishedOnly` is the public difference: a draft target — or one a bound
+     * read scope hides from this reader — is neither shown **nor counted**, so
+     * `total` is the number of links this caller can actually reach. Counting
+     * them would leak the cardinality of what is hidden: "5 links, 2 visible"
+     * says three restricted records exist here.
      */
     relationsForRows(type: AnyContentType, fields: string[], rows: Row[], workspaceId: string, limit?: number): Promise<Map<string, Record<string, PublicRelationFieldView>>>;
     /**

package/dist/lib/public-api/infrastructure/public-expansion.query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public-expansion.query.d.ts","sourceRoot":"","sources":["../../../../src/lib/public-api/infrastructure/public-expansion.query.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE7E,OAAO,EAEH,KAAK,kBAAkB,EAC1B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gEAAgE,CAAC;AAErG,OAAO,KAAK,EACR,oBAAoB,EAEpB,uBAAuB,EAC1B,MAAM,2BAA2B,CAAC;AAInC,wEAAwE;AACxE,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAKnC;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAwCtC;;;;;;;;;;;;GAYG;AACH,qBACa,oBAAoB;IAEP,OAAO,CAAC,QAAQ,CAAC,EAAE;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAG9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAJY,EAAE,EAAE,QAAQ,EAC9B,aAAa,EAAE,mBAAmB,EAGlC,KAAK,CAAC,EAAE,kBAAkB,YAAA;IAG/C;;;;;;;OAOG;IACH,mBAAmB,CACf,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAC7B,MAAM,EAAE;IA8BX,yEAAyE;IACzE,gBAAgB,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE;IAiBzE;;;;;;;OAOG;IACG,gBAAgB,CAClB,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,MAAM,EAAE,EAChB,IAAI,EAAE,GAAG,EAAE,EACX,WAAW,EAAE,MAAM,EACnB,KAAK,SAA0B,GAChC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAyChE;;;;OAIG;IACG,oBAAoB,CACtB,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,EACjE,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAqBnD;;;;;;;;OAQG;YACW,iBAAiB;IAsD/B;;;;;;OAMG;IACG,YAAY,CACd,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,MAAM,EAAE,EAChB,IAAI,EAAE,GAAG,EAAE,EACX,WAAW,EAAE,MAAM,EACnB,KAAK,SAA0B,GAChC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IA+F7D;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe;IAgBvB,4EAA4E;IAC5E,OAAO,CAAC,WAAW;CA+BtB"}
+{"version":3,"file":"public-expansion.query.d.ts","sourceRoot":"","sources":["../../../../src/lib/public-api/infrastructure/public-expansion.query.ts"],"names":[],"mappings":"AASA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE7E,OAAO,EAEH,KAAK,kBAAkB,EAC1B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gEAAgE,CAAC;AAErG,OAAO,KAAK,EACR,oBAAoB,EAEpB,uBAAuB,EAC1B,MAAM,2BAA2B,CAAC;AAInC,wEAAwE;AACxE,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAKnC;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAwCtC;;;;;;;;;;;;GAYG;AACH,qBACa,oBAAoB;IAEP,OAAO,CAAC,QAAQ,CAAC,EAAE;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAG9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAKvB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;gBATO,EAAE,EAAE,QAAQ,EAC9B,aAAa,EAAE,mBAAmB,EAGlC,KAAK,CAAC,EAAE,kBAAkB,YAAA,EAK1B,UAAU,CAAC,EAAE,wBAAwB,YAAA;IAG1D;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAOtB;;;;;;;OAOG;IACH,mBAAmB,CACf,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAC7B,MAAM,EAAE;IA8BX,yEAAyE;IACzE,gBAAgB,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE;IAiBzE;;;;;;;;;OASG;IACG,gBAAgB,CAClB,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,MAAM,EAAE,EAChB,IAAI,EAAE,GAAG,EAAE,EACX,WAAW,EAAE,MAAM,EACnB,KAAK,SAA0B,GAChC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC,CAAC;IA6ChE;;;;OAIG;IACG,oBAAoB,CACtB,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,EACjE,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAqBnD;;;;;;;;OAQG;YACW,iBAAiB;IAuD/B;;;;;;OAMG;IACG,YAAY,CACd,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,MAAM,EAAE,EAChB,IAAI,EAAE,GAAG,EAAE,EACX,WAAW,EAAE,MAAM,EACnB,KAAK,SAA0B,GAChC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IA+F7D;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe;IAgBvB,4EAA4E;IAC5E,OAAO,CAAC,WAAW;CA+BtB"}

