@orthacms/content-server 0.4.2 → 0.5.0

package/dist/lib/public-api/infrastructure/public-expansion.query.d.ts

@@ -1,6 +1,7 @@
 import { type Database } from '@orthacms/database';
 import { type AnyContentType } from '../../types/content-type';
 import { type MediaAssetResolver } from '../../extension/media-asset-resolver';
+import { ContentReadScopeRegistry } from '../../extension/read-scope';
 import { RelationLinkService } from '../../entries/infrastructure/persistence/relation-link.service';
 import type { PublicMediaFieldView, PublicRelationFieldView } from '../types/public-expansion';
 /** A generated content row seen as a bag of values by property name. */
@@ -31,7 +32,16 @@ export declare class PublicExpansionQuery {
     private readonly db;
     private readonly relationLinks;
     private readonly media?;
-    constructor(db: Database, relationLinks: RelationLinkService, media?: MediaAssetResolver | undefined);
+    private readonly readScopes?;
+    constructor(db: Database, relationLinks: RelationLinkService, media?: MediaAssetResolver | undefined, readScopes?: ContentReadScopeRegistry | undefined);
+    /**
+     * The read-scope fragments for one hop's target type.
+     *
+     * The target is a different content type from the one the request named, so
+     * the scope is asked about **it** — a scope keyed to the requested type
+     * would leave every relation target unguarded.
+     */
+    private readScopeWhere;
     /**
      * Validate a `?relationFields=` list: every name must be a relation field
      * on the type, and its target must be a content type the workspace was
@@ -47,9 +57,11 @@ export declare class PublicExpansionQuery {
      * One capped page of links per requested relation field, for every row on
      * the page, keyed by entry id.
      *
-     * `publishedOnly` is the public difference: a draft target is neither shown
-     * nor counted, so `total` is the number of links a caller can actually
-     * reach.
+     * `publishedOnly` is the public difference: a draft target — or one a bound
+     * read scope hides from this reader — is neither shown **nor counted**, so
+     * `total` is the number of links this caller can actually reach. Counting
+     * them would leak the cardinality of what is hidden: "5 links, 2 visible"
+     * says three restricted records exist here.
      */
     relationsForRows(type: AnyContentType, fields: string[], rows: Row[], workspaceId: string, limit?: number): Promise<Map<string, Record<string, PublicRelationFieldView>>>;
     /**

package/dist/lib/public-api/infrastructure/public-expansion.query.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"public-expansion.query.d.ts","sourceRoot":"","sources":["../../../../src/lib/public-api/infrastructure/public-expansion.query.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE7E,OAAO,EAEH,KAAK,kBAAkB,EAC1B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gEAAgE,CAAC;AAErG,OAAO,KAAK,EACR,oBAAoB,EAEpB,uBAAuB,EAC1B,MAAM,2BAA2B,CAAC;AAInC,wEAAwE;AACxE,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAKnC;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAwCtC;;;;;;;;;;;;GAYG;AACH,qBACa,oBAAoB;IAEP,OAAO,CAAC,QAAQ,CAAC,EAAE;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAG9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAJY,EAAE,EAAE,QAAQ,EAC9B,aAAa,EAAE,mBAAmB,EAGlC,KAAK,CAAC,EAAE,kBAAkB,YAAA;IAG/C;;;;;;;OAOG;IACH,mBAAmB,CACf,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAC7B,MAAM,EAAE;IA8BX,yEAAyE;IACzE,gBAAgB,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE;IAiBzE;;;;;;;OAOG;IACG,gBAAgB,CAClB,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,MAAM,EAAE,EAChB,IAAI,EAAE,GAAG,EAAE,EACX,WAAW,EAAE,MAAM,EACnB,KAAK,SAA0B,GAChC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC,CAAC;IAyChE;;;;OAIG;IACG,oBAAoB,CACtB,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,EACjE,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAqBnD;;;;;;;;OAQG;YACW,iBAAiB;IAsD/B;;;;;;OAMG;IACG,YAAY,CACd,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,MAAM,EAAE,EAChB,IAAI,EAAE,GAAG,EAAE,EACX,WAAW,EAAE,MAAM,EACnB,KAAK,SAA0B,GAChC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IA+F7D;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe;IAgBvB,4EAA4E;IAC5E,OAAO,CAAC,WAAW;CA+BtB"}
+{"version":3,"file":"public-expansion.query.d.ts","sourceRoot":"","sources":["../../../../src/lib/public-api/infrastructure/public-expansion.query.ts"],"names":[],"mappings":"AASA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE7E,OAAO,EAEH,KAAK,kBAAkB,EAC1B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gEAAgE,CAAC;AAErG,OAAO,KAAK,EACR,oBAAoB,EAEpB,uBAAuB,EAC1B,MAAM,2BAA2B,CAAC;AAInC,wEAAwE;AACxE,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAKnC;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAwCtC;;;;;;;;;;;;GAYG;AACH,qBACa,oBAAoB;IAEP,OAAO,CAAC,QAAQ,CAAC,EAAE;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAG9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAKvB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;gBATO,EAAE,EAAE,QAAQ,EAC9B,aAAa,EAAE,mBAAmB,EAGlC,KAAK,CAAC,EAAE,kBAAkB,YAAA,EAK1B,UAAU,CAAC,EAAE,wBAAwB,YAAA;IAG1D;;;;;;OAMG;IACH,OAAO,CAAC,cAAc;IAOtB;;;;;;;OAOG;IACH,mBAAmB,CACf,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,GAAG,SAAS,EACvB,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAC7B,MAAM,EAAE;IA8BX,yEAAyE;IACzE,gBAAgB,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE;IAiBzE;;;;;;;;;OASG;IACG,gBAAgB,CAClB,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,MAAM,EAAE,EAChB,IAAI,EAAE,GAAG,EAAE,EACX,WAAW,EAAE,MAAM,EACnB,KAAK,SAA0B,GAChC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC,CAAC;IA6ChE;;;;OAIG;IACG,oBAAoB,CACtB,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,EACjE,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAqBnD;;;;;;;;OAQG;YACW,iBAAiB;IAuD/B;;;;;;OAMG;IACG,YAAY,CACd,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,MAAM,EAAE,EAChB,IAAI,EAAE,GAAG,EAAE,EACX,WAAW,EAAE,MAAM,EACnB,KAAK,SAA0B,GAChC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC;IA+F7D;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe;IAgBvB,4EAA4E;IAC5E,OAAO,CAAC,WAAW;CA+BtB"}

