@orthacms/content-server 0.4.2 → 0.5.0

package/dist/lib/entries/http/dto/extension-bag.validator.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_EXTENSION_KEYS = void 0;
+exports.MaxExtensionKeys = MaxExtensionKeys;
+const class_validator_1 = require("class-validator");
+/**
+ * Most extension keys one save may carry.
+ *
+ * A key names an installed plugin, so the real ceiling is single digits; this is
+ * a guard against a client posting an object with thousands of keys, each of
+ * which the registry would otherwise walk on every write. Deliberately not a
+ * bound on the *values* — those are the extensions' own contracts, and
+ * content-server declares the bag opaque.
+ */
+exports.MAX_EXTENSION_KEYS = 16;
+/** Rejects an extension bag with more keys than {@link MAX_EXTENSION_KEYS}. */
+function MaxExtensionKeys(options) {
+    return function (target, propertyName) {
+        (0, class_validator_1.registerDecorator)({
+            name: 'maxExtensionKeys',
+            target: target.constructor,
+            propertyName,
+            options,
+            validator: {
+                validate(value) {
+                    if (value === undefined || value === null)
+                        return true;
+                    if (typeof value !== 'object' || Array.isArray(value)) {
+                        // `@IsObject()` owns that message; saying it twice
+                        // would put two sentences about one field in the 400.
+                        return true;
+                    }
+                    return (Object.keys(value).length <=
+                        exports.MAX_EXTENSION_KEYS);
+                },
+                defaultMessage() {
+                    return `extensions may name at most ${exports.MAX_EXTENSION_KEYS} plugins`;
+                }
+            }
+        });
+    };
+}

package/dist/lib/entries/http/dto/save-entry.dto.d.ts

@@ -44,5 +44,21 @@ export declare class SaveEntryDto {
      * the workspace. Read on create only.
      */
     localeGroupId?: string;
+    /**
+     * State a **different plugin** owns about this entry, keyed by that plugin's
+     * extension key — opaque here, exactly like {@link locale}: content-server
+     * forwards the bag to the bound entry-write extensions and never looks
+     * inside it. `@orthacms/segments-server` reads `access` from it.
+     *
+     * It rides the save body rather than a second request so the entry, its
+     * links, the plugin's state and the version recording all of them commit in
+     * one transaction — and so the version records what the save applied instead
+     * of what it replaced.
+     *
+     * A key **omitted** is left alone; a key present is written. An **unknown**
+     * key is ignored rather than refused, because the same client may be talking
+     * to a deployment without that plugin installed.
+     */
+    extensions?: Record<string, unknown>;
 }
 //# sourceMappingURL=save-entry.dto.d.ts.map

package/dist/lib/entries/http/dto/save-entry.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"save-entry.dto.d.ts","sourceRoot":"","sources":["../../../../../src/lib/entries/http/dto/save-entry.dto.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAiBjE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,YAAY;IACrB,wCAAwC;IASxC,MAAM,EAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC;;;OAGG;IAwBH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAE1C;;;;;OAKG;IAWH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;;OAKG;IASH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B"}
+{"version":3,"file":"save-entry.dto.d.ts","sourceRoot":"","sources":["../../../../../src/lib/entries/http/dto/save-entry.dto.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAqBjE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,YAAY;IACrB,wCAAwC;IASxC,MAAM,EAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC;;;OAGG;IAwBH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAE1C;;;;;OAKG;IAWH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;;OAKG;IASH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;;;;;;;;;;;;OAcG;IAYH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC"}