package/dist/lib/public-api/infrastructure/public-expansion.query.js

@@ -9,6 +9,7 @@ const content_domain_1 = require("@orthacms/content-domain");
 const content_type_1 = require("../../types/content-type");
 const fields_1 = require("../../types/fields");
 const media_asset_resolver_1 = require("../../extension/media-asset-resolver");
+const read_scope_1 = require("../../extension/read-scope");
 const relation_link_service_1 = require("../../entries/infrastructure/persistence/relation-link.service");
 const public_list_entries_query_dto_1 = require("../http/dto/public-list-entries-query.dto");
 const public_entry_row_1 = require("./public-entry-row");
@@ -73,10 +74,22 @@ let PublicExpansionQuery = class PublicExpansionQuery {
     db;
     relationLinks;
     media;
-    constructor(db, relationLinks, media) {
+    readScopes;
+    constructor(db, relationLinks, media, readScopes) {
         this.db = db;
         this.relationLinks = relationLinks;
         this.media = media;
+        this.readScopes = readScopes;
+    }
+    /**
+     * The read-scope fragments for one hop's target type.
+     *
+     * The target is a different content type from the one the request named, so
+     * the scope is asked about **it** — a scope keyed to the requested type
+     * would leave every relation target unguarded.
+     */
+    readScopeWhere(type, workspaceId) {
+        return this.readScopes?.fragments({ type, workspaceId }) ?? [];
     }
     /**
      * Validate a `?relationFields=` list: every name must be a relation field
@@ -121,9 +134,11 @@ let PublicExpansionQuery = class PublicExpansionQuery {
      * One capped page of links per requested relation field, for every row on
      * the page, keyed by entry id.
      *
-     * `publishedOnly` is the public difference: a draft target is neither shown
-     * nor counted, so `total` is the number of links a caller can actually
-     * reach.
+     * `publishedOnly` is the public difference: a draft target — or one a bound
+     * read scope hides from this reader — is neither shown **nor counted**, so
+     * `total` is the number of links this caller can actually reach. Counting
+     * them would leak the cardinality of what is hidden: "5 links, 2 visible"
+     * says three restricted records exist here.
      */
     async relationsForRows(type, fields, rows, workspaceId, limit = public_list_entries_query_dto_1.DEFAULT_EXPANSION_LIMIT) {
         const out = new Map();
@@ -140,9 +155,13 @@ let PublicExpansionQuery = class PublicExpansionQuery {
             for (const [field, value] of Object.entries(byField)) {
                 const linked = entriesById.get(field);
                 view[field] = {
-                    // Preserve the preview's link order, and drop any id the
-                    // hydration didn't return (it named a target the caller
-                    // can't see — already excluded from `total` upstream).
+                    // Preserve the preview's link order. Nothing should drop
+                    // here any more — `previewForEntries` applies the same
+                    // visibility (published-only **and** the bound read scopes)
+                    // inside its window, so an unreachable target is already
+                    // out of both `items` and `total`. The filter stays as a
+                    // belt: a hydration miss must never leave a hole in the
+                    // array, and it is cheap to keep honest.
                     items: value.items
                         .map((ref) => linked?.get(ref.id))
                         .filter((entry) => !!entry),
@@ -209,7 +228,7 @@ let PublicExpansionQuery = class PublicExpansionQuery {
                 ? (0, drizzle_orm_1.eq)(cols['status'], content_type_1.ENTRY_STATUS.Published)
                 : undefined, target.paranoid
                 ? (0, drizzle_orm_1.isNull)(cols['deletedAt'])
-                : undefined)));
+                : undefined, ...this.readScopeWhere(target, workspaceId))));
             out.set(field, new Map(rows.map((row) => [
                 row['id'],
                 (0, public_entry_row_1.toPublicEntry)(target, row)
@@ -358,7 +377,8 @@ exports.PublicExpansionQuery = PublicExpansionQuery = tslib_1.__decorate([
     tslib_1.__param(0, (0, database_1.InjectDatabase)()),
     tslib_1.__param(2, (0, common_1.Optional)()),
     tslib_1.__param(2, (0, media_asset_resolver_1.InjectMediaAssetResolver)()),
-    tslib_1.__metadata("design:paramtypes", [Object, relation_link_service_1.RelationLinkService, Object])
+    tslib_1.__param(3, (0, common_1.Optional)()),
+    tslib_1.__metadata("design:paramtypes", [Object, relation_link_service_1.RelationLinkService, Object, read_scope_1.ContentReadScopeRegistry])
 ], PublicExpansionQuery);
 /** The asset ids stored in a media field — one id, or an ordered list. */
 function mediaRefsOf(value) {