package/dist/lib/public-api/infrastructure/public-expansion.query.js

@@ -9,6 +9,7 @@ const content_domain_1 = require("@orthacms/content-domain");
 const content_type_1 = require("../../types/content-type");
 const fields_1 = require("../../types/fields");
 const media_asset_resolver_1 = require("../../extension/media-asset-resolver");
+const read_scope_1 = require("../../extension/read-scope");
 const relation_link_service_1 = require("../../entries/infrastructure/persistence/relation-link.service");
 const public_list_entries_query_dto_1 = require("../http/dto/public-list-entries-query.dto");
 const public_entry_row_1 = require("./public-entry-row");
@@ -73,10 +74,22 @@ let PublicExpansionQuery = class PublicExpansionQuery {
     db;
     relationLinks;
     media;
-    constructor(db, relationLinks, media) {
+    readScopes;
+    constructor(db, relationLinks, media, readScopes) {
         this.db = db;
         this.relationLinks = relationLinks;
         this.media = media;
+        this.readScopes = readScopes;
+    }
+    /**
+     * The read-scope fragments for one hop's target type.
+     *
+     * The target is a different content type from the one the request named, so
+     * the scope is asked about **it** — a scope keyed to the requested type
+     * would leave every relation target unguarded.
+     */
+    readScopeWhere(type, workspaceId) {
+        return this.readScopes?.fragments({ type, workspaceId }) ?? [];
     }
     /**
      * Validate a `?relationFields=` list: every name must be a relation field
@@ -121,9 +134,11 @@ let PublicExpansionQuery = class PublicExpansionQuery {
      * One capped page of links per requested relation field, for every row on
      * the page, keyed by entry id.
      *
-     * `publishedOnly` is the public difference: a draft target is neither shown
-     * nor counted, so `total` is the number of links a caller can actually
-     * reach.
+     * `publishedOnly` is the public difference: a draft target — or one a bound
+     * read scope hides from this reader — is neither shown **nor counted**, so
+     * `total` is the number of links this caller can actually reach. Counting
+     * them would leak the cardinality of what is hidden: "5 links, 2 visible"
+     * says three restricted records exist here.
      */
     async relationsForRows(type, fields, rows, workspaceId, limit = public_list_entries_query_dto_1.DEFAULT_EXPANSION_LIMIT) {
         const out = new Map();
@@ -140,9 +155,13 @@ let PublicExpansionQuery = class PublicExpansionQuery {
             for (const [field, value] of Object.entries(byField)) {
                 const linked = entriesById.get(field);
                 view[field] = {
-                    // Preserve the preview's link order, and drop any id the
-                    // hydration didn't return (it named a target the caller
-                    // can't see — already excluded from `total` upstream).
+                    // Preserve the preview's link order. Nothing should drop
+                    // here any more — `previewForEntries` applies the same
+                    // visibility (published-only **and** the bound read scopes)
+                    // inside its window, so an unreachable target is already
+                    // out of both `items` and `total`. The filter stays as a
+                    // belt: a hydration miss must never leave a hole in the
+                    // array, and it is cheap to keep honest.
                     items: value.items
                         .map((ref) => linked?.get(ref.id))
                         .filter((entry) => !!entry),
@@ -209,7 +228,7 @@ let PublicExpansionQuery = class PublicExpansionQuery {
                 ? (0, drizzle_orm_1.eq)(cols['status'], content_type_1.ENTRY_STATUS.Published)
                 : undefined, target.paranoid
                 ? (0, drizzle_orm_1.isNull)(cols['deletedAt'])
-                : undefined)));
+                : undefined, ...this.readScopeWhere(target, workspaceId))));
             out.set(field, new Map(rows.map((row) => [
                 row['id'],
                 (0, public_entry_row_1.toPublicEntry)(target, row)
@@ -358,7 +377,8 @@ exports.PublicExpansionQuery = PublicExpansionQuery = tslib_1.__decorate([
     tslib_1.__param(0, (0, database_1.InjectDatabase)()),
     tslib_1.__param(2, (0, common_1.Optional)()),
     tslib_1.__param(2, (0, media_asset_resolver_1.InjectMediaAssetResolver)()),
-    tslib_1.__metadata("design:paramtypes", [Object, relation_link_service_1.RelationLinkService, Object])
+    tslib_1.__param(3, (0, common_1.Optional)()),
+    tslib_1.__metadata("design:paramtypes", [Object, relation_link_service_1.RelationLinkService, Object, read_scope_1.ContentReadScopeRegistry])
 ], PublicExpansionQuery);
 /** The asset ids stored in a media field — one id, or an ordered list. */
 function mediaRefsOf(value) {