package/dist/lib/entries/http/dto/save-entry.dto.js

@@ -5,6 +5,7 @@ const tslib_1 = require("tslib");
 const swagger_1 = require("@nestjs/swagger");
 const class_validator_1 = require("class-validator");
 const relation_delta_map_validator_1 = require("./relation-delta-map.validator");
+const extension_bag_validator_1 = require("./extension-bag.validator");
 /** Longest accepted locale slug (BCP-47's practical bound). */
 const LOCALE_MAX_LENGTH = 35;
 /** OpenAPI schema of one uuid-array leg of a relation delta. */
@@ -58,6 +59,22 @@ class SaveEntryDto {
      * the workspace. Read on create only.
      */
     localeGroupId;
+    /**
+     * State a **different plugin** owns about this entry, keyed by that plugin's
+     * extension key — opaque here, exactly like {@link locale}: content-server
+     * forwards the bag to the bound entry-write extensions and never looks
+     * inside it. `@orthacms/segments-server` reads `access` from it.
+     *
+     * It rides the save body rather than a second request so the entry, its
+     * links, the plugin's state and the version recording all of them commit in
+     * one transaction — and so the version records what the save applied instead
+     * of what it replaced.
+     *
+     * A key **omitted** is left alone; a key present is written. An **unknown**
+     * key is ignored rather than refused, because the same client may be talking
+     * to a deployment without that plugin installed.
+     */
+    extensions;
 }
 exports.SaveEntryDto = SaveEntryDto;
 tslib_1.__decorate([
@@ -118,3 +135,16 @@ tslib_1.__decorate([
     (0, class_validator_1.IsUUID)(),
     tslib_1.__metadata("design:type", String)
 ], SaveEntryDto.prototype, "localeGroupId", void 0);
+tslib_1.__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: 'object',
+        maxProperties: extension_bag_validator_1.MAX_EXTENSION_KEYS,
+        additionalProperties: true,
+        example: { access: { allow: [], deny: [] } },
+        description: 'Per-plugin state stored alongside the entry, keyed by extension (e.g. `access`). Opaque to content-server: forwarded to the bound entry-write extensions, written inside the save’s transaction, and captured by the revision. An omitted key is left unchanged; an unknown key is ignored.'
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsObject)(),
+    (0, extension_bag_validator_1.MaxExtensionKeys)(),
+    tslib_1.__metadata("design:type", Object)
+], SaveEntryDto.prototype, "extensions", void 0);

package/dist/lib/entries/infrastructure/persistence/entry-writer.service.d.ts

@@ -1,6 +1,7 @@
 import { OutboxWriter, UnitOfWork, type Database, type EventActor } from '@orthacms/database';
 import { type ContentEntryExtension } from '../../../extension/entry-extension';
 import { type MediaAssetResolver } from '../../../extension/media-asset-resolver';
+import { EntryWriteExtensionRegistry } from '../../../extension/entry-write-extension';
 import type { AnyContentType } from '../../../types/content-type';
 import { EntryValidationService, type ValidationIssue } from '../../../validation/services/entry-validation.service';
 import type { EntryRecord, RelationDelta, RelationFieldView } from '../../types/entry-list-view';
@@ -35,9 +36,10 @@ export declare class EntryWriterService {
     private readonly validation;
     private readonly relations;
     private readonly revisionStore;
+    private readonly writeExtensions;
     private readonly extension?;
     private readonly mediaResolver?;
-    constructor(db: Database, uow: UnitOfWork, outbox: OutboxWriter, validation: EntryValidationService, relations: RelationLinkService, revisionStore: RevisionStore, extension?: ContentEntryExtension | undefined, mediaResolver?: MediaAssetResolver | undefined);
+    constructor(db: Database, uow: UnitOfWork, outbox: OutboxWriter, validation: EntryValidationService, relations: RelationLinkService, revisionStore: RevisionStore, writeExtensions: EntryWriteExtensionRegistry, extension?: ContentEntryExtension | undefined, mediaResolver?: MediaAssetResolver | undefined);
     /**
      * The active unit-of-work transaction, typed as the handle drizzle hands a
      * `db.transaction` callback.
@@ -49,16 +51,32 @@ export declare class EntryWriterService {
      * `uow.run(...)`, where the two are the same object.
      */
     private tx;
-    /** One event per affected row, built from each row's own id. */
+    /**
+     * One event per affected row, built from each row's own id **and the row