package/dist/lib/revisions/application/use-cases/restore-revision.use-case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"restore-revision.use-case.d.ts","sourceRoot":"","sources":["../../../../../src/lib/revisions/application/use-cases/restore-revision.use-case.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kEAAkE,CAAC;AACtG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAC1E,OAAO,EAEH,KAAK,aAAa,EACrB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;GASG;AACH,qBACa,sBAAsB;IAE3B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACA,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAD5B,MAAM,EAAE,kBAAkB,EACH,KAAK,EAAE,aAAa;IAG1D,OAAO,CACT,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM;IACnB;;;;OAIG;IACH,KAAK,EAAE,UAAU,GAAG,IAAI,EACxB,OAAO,CAAC,EAAE;QACN;;;;;WAKG;QACH,cAAc,CAAC,EAAE,OAAO,CAAC;KAC5B,GACF,OAAO,CAAC,WAAW,CAAC;CA+B1B"}
+{"version":3,"file":"restore-revision.use-case.d.ts","sourceRoot":"","sources":["../../../../../src/lib/revisions/application/use-cases/restore-revision.use-case.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kEAAkE,CAAC;AACtG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAC1E,OAAO,EAEH,KAAK,aAAa,EACrB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;GASG;AACH,qBACa,sBAAsB;IAE3B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACA,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAD5B,MAAM,EAAE,kBAAkB,EACH,KAAK,EAAE,aAAa;IAG1D,OAAO,CACT,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM;IACnB;;;;OAIG;IACH,KAAK,EAAE,UAAU,GAAG,IAAI,EACxB,OAAO,CAAC,EAAE;QACN;;;;;WAKG;QACH,cAAc,CAAC,EAAE,OAAO,CAAC;KAC5B,GACF,OAAO,CAAC,WAAW,CAAC;CA0C1B"}

package/dist/lib/revisions/application/use-cases/restore-revision.use-case.js

@@ -46,7 +46,18 @@ let RestoreRevisionUseCase = class RestoreRevisionUseCase {
                 values[field] = ids;
             }
         }
-        return this.writer.update(type, id, values, workspaceId, undefined, actor, options);
+        return this.writer.update(type, id, values, workspaceId, undefined, actor, {
+            ...options,
+            // Put back whatever the bound extensions held when this version was
+            // captured — segments' audiences, today. Without it "go back to
+            // Tuesday" would restore Tuesday's words in front of today's
+            // readers, which is the half of a restore nobody would think to
+            // check. A version captured before any extension existed carries no
+            // bag, and an absent bag changes nothing (an omitted key is left
+            // alone) — which is the right reading: that version knows nothing
+            // about audiences, it does not assert the entry had none.
+            extensions: detail.snapshot.extra
+        });
     }
 };
 exports.RestoreRevisionUseCase = RestoreRevisionUseCase;

package/dist/lib/revisions/infrastructure/persistence/revision-snapshot.d.ts

@@ -11,7 +11,13 @@ type Row = Record<string, unknown>;
  * `relations` is read separately from the join tables — those links never travel
  * in the `values` bag — inside the save transaction, so the snapshot reflects
  * exactly what committed.
+ *
+ * `extra` is the same idea one plugin further out: state a **bound entry-write
+ * extension** owns in a table this package knows nothing about (segments'
+ * audiences), read back on the same transaction. It is omitted when there is
+ * none, so a snapshot on an installation with no extensions is byte-for-byte
+ * what it was before the port existed.
  */
-export declare function buildSnapshot(type: AnyContentType, row: Row, relations: Record<string, string[]>): RevisionSnapshot;
+export declare function buildSnapshot(type: AnyContentType, row: Row, relations: Record<string, string[]>, extra?: Record<string, unknown>): RevisionSnapshot;
 export {};
 //# sourceMappingURL=revision-snapshot.d.ts.map