package/dist/lib/public-api/infrastructure/token-actor.d.ts

@@ -0,0 +1,37 @@
+import { type EventActor } from '@orthacms/database';
+import type { ToolActor } from '@orthacms/tools-server';
+import type { PublicApiToken } from '../http/api-token-request';
+/**
+ * The API token as the {@link EventActor} a public-API write stamps onto its
+ * domain events.
+ *
+ * Every write over the public REST API, GraphQL and MCP used to reach the audit
+ * log with no actor at all and render as "System" — not an oversight but the
+ * only honest option at the time, since `actor_id` meant "a `users` row" and a
+ * token is not one. `activity_events.actor_type` is what makes naming the
+ * credential possible, so this is the seam that fills it.
+ *
+ * `email` carries the token's **label**, because that is the readable name a
+ * row needs and a token has no address; `actor_type` is what tells a client not
+ * to read it as one. The token id goes in `id` — the same handle the API Tokens
+ * page lists and the revoke button acts on, so a row leads straight to the
+ * credential it names.
+ *
+ * A revision's `created_by` still gets `null` for a token: that column really is
+ * a `users` FK. The split lives in `EntryWriterService`'s `revisionActorId`.
+ */
+export declare function toTokenActor(token: PublicApiToken): EventActor;
+/**
+ * The {@link EventActor} for a write made through the shared **tool registry** —
+ * an MCP client, or the copilot's own run loop.
+ *
+ * `ToolActor` already carries the distinction this needs (`kind`, `id`,
+ * `displayName`), which is the point of it being transport-neutral: one
+ * conversion covers both surfaces, and neither had any actor on its writes
+ * before. A token acts as itself here exactly as it does over REST — the
+ * minting user in `actor.userId` is attribution for a revision's `created_by`,
+ * not the principal that performed the call, and conflating them would name a
+ * person for every request an integration makes.
+ */
+export declare function toToolEventActor(actor: ToolActor): EventActor;
+//# sourceMappingURL=token-actor.d.ts.map

package/dist/lib/public-api/infrastructure/token-actor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-actor.d.ts","sourceRoot":"","sources":["../../../../src/lib/public-api/infrastructure/token-actor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,cAAc,GAAG,UAAU,CAO9D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU,CAa7D"}