+     * itself** — the latter because an entry event carries a frozen `title`
+     * snapshot, and a title is per row rather than per batch.
+     */
     private eventsFor;
+    /**
+     * What an entry event says about its subject: the type, the workspace, and
+     * a **frozen** human label read off the row being written.
+     *
+     * Frozen rather than looked up, for the same reason `actor_email` is: the
+     * audit row has to outlive its subject. `entry.purged` destroys the only
+     * other copy of the name, so a row that stored just the uuid could never
+     * answer "what did they delete" — not even in principle.
+     */
+    private subjectOf;
     /**
      * Append `events` to the transactional outbox, stamped with the acting
-     * user, from inside the active unit of work.
+     * principal, from inside the active unit of work.
      *
-     * `actor` is `null` for a write made with an API token: revisions record a
-     * *user* id and a token is not one, and an audit row naming a person who
-     * did not do it is worse than one that says "System". Attributing a token's
-     * writes is a real gap that wants its own column, not a misused one.
+     * A **token** may be the actor here, and that is the whole difference from
+     * {@link revisionActorId} below: the audit row now carries an `actor_type`,
+     * so naming a credential is a fact rather than a misused user column. A
+     * write made with a bearer token used to reach the log as "System", which
+     * left every write over the public REST API, GraphQL and MCP unattributable
+     * to the credential that made it.
      */
     private emit;
     /**
@@ -119,6 +137,14 @@ export declare class EntryWriterService {
      * two of them from deadlocking on the pair.
      */
     private appendRevisionsFor;
+    /**
+     * The rows behind a set of ids, on this transaction.
+     *
+     * Soft-deleted rows are **included**: a locale in the trash is still a row
+     * whose state an extension just changed, and it comes back on restore
+     * expecting a timeline that says so.
+     */
+    private rowsByIds;
     /**
      * Create an entry **owned by `workspaceId`** (stamped onto the row so the
      * reader's workspace filter and every later scoped write see it). A
@@ -136,8 +162,13 @@ export declare class EntryWriterService {
      * extension validates them and stamps the envelope columns (a
      * `localeGroupId` makes the row a **sibling** in that translation group). A
      * duplicate `(group, locale)` surfaces as a **409** via {@link uniqueGuarded}.
+     *
+     * `extensions` is the same kind of thing one plugin further out: an opaque
+     * bag forwarded to the bound {@link EntryWriteExtensionRegistry}, so a plugin
+     * that owns state *about* an entry (segments' audiences) writes it inside
+     * this transaction and has it captured by the same version.
      */
-    create(type: AnyContentType, values: Record<string, unknown>, workspaceId: string, relations?: Record<string, RelationDelta>, locale?: string, localeGroupId?: string, actor?: EventActor | null): Promise<EntryRecord>;
+    create(type: AnyContentType, values: Record<string, unknown>, workspaceId: string, relations?: Record<string, RelationDelta>, locale?: string, localeGroupId?: string, actor?: EventActor | null, extensions?: Record<string, unknown>): Promise<EntryRecord>;
     /**
      * First page (+ total) of every relation field's links for one live entry,
      * keyed by field name — what the editor loads on open. Each field is
@@ -180,6 +211,17 @@ export declare class EntryWriterService {
          * really did change.
          */
         appendRevision?: boolean;
+        /**
+         * Opaque per-plugin state to store alongside the entry, forwarded to
+         * the bound {@link EntryWriteExtensionRegistry} inside this write's
+         * transaction. A key the caller omits is left alone — a save that
+         * said nothing about audiences must not clear them.
+         *
+         * A **restore** passes the restored version's `snapshot.extra` here,
+         * which is what makes going back to Tuesday put Tuesday's audiences
+         * back too rather than leaving today's readers on Tuesday's words.
+         */
+        extensions?: Record<string, unknown>;
     }): Promise<EntryRecord>;
     /**
      * Stamp `status='published'` + `published_at`/`updated_at` on one live row,