package/dist/lib/revisions/infrastructure/persistence/revision-snapshot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"revision-snapshot.d.ts","sourceRoot":"","sources":["../../../../../src/lib/revisions/infrastructure/persistence/revision-snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElE,wEAAwE;AACxE,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CACzB,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,EACR,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GACpC,gBAAgB,CAKlB"}
+{"version":3,"file":"revision-snapshot.d.ts","sourceRoot":"","sources":["../../../../../src/lib/revisions/infrastructure/persistence/revision-snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElE,wEAAwE;AACxE,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CACzB,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,EACR,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EACnC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,gBAAgB,CAMlB"}

package/dist/lib/revisions/infrastructure/persistence/revision-snapshot.js

@@ -11,10 +11,17 @@ const entry_row_1 = require("../../../entries/infrastructure/persistence/entry-r
  * `relations` is read separately from the join tables — those links never travel
  * in the `values` bag — inside the save transaction, so the snapshot reflects
  * exactly what committed.
+ *
+ * `extra` is the same idea one plugin further out: state a **bound entry-write
+ * extension** owns in a table this package knows nothing about (segments'
+ * audiences), read back on the same transaction. It is omitted when there is
+ * none, so a snapshot on an installation with no extensions is byte-for-byte
+ * what it was before the port existed.
  */
-function buildSnapshot(type, row, relations) {
+function buildSnapshot(type, row, relations, extra) {
     return {
         values: (0, entry_row_1.toRecord)(type, row).values,
-        relations
+        relations,
+        ...(extra ? { extra } : {})
     };
 }

package/dist/lib/revisions/types/revision-view.d.ts

@@ -17,6 +17,17 @@ export interface RevisionSnapshot {
      * never travel in {@link values}.
      */
     relations: Record<string, string[]>;
+    /**
+     * What each bound **entry-write extension** held for the entry at capture
+     * time, keyed by its `key` — state a different plugin owns in a table this
+     * package knows nothing about (`segments` records who could read the entry).
+     *
+     * Opaque here: content-server stores it, hands it back on a restore, and
+     * never looks inside. Absent on an installation with no extensions, and on
+     * every version captured before one was installed — so a reader must treat
+     * a missing bag as "nothing is known", never as "the entry had none".
+     */
+    extra?: Record<string, unknown>;
 }
 /**
  * One revision as served to the admin timeline — the metadata, without the

package/dist/lib/revisions/types/revision-view.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"revision-view.d.ts","sourceRoot":"","sources":["../../../../src/lib/revisions/types/revision-view.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EACR,QAAQ,EACR,WAAW,EACd,MAAM,qCAAqC,CAAC;AAE7C;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC7B;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACvC;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC5B,mBAAmB;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,MAAM,EAAE,cAAc,CAAC;IACvB,wDAAwD;IACxD,WAAW,EAAE,OAAO,CAAC;IACrB,sEAAsE;IACtE,QAAQ,EAAE,OAAO,CAAC;IAClB,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wEAAwE;AACxE,MAAM,WAAW,cAAe,SAAQ,eAAe;IACnD,6BAA6B;IAC7B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAC7C,2EAA2E;IAC3E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;CAC1C;AAED,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC7B,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACjB"}
+{"version":3,"file":"revision-view.d.ts","sourceRoot":"","sources":["../../../../src/lib/revisions/types/revision-view.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EACR,QAAQ,EACR,WAAW,EACd,MAAM,qCAAqC,CAAC;AAE7C;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC7B;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpC;;;;;;;;;OASG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC5B,mBAAmB;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,MAAM,EAAE,cAAc,CAAC;IACvB,wDAAwD;IACxD,WAAW,EAAE,OAAO,CAAC;IACrB,sEAAsE;IACtE,QAAQ,EAAE,OAAO,CAAC;IAClB,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wEAAwE;AACxE,MAAM,WAAW,cAAe,SAAQ,eAAe;IACnD,6BAA6B;IAC7B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAC7C,2EAA2E;IAC3E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;CAC1C;AAED,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC7B,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACjB"}