package/dist/lib/public-api/infrastructure/token-actor.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toTokenActor = toTokenActor;
+exports.toToolEventActor = toToolEventActor;
+const database_1 = require("@orthacms/database");
+/**
+ * The API token as the {@link EventActor} a public-API write stamps onto its
+ * domain events.
+ *
+ * Every write over the public REST API, GraphQL and MCP used to reach the audit
+ * log with no actor at all and render as "System" — not an oversight but the
+ * only honest option at the time, since `actor_id` meant "a `users` row" and a
+ * token is not one. `activity_events.actor_type` is what makes naming the
+ * credential possible, so this is the seam that fills it.
+ *
+ * `email` carries the token's **label**, because that is the readable name a
+ * row needs and a token has no address; `actor_type` is what tells a client not
+ * to read it as one. The token id goes in `id` — the same handle the API Tokens
+ * page lists and the revoke button acts on, so a row leads straight to the
+ * credential it names.
+ *
+ * A revision's `created_by` still gets `null` for a token: that column really is
+ * a `users` FK. The split lives in `EntryWriterService`'s `revisionActorId`.
+ */
+function toTokenActor(token) {
+    return {
+        id: token.id,
+        email: token.name,
+        type: database_1.EVENT_ACTOR_TYPE.ApiToken,
+        label: token.name
+    };
+}
+/**
+ * The {@link EventActor} for a write made through the shared **tool registry** —
+ * an MCP client, or the copilot's own run loop.
+ *
+ * `ToolActor` already carries the distinction this needs (`kind`, `id`,
+ * `displayName`), which is the point of it being transport-neutral: one
+ * conversion covers both surfaces, and neither had any actor on its writes
+ * before. A token acts as itself here exactly as it does over REST — the
+ * minting user in `actor.userId` is attribution for a revision's `created_by`,
+ * not the principal that performed the call, and conflating them would name a
+ * person for every request an integration makes.
+ */
+function toToolEventActor(actor) {
+    return actor.kind === 'token'
+        ? {
+            id: actor.id,
+            email: actor.displayName,
+            type: database_1.EVENT_ACTOR_TYPE.ApiToken,
+            label: actor.displayName
+        }
+        : {
+            id: actor.id,
+            email: actor.displayName,
+            type: database_1.EVENT_ACTOR_TYPE.User
+        };
+}

package/dist/lib/revisions/application/use-cases/restore-revision.use-case.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"restore-revision.use-case.d.ts","sourceRoot":"","sources":["../../../../../src/lib/revisions/application/use-cases/restore-revision.use-case.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kEAAkE,CAAC;AACtG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAC1E,OAAO,EAEH,KAAK,aAAa,EACrB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;GASG;AACH,qBACa,sBAAsB;IAE3B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACA,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAD5B,MAAM,EAAE,kBAAkB,EACH,KAAK,EAAE,aAAa;IAG1D,OAAO,CACT,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM;IACnB;;;;OAIG;IACH,KAAK,EAAE,UAAU,GAAG,IAAI,EACxB,OAAO,CAAC,EAAE;QACN;;;;;WAKG;QACH,cAAc,CAAC,EAAE,OAAO,CAAC;KAC5B,GACF,OAAO,CAAC,WAAW,CAAC;CA+B1B"}
+{"version":3,"file":"restore-revision.use-case.d.ts","sourceRoot":"","sources":["../../../../../src/lib/revisions/application/use-cases/restore-revision.use-case.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kEAAkE,CAAC;AACtG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AAC1E,OAAO,EAEH,KAAK,aAAa,EACrB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;GASG;AACH,qBACa,sBAAsB;IAE3B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACA,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAD5B,MAAM,EAAE,kBAAkB,EACH,KAAK,EAAE,aAAa;IAG1D,OAAO,CACT,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM;IACnB;;;;OAIG;IACH,KAAK,EAAE,UAAU,GAAG,IAAI,EACxB,OAAO,CAAC,EAAE;QACN;;;;;WAKG;QACH,cAAc,CAAC,EAAE,OAAO,CAAC;KAC5B,GACF,OAAO,CAAC,WAAW,CAAC;CAoD1B"}

package/dist/lib/revisions/application/use-cases/restore-revision.use-case.js

@@ -46,7 +46,29 @@ let RestoreRevisionUseCase = class RestoreRevisionUseCase {
                 values[field] = ids;
             }
         }
-        return this.writer.update(type, id, values, workspaceId, undefined, actor, options);
+        return this.writer.update(type, id, values, workspaceId, undefined, 
+        // Restoring reaches the log as the `entry.updated` its save raises,
+        // naming the fields it put back — which is right, and used to be
+        // the whole story: nothing said the edit *was* a restore, or of
+        // which version. `via` carries that without inventing a kind, the
+        // same seam a copilot-applied change uses.
+        actor
+            ? {
+                ...actor,
+                via: { kind: 'revision_restore', revisionNumber: number }
+            }
+            : actor, {
+            ...options,
+            // Put back whatever the bound extensions held when this version was
+            // captured — segments' audiences, today. Without it "go back to
+            // Tuesday" would restore Tuesday's words in front of today's
+            // readers, which is the half of a restore nobody would think to
+            // check. A version captured before any extension existed carries no
+            // bag, and an absent bag changes nothing (an omitted key is left
+            // alone) — which is the right reading: that version knows nothing
+            // about audiences, it does not assert the entry had none.
+            extensions: detail.snapshot.extra
+        });
     }
 };
 exports.RestoreRevisionUseCase = RestoreRevisionUseCase;