package/dist/lib/entries/infrastructure/persistence/entry-writer.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entry-writer.service.d.ts","sourceRoot":"","sources":["../../../../../src/lib/entries/infrastructure/persistence/entry-writer.service.ts"],"names":[],"mappings":"AAoBA,OAAO,EAGH,YAAY,EACZ,UAAU,EACV,KAAK,QAAQ,EAEb,KAAK,UAAU,EAClB,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EAEH,KAAK,qBAAqB,EAC7B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAEH,KAAK,kBAAkB,EAC1B,MAAM,yCAAyC,CAAC;AAEjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAGlE,OAAO,EACH,sBAAsB,EACtB,KAAK,eAAe,EACvB,MAAM,uDAAuD,CAAC;AAC/D,OAAO,KAAK,EACR,WAAW,EACX,aAAa,EACb,iBAAiB,EACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,OAAO,EAEH,mBAAmB,EACnB,KAAK,aAAa,EACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAEH,KAAK,aAAa,EACrB,MAAM,qDAAqD,CAAC;AAW7D,oFAAoF;AACpF,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAenC;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,kBAAkB;IAEL,OAAO,CAAC,QAAQ,CAAC,EAAE;IAIrC,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAI1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAK9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAO3B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;gBAvBI,EAAE,EAAE,QAAQ,EAI9B,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,YAAY,EACpB,UAAU,EAAE,sBAAsB,EAClC,SAAS,EAAE,mBAAmB,EAI9B,aAAa,EAAE,aAAa,EAK5B,SAAS,CAAC,EAAE,qBAAqB,YAAA,EAOjC,aAAa,CAAC,EAAE,kBAAkB,YAAA;IAGvD;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE;IAIV,gEAAgE;IAChE,OAAO,CAAC,SAAS;IAOjB;;;;;;;;OAQG;YACW,IAAI;IASlB;;;;;;;;;OASG;IACH,OAAO,CAAC,aAAa;IAarB;;;;;;;;;;;;;;;OAeG;YACW,sBAAsB;IAwDpC;;;;;;;OAOG;YACW,QAAQ;IAuBtB;;;;;;;OAOG;YACW,cAAc;IAwB5B;;;;;;;;;;OAUG;YACW,kBAAkB;IAsBhC;;;;;;;;;;;;;;;;;OAiBG;IACG,MAAM,CACR,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,EACzC,MAAM,CAAC,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,GAC1B,OAAO,CAAC,WAAW,CAAC;IAyJvB;;;;;OAKG;IACG,YAAY,CACd,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAM7C;;;;OAIG;IACG,gBAAgB,CAClB,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,iBAAiB,CAAC;IAe7B;;;;;;OAMG;YACW,mBAAmB;IAuCjC,yEAAyE;IACzE,OAAO,CAAC,YAAY;IAUpB,oDAAoD;IAC9C,MAAM,CACR,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,CAAC;IAMvB;;;;;OAKG;IACG,MAAM,CACR,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,EACzC,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,EACzB,OAAO,CAAC,EAAE;QACN;;;;;;;;WAQG;QACH,cAAc,CAAC,EAAE,OAAO,CAAC;KAC5B,GACF,OAAO,CAAC,WAAW,CAAC;IA2JvB;;;OAGG;IACG,aAAa,CACf,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;IAa3B;;;;;;;;;;OAUG;IACG,qBAAqB,CACvB,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,cAAc,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,IAAI,CAAC;IAShB;;;OAGG;IACG,uBAAuB,CACzB,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAIhB,mFAAmF;IAC7E,SAAS,CACX,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;IAa3B;;;;;OAKG;IACG,sBAAsB,CACxB,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAkB5B,sFAAsF;IAChF,iBAAiB,CACnB,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAoBhB;;;;OAIG;IACG,iBAAiB,CACnB,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,EAAE,CAAC;IAkBpB;;;;;;;;;;;;OAYG;IACG,aAAa,CACf,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC;IAsBlB;;;;;OAKG;IACG,MAAM,CACR,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,GAC1B,OAAO,CAAC,IAAI,CAAC;IAwChB;;;;;OAKG;IACG,OAAO,CACT,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,GAC1B,OAAO,CAAC,WAAW,CAAC;IA6BvB,2EAA2E;IACrE,KAAK,CACP,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,GAC1B,OAAO,CAAC,IAAI,CAAC;IA0BhB,wEAAwE;IAClE,UAAU,CACZ,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,GAC1B,OAAO,CAAC,gBAAgB,CAAC;IAyC5B,4EAA4E;IACtE,SAAS,CACX,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,GAC1B,OAAO,CAAC,gBAAgB,CAAC;IA8B5B;;;;;OAKG;IACG,WAAW,CACb,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,GAC1B,OAAO,CAAC,gBAAgB,CAAC;IAkC5B;;;;;OAKG;IACH;;;;;;;;;;;;;;OAcG;YACW,eAAe;YAcf,aAAa;IA8C3B,2EAA2E;IAC3E,OAAO,CAAC,OAAO;IAIf;;;;OAIG;IACH,OAAO,CAAC,KAAK;IAIb;;;OAGG;IACH,OAAO,CAAC,SAAS;IAajB;;;;OAIG;IACG,QAAQ,CACV,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,QAAQ,GAAG,aAAuB,GACzC,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;IAS3B;;;;OAIG;IACG,aAAa,CACf,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,QAAQ,GAAG,aAAuB,GACzC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAgB5B;;;;;;;;;;;;;OAaG;IACH;;;;;;;;;;;;;;;;;;OAkBG;YACW,qBAAqB;YA4DrB,qBAAqB;IAiHnC;;;;;;;;;;;;;;OAcG;YACW,kBAAkB;IAoDhC;;;;;;;;;;OAUG;YACW,uBAAuB;IAoBrC;;;;;;;;OAQG;IACG,sBAAsB,CACxB,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,eAAe,EAAE,CAAC;IA8B7B,qEAAqE;IACrE,OAAO,CAAC,WAAW;IAanB,0DAA0D;IAC1D,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,QAAQ;CAKnB"}
+{"version":3,"file":"entry-writer.service.d.ts","sourceRoot":"","sources":["../../../../../src/lib/entries/infrastructure/persistence/entry-writer.service.ts"],"names":[],"mappings":"AAoBA,OAAO,EAIH,YAAY,EACZ,UAAU,EACV,KAAK,QAAQ,EAEb,KAAK,UAAU,EAClB,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EAEH,KAAK,qBAAqB,EAC7B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAEH,KAAK,kBAAkB,EAC1B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AAEvF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAGlE,OAAO,EACH,sBAAsB,EACtB,KAAK,eAAe,EACvB,MAAM,uDAAuD,CAAC;AAC/D,OAAO,KAAK,EACR,WAAW,EACX,aAAa,EACb,iBAAiB,EACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAQjE,OAAO,EAEH,mBAAmB,EACnB,KAAK,aAAa,EACrB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAEH,KAAK,aAAa,EACrB,MAAM,qDAAqD,CAAC;AAY7D,oFAAoF;AACpF,