package/dist/lib/utils/content-views-plugin.d.ts

@@ -0,0 +1,28 @@
+import type { ServerPlugin } from '@orthacms/bootstrap-server';
+import type { ContentServerPlugin } from './content-plugin';
+/** Options for {@link ContentViewsPlugin}. */
+export interface ContentViewsPluginOptions {
+    /**
+     * The content plugin this rides on — its registry is what turns a view's
+     * `content:<typeName>` scope back into a known content type. Taking the
+     * whole plugin (rather than a bare registry) makes the dependency visible
+     * at the composition root: the entry has to be listed *after* the content
+     * one, which is also the migration order its foreign keys need.
+     */
+    content: ContentServerPlugin;
+}
+/**
+ * Saved list views — the named filter/sort/column slices an editor returns to.
+ *
+ * A **separate `ServerPlugin` entry from the same package** as `ContentPlugin`,
+ * and deliberately so. `ServerPlugin.migrations` is one descriptor, and
+ * content's is already carrying the HOST's generated collection tables; a
+ * second entry is how this package ships its own fixed tables without touching
+ * that contract. The host applies both under their own tracking tables.
+ *
+ * Order matters at the composition root: `saved_views` has foreign keys into
+ * identity's `users` and workspaces' `workspaces`, and nothing declares that
+ * dependency — list this after both, and after `ContentPlugin` itself.
+ */
+export declare function ContentViewsPlugin(options: ContentViewsPluginOptions): ServerPlugin;
+//# sourceMappingURL=content-views-plugin.d.ts.map

package/dist/lib/utils/content-views-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-views-plugin.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/content-views-plugin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,8CAA8C;AAC9C,MAAM,WAAW,yBAAyB;IACtC;;;;;;OAMG;IACH,OAAO,EAAE,mBAAmB,CAAC;CAChC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAC9B,OAAO,EAAE,yBAAyB,GACnC,YAAY,CAUd"}

package/dist/lib/utils/content-views-plugin.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContentViewsPlugin = ContentViewsPlugin;
+const node_path_1 = require("node:path");
+const content_views_module_1 = require("../views/content-views.module");
+/**
+ * Saved list views — the named filter/sort/column slices an editor returns to.
+ *
+ * A **separate `ServerPlugin` entry from the same package** as `ContentPlugin`,
+ * and deliberately so. `ServerPlugin.migrations` is one descriptor, and
+ * content's is already carrying the HOST's generated collection tables; a
+ * second entry is how this package ships its own fixed tables without touching
+ * that contract. The host applies both under their own tracking tables.
+ *
+ * Order matters at the composition root: `saved_views` has foreign keys into
+ * identity's `users` and workspaces' `workspaces`, and nothing declares that
+ * dependency — list this after both, and after `ContentPlugin` itself.
+ */
+function ContentViewsPlugin(options) {
+    return {
+        name: 'content-views',
+        module: content_views_module_1.ContentViewsModule.forRoot(options.content.registry),
+        // src/lib/utils → ../../../migrations = <pkg>/migrations.
+        migrations: {
+            dir: () => (0, node_path_1.join)(__dirname, '../../../migrations'),
+            table: '__drizzle_migrations_content_views'
+        }
+    };
+}

package/dist/lib/views/application/queries/saved-views.query.d.ts

@@ -0,0 +1,16 @@
+import type { SavedView } from '../../domain/saved-view';
+import { type SavedViewRecord, type SavedViewRepository } from '../../domain/saved-view.repository';
+/**
+ * The read side: every view a caller may see for one list, with the two
+ * per-caller flags the switcher renders from (`isOwn` gates Save and Delete,
+ * `isDefault` marks the row and drives the landing view).
+ */
+export declare class SavedViewsQuery {
+    private readonly repository;
+    constructor(repository: SavedViewRepository);
+    /** Views visible to `readerId` in this workspace + scope. */
+    list(workspaceId: string, scope: string, readerId: string): Promise<SavedView[]>;
+}
+/** Projects a stored row into the API shape for one reader. */
+export declare function toSavedView(record: SavedViewRecord, readerId: string, defaultId: string | null): SavedView;
+//# sourceMappingURL=saved-views.query.d.ts.map