package/dist/lib/revisions/infrastructure/persistence/revision-snapshot.d.ts

@@ -11,7 +11,13 @@ type Row = Record<string, unknown>;
  * `relations` is read separately from the join tables — those links never travel
  * in the `values` bag — inside the save transaction, so the snapshot reflects
  * exactly what committed.
+ *
+ * `extra` is the same idea one plugin further out: state a **bound entry-write
+ * extension** owns in a table this package knows nothing about (segments'
+ * audiences), read back on the same transaction. It is omitted when there is
+ * none, so a snapshot on an installation with no extensions is byte-for-byte
+ * what it was before the port existed.
  */
-export declare function buildSnapshot(type: AnyContentType, row: Row, relations: Record<string, string[]>): RevisionSnapshot;
+export declare function buildSnapshot(type: AnyContentType, row: Row, relations: Record<string, string[]>, extra?: Record<string, unknown>): RevisionSnapshot;
 export {};
 //# sourceMappingURL=revision-snapshot.d.ts.map

package/dist/lib/revisions/infrastructure/persistence/revision-snapshot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"revision-snapshot.d.ts","sourceRoot":"","sources":["../../../../../src/lib/revisions/infrastructure/persistence/revision-snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElE,wEAAwE;AACxE,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CACzB,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,EACR,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GACpC,gBAAgB,CAKlB"}
+{"version":3,"file":"revision-snapshot.d.ts","sourceRoot":"","sources":["../../../../../src/lib/revisions/infrastructure/persistence/revision-snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAElE,wEAAwE;AACxE,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CACzB,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,EACR,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EACnC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,gBAAgB,CAMlB"}

package/dist/lib/revisions/infrastructure/persistence/revision-snapshot.js

@@ -11,10 +11,17 @@ const entry_row_1 = require("../../../entries/infrastructure/persistence/entry-r
  * `relations` is read separately from the join tables — those links never travel
  * in the `values` bag — inside the save transaction, so the snapshot reflects
  * exactly what committed.
+ *
+ * `extra` is the same idea one plugin further out: state a **bound entry-write
+ * extension** owns in a table this package knows nothing about (segments'
+ * audiences), read back on the same transaction. It is omitted when there is
+ * none, so a snapshot on an installation with no extensions is byte-for-byte
+ * what it was before the port existed.
  */
-function buildSnapshot(type, row, relations) {
+function buildSnapshot(type, row, relations, extra) {
     return {
         values: (0, entry_row_1.toRecord)(type, row).values,
-        relations
+        relations,
+        ...(extra ? { extra } : {})
     };
 }

package/dist/lib/revisions/infrastructure/purge/revisions-workspace.purger.d.ts

@@ -0,0 +1,28 @@
+import { OnModuleInit } from '@nestjs/common';
+import { UnitOfWork } from '@orthacms/database';
+import { WorkspacePurgeRegistry, type WorkspacePurger, type WorkspacePurgeOutcome } from '@orthacms/workspaces-server';
+/**
+ * Removes a deleted workspace's entry revisions.
+ *
+ * Content is otherwise the plugin that does **not** purge: a workspace holding
+ * entries is refused (409), because entries are authored records someone must
+ * delete deliberately. Revisions fall outside that protection in both
+ * directions. They carry a plain `workspace_id` with no foreign key, and
+ * `countWorkspaceEntries` sums the live `content_<name>` tables only — so a
+ * workspace whose entries have all been deleted counts as empty, deletes
+ * cleanly, and leaves its whole revision history behind pointing at nothing.
+ *
+ * That history is not an authored record in its own right: it is the version
+ * timeline of rows that are already gone, unreachable once the workspace it was
+ * scoped to no longer opens. Purging it is the same call the folder tree and the
+ * token bucket get — scoping rows with no independent meaning left.
+ */
+export declare class RevisionsWorkspacePurger implements WorkspacePurger, OnModuleInit {
+    private readonly uow;
+    private readonly registry?;
+    readonly purgeName = "content:entry-revisions";
+    constructor(uow: UnitOfWork, registry?: WorkspacePurgeRegistry | undefined);
+    onModuleInit(): void;
+    purge(workspaceId: string): Promise<WorkspacePurgeOutcome>;
+}
+//# sourceMappingURL=revisions-workspace.purger.d.ts.map

package/dist/lib/revisions/infrastructure/purge/revisions-workspace.purger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revisions-workspace.purger.d.ts","sourceRoot":"","sources":["../../../../../src/lib/revisions/infrastructure/purge/revisions-workspace.purger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,YAAY,EAAY,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EACH,sBAAsB,EACtB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC7B,MAAM,6BAA6B,CAAC;AAGrC;;;;;;;;;;;;;;;GAeG;AACH,qBACa,wBAAyB,YAAW,eAAe,EAAE,YAAY;IAItE,OAAO,CAAC,QAAQ,CAAC,GAAG;IACR,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAJ1C,QAAQ,CAAC,SAAS,6BAA6B;gBAG1B,GAAG,EAAE,UAAU,EACH,QAAQ,CAAC,EAAE,sBAAsB,YAAA;IAGlE,YAAY,IAAI,IAAI;IAId,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;CASnE"}

package/dist/lib/revisions/infrastructure/purge/revisions-workspace.purger.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RevisionsWorkspacePurger = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const drizzle_orm_1 = require("drizzle-orm");
+const database_1 = require("@orthacms/database");
+const workspaces_server_1 = require("@orthacms/workspaces-server");
+const revision_table_1 = require("../persistence/revision-table");
+/**
+ * Removes a deleted workspace's entry revisions.
+ *
+ * Content is otherwise the plugin that does **not** purge: a workspace holding
+ * entries is refused (409), because entries are authored records someone must
+ * delete deliberately. Revisions fall outside that protection in both
+ * directions. They carry a plain `workspace_id` with no foreign key, and
+ * `countWorkspaceEntries` sums the live `content_<name>` tables only — so a
+ * workspace whose entries have all been deleted counts as empty, deletes
+ * cleanly, and leaves its whole revision history behind pointing at nothing.
+ *
+ * That history is not an authored record in its own right: it is the version
+ * timeline of rows that are already gone, unreachable once the workspace it was
+ * scoped to no longer opens. Purging it is the same call the folder tree and the
+ * token bucket get — scoping rows with no independent meaning left.
+ */
+let RevisionsWorkspacePurger = class RevisionsWorkspacePurger {
+    uow;
+    registry;
+    purgeName = 'content:entry-revisions';
+    constructor(uow, registry) {
+        this.uow = uow;
+        this.registry = registry;
+    }
+    onModuleInit() {
+        this.registry?.register(this);
+    }
+    async purge(workspaceId) {
+        const removed = await this.uow
+            .current()
+            .delete(revision_table_1.contentEntryRevisions)
+            .where((0, drizzle_orm_1.eq)(revision_table_1.contentEntryRevisions.workspaceId, workspaceId))
+            .returning({ id: revision_table_1.contentEntryRevisions.id });
+        return { rows: removed.length };
+    }
+};
+exports.RevisionsWorkspacePurger = RevisionsWorkspacePurger;
+exports.RevisionsWorkspacePurger = RevisionsWorkspacePurger = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(1, (0, common_1.Optional)()),
+    tslib_1.__metadata("design:paramtypes", [database_1.UnitOfWork,
+        workspaces_server_1.WorkspacePurgeRegistry])
+], RevisionsWorkspacePurger);

package/dist/lib/revisions/types/revision-view.d.ts

@@ -17,6 +17,17 @@ export interface RevisionSnapshot {
      * never travel in {@link values}.
      */
     relations: Record<string, string[]>;
+    /**
+     * What each bound **entry-write extension** held for the entry at capture
+     * time, keyed by its `key` — state a different plugin owns in a table this
+     * package knows nothing about (`segments` records who could read the entry).
+     *
+     * Opaque here: content-server stores it, hands it back on a restore, and
+     * never looks inside. Absent on an installation with no extensions, and on
+     * every version captured before one was installed — so a reader must treat
+     * a missing bag as "nothing is known", never as "the entry had none".
+     */
+    extra?: Record<string, unknown>;
 }
 /**
  * One revision as served to the admin timeline — the metadata, without the

package/dist/lib/revisions/types/revision-view.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"revision-view.d.ts","sourceRoot":"","sources":["../../../../src/lib/revisions/types/revision-view.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EACR,QAAQ,EACR,WAAW,EACd,MAAM,qCAAqC,CAAC;AAE7C;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC7B;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACvC;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC5B,mBAAmB;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,MAAM,EAAE,cAAc,CAAC;IACvB,wDAAwD;IACxD,WAAW,EAAE,OAAO,CAAC;IACrB,sEAAsE;IACtE,QAAQ,EAAE,OAAO,CAAC;IAClB,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wEAAwE;AACxE,MAAM,WAAW,cAAe,SAAQ,eAAe;IACnD,6BAA6B;IAC7B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAC7C,2EAA2E;IAC3E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;CAC1C;AAED,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC7B,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACjB"}
+{"version":3,"file":"revision-view.d.ts","sourceRoot":"","sources":["../../../../src/lib/revisions/types/revision-view.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,KAAK,EACR,QAAQ,EACR,WAAW,EACd,MAAM,qCAAqC,CAAC;AAE7C;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC7B;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpC;;;;;;;;;OASG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC5B,mBAAmB;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,MAAM,EAAE,cAAc,CAAC;IACvB,wDAAwD;IACxD,WAAW,EAAE,OAAO,CAAC;IACrB,sEAAsE;IACtE,QAAQ,EAAE,OAAO,CAAC;IAClB,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wEAAwE;AACxE,MAAM,WAAW,cAAe,SAAQ,eAAe;IACnD,6BAA6B;IAC7B,QAAQ,EAAE,gBAAgB,CAAC;IAC3B;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAC7C,2EAA2E;IAC3E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;CAC1C;AAED,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC7B,KAAK,EAAE,eAAe,EAAE,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACjB"}