package/dist/lib/views/application/queries/saved-views.query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saved-views.query.d.ts","sourceRoot":"","sources":["../../../../../src/lib/views/application/queries/saved-views.query.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAEH,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAC3B,MAAM,oCAAoC,CAAC;AAE5C;;;;GAIG;AACH,qBACa,eAAe;IAGpB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,mBAAmB;IAGpD,6DAA6D;IACvD,IAAI,CACN,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,SAAS,EAAE,CAAC;CAS1B;AAED,+DAA+D;AAC/D,wBAAgB,WAAW,CACvB,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAAG,IAAI,GACzB,SAAS,CAYX"}

package/dist/lib/views/application/queries/saved-views.query.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SavedViewsQuery = void 0;
+exports.toSavedView = toSavedView;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const saved_view_repository_1 = require("../../domain/saved-view.repository");
+/**
+ * The read side: every view a caller may see for one list, with the two
+ * per-caller flags the switcher renders from (`isOwn` gates Save and Delete,
+ * `isDefault` marks the row and drives the landing view).
+ */
+let SavedViewsQuery = class SavedViewsQuery {
+    repository;
+    constructor(repository) {
+        this.repository = repository;
+    }
+    /** Views visible to `readerId` in this workspace + scope. */
+    async list(workspaceId, scope, readerId) {
+        const [records, defaultId] = await Promise.all([
+            this.repository.listVisible(workspaceId, scope, readerId),
+            this.repository.findDefaultId(readerId, scope)
+        ]);
+        return records.map((record) => toSavedView(record, readerId, defaultId));
+    }
+};
+exports.SavedViewsQuery = SavedViewsQuery;
+exports.SavedViewsQuery = SavedViewsQuery = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(0, (0, common_1.Inject)(saved_view_repository_1.SAVED_VIEW_REPOSITORY)),
+    tslib_1.__metadata("design:paramtypes", [Object])
+], SavedViewsQuery);
+/** Projects a stored row into the API shape for one reader. */
+function toSavedView(record, readerId, defaultId) {
+    return {
+        id: record.id,
+        scope: record.scope,
+        name: record.name,
+        visibility: record.visibility,
+        ownerId: record.ownerId,
+        isOwn: record.ownerId === readerId,
+        isDefault: record.id === defaultId,
+        payload: record.payload,
+        updatedAt: record.updatedAt.toISOString()
+    };
+}

package/dist/lib/views/application/saved-view-access.service.d.ts

@@ -0,0 +1,30 @@
+import { AccessPolicy, PermissionsService, type PublicUser } from '@orthacms/identity-server';
+import { type ViewVisibility } from '../domain/saved-view';
+import type { SavedViewRecord } from '../domain/saved-view.repository';
+/**
+ * The two authorization rules saved views add on top of the route guards.
+ *
+ * The guards already establish that the caller is authenticated, a member of
+ * the open workspace, and may read content. What is left is per-row and
+ * per-visibility, so it cannot live in a decorator:
+ *
+ *  - **Only the owner writes.** Editing or deleting someone else's view is a
+ *    403 even for an administrator — a shared view is its author's, and the
+ *    remedy for disagreeing with one is "Save as new", not a silent rewrite.
+ *  - **Sharing is a permission.** Making a view workspace-visible needs
+ *    `views:share`; a member without it still saves as many private views as
+ *    they like.
+ */
+export declare class SavedViewAccessService {
+    private readonly permissions;
+    private readonly accessPolicy;
+    constructor(permissions: PermissionsService, accessPolicy: AccessPolicy);
+    /** Throws unless `user` owns `view`. */
+    assertOwned(view: SavedViewRecord, user: PublicUser): void;
+    /**
+     * Throws unless `user` may store a view at `visibility`. Private views need
+     * nothing beyond membership; workspace-visible ones need `views:share`.
+     */
+    assertCanUseVisibility(visibility: ViewVisibility, user: PublicUser): Promise<void>;
+}
+//# sourceMappingURL=saved-view-access.service.d.ts.map