package/dist/lib/utils/content-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"content-plugin.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/content-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAG/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,yCAAyC;AACzC,MAAM,WAAW,oBAAoB;IACjC,iEAAiE;IACjE,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;CAC3C;AAED,kEAAkE;AAClE,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACrD,QAAQ,EAAE,mBAAmB,CAAC;CACjC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CACzB,OAAO,EAAE,oBAAoB,GAC9B,mBAAmB,CAerB"}
+{"version":3,"file":"content-plugin.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/content-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAI/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,yCAAyC;AACzC,MAAM,WAAW,oBAAoB;IACjC,iEAAiE;IACjE,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;CAC3C;AAED,kEAAkE;AAClE,MAAM,WAAW,mBAAoB,SAAQ,YAAY;IACrD,QAAQ,EAAE,mBAAmB,CAAC;CACjC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CACzB,OAAO,EAAE,oBAAoB,GAC9B,mBAAmB,CAsBrB"}

package/dist/lib/utils/content-plugin.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ContentPlugin = ContentPlugin;
 const content_module_1 = require("../content.module");
 const describe_content_api_1 = require("../docs/describe-content-api");
+const describe_content_insights_api_1 = require("../insights/docs/describe-content-insights-api");
 const content_type_registry_1 = require("../registry/content-type-registry");
 /**
  * Content plugin factory. Builds the registry eagerly — duplicate names
@@ -29,7 +30,15 @@ function ContentPlugin(options) {
         // can see; the registry is what knows `article` from `home_page`. This
         // hook is where the code-defined types become OpenAPI schemas.
         docs: {
-            decorate: (document) => (0, describe_content_api_1.describeContentApi)(document, registry.serializeAll())
+            decorate: (document) => {
+                (0, describe_content_api_1.describeContentApi)(document, registry.serializeAll());
+                // The Insights widgets are a second surface with a fixed
+                // contract — six unlike payloads whose views are `interface`s,
+                // so the scanner emits an empty 200 for each. Described from
+                // their own module rather than folded into the pass above:
+                // they are grouped under the `insights` tag, not `content`.
+                (0, describe_content_insights_api_1.describeContentInsightsApi)(document);
+            }
         }
     };
 }

package/dist/lib/utils/content-views-plugin.d.ts

@@ -0,0 +1,28 @@
+import type { ServerPlugin } from '@orthacms/bootstrap-server';
+import type { ContentServerPlugin } from './content-plugin';
+/** Options for {@link ContentViewsPlugin}. */
+export interface ContentViewsPluginOptions {
+    /**
+     * The content plugin this rides on — its registry is what turns a view's
+     * `content:<typeName>` scope back into a known content type. Taking the
+     * whole plugin (rather than a bare registry) makes the dependency visible
+     * at the composition root: the entry has to be listed *after* the content
+     * one, which is also the migration order its foreign keys need.
+     */
+    content: ContentServerPlugin;
+}
+/**
+ * Saved list views — the named filter/sort/column slices an editor returns to.
+ *
+ * A **separate `ServerPlugin` entry from the same package** as `ContentPlugin`,
+ * and deliberately so. `ServerPlugin.migrations` is one descriptor, and
+ * content's is already carrying the HOST's generated collection tables; a
+ * second entry is how this package ships its own fixed tables without touching
+ * that contract. The host applies both under their own tracking tables.
+ *
+ * Order matters at the composition root: `saved_views` has foreign keys into
+ * identity's `users` and workspaces' `workspaces`, and nothing declares that
+ * dependency — list this after both, and after `ContentPlugin` itself.
+ */
+export declare function ContentViewsPlugin(options: ContentViewsPluginOptions): ServerPlugin;
+//# sourceMappingURL=content-views-plugin.d.ts.map

package/dist/lib/utils/content-views-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-views-plugin.d.ts","sourceRoot":"","sources":["../../../src/lib/utils/content-views-plugin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAG/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,8CAA8C;AAC9C,MAAM,WAAW,yBAAyB;IACtC;;;;;;OAMG;IACH,OAAO,EAAE,mBAAmB,CAAC;CAChC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAC9B,OAAO,EAAE,yBAAyB,GACnC,YAAY,CAqBd"}

package/dist/lib/utils/content-views-plugin.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContentViewsPlugin = ContentViewsPlugin;
+const node_path_1 = require("node:path");
+const content_views_module_1 = require("../views/content-views.module");
+const describe_views_api_1 = require("../docs/describe-views-api");
+/**
+ * Saved list views — the named filter/sort/column slices an editor returns to.
+ *
+ * A **separate `ServerPlugin` entry from the same package** as `ContentPlugin`,
+ * and deliberately so. `ServerPlugin.migrations` is one descriptor, and
+ * content's is already carrying the HOST's generated collection tables; a
+ * second entry is how this package ships its own fixed tables without touching
+ * that contract. The host applies both under their own tracking tables.
+ *
+ * Order matters at the composition root: `saved_views` has foreign keys into
+ * identity's `users` and workspaces' `workspaces`, and nothing declares that
+ * dependency — list this after both, and after `ContentPlugin` itself.
+ */
+function ContentViewsPlugin(options) {
+    return {
+        name: 'content-views',
+        module: content_views_module_1.ContentViewsModule.forRoot(options.content.registry),
+        // src/lib/utils → ../../../migrations = <pkg>/migrations.
+        migrations: {
+            dir: () => (0, node_path_1.join)(__dirname, '../../../migrations'),
+            table: '__drizzle_migrations_content_views'
+        },
+        // `SavedView` is a framework-free `interface` (ADR-0003 forbids
+        // decorating it) and its `scope` is `content:<typeName>`, which only
+        // the registry knows — so the swagger scanner sees neither the shape
+        // nor the values, and this hook is where both become visible.
+        docs: {
+            decorate: (document) => (0, describe_views_api_1.describeViewsApi)(document, options.content.registry.serializeAll())
+        }
+    };
+}

package/dist/lib/views/application/queries/saved-views.query.d.ts

@@ -0,0 +1,16 @@
+import type { SavedView } from '../../domain/saved-view';
+import { type SavedViewRecord, type SavedViewRepository } from '../../domain/saved-view.repository';
+/**
+ * The read side: every view a caller may see for one list, with the two
+ * per-caller flags the switcher renders from (`isOwn` gates Save and Delete,
+ * `isDefault` marks the row and drives the landing view).
+ */
+export declare class SavedViewsQuery {
+    private readonly repository;
+    constructor(repository: SavedViewRepository);
+    /** Views visible to `readerId` in this workspace + scope. */
+    list(workspaceId: string, scope: string, readerId: string): Promise<SavedView[]>;
+}
+/** Projects a stored row into the API shape for one reader. */
+export declare function toSavedView(record: SavedViewRecord, readerId: string, defaultId: string | null): SavedView;
+//# sourceMappingURL=saved-views.query.d.ts.map

package/dist/lib/views/application/queries/saved-views.query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saved-views.query.d.ts","sourceRoot":"","sources":["../../../../../src/lib/views/application/queries/saved-views.query.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAEH,KAAK,eAAe,EACpB,KAAK,mBAAmB,EAC3B,MAAM,oCAAoC,CAAC;AAE5C;;;;GAIG;AACH,qBACa,eAAe;IAGpB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,mBAAmB;IAGpD,6DAA6D;IACvD,IAAI,CACN,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,SAAS,EAAE,CAAC;CAS1B;AAED,+DAA+D;AAC/D,wBAAgB,WAAW,CACvB,MAAM,EAAE,eAAe,EACvB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAAG,IAAI,GACzB,SAAS,CAYX"}

package/dist/lib/views/application/queries/saved-views.query.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SavedViewsQuery = void 0;
+exports.toSavedView = toSavedView;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const saved_view_repository_1 = require("../../domain/saved-view.repository");
+/**
+ * The read side: every view a caller may see for one list, with the two
+ * per-caller flags the switcher renders from (`isOwn` gates Save and Delete,
+ * `isDefault` marks the row and drives the landing view).
+ */
+let SavedViewsQuery = class SavedViewsQuery {
+    repository;
+    constructor(repository) {
+        this.repository = repository;
+    }
+    /** Views visible to `readerId` in this workspace + scope. */
+    async list(workspaceId, scope, readerId) {
+        const [records, defaultId] = await Promise.all([
+            this.repository.listVisible(workspaceId, scope, readerId),
+            this.repository.findDefaultId(readerId, scope)
+        ]);
+        return records.map((record) => toSavedView(record, readerId, defaultId));
+    }
+};
+exports.SavedViewsQuery = SavedViewsQuery;
+exports.SavedViewsQuery = SavedViewsQuery = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(0, (0, common_1.Inject)(saved_view_repository_1.SAVED_VIEW_REPOSITORY)),
+    tslib_1.__metadata("design:paramtypes", [Object])
+], SavedViewsQuery);
+/** Projects a stored row into the API shape for one reader. */
+function toSavedView(record, readerId, defaultId) {
+    return {
+        id: record.id,
+        scope: record.scope,
+        name: record.name,
+        visibility: record.visibility,
+        ownerId: record.ownerId,
+        isOwn: record.ownerId === readerId,
+        isDefault: record.id === defaultId,
+        payload: record.payload,
+        updatedAt: record.updatedAt.toISOString()
+    };
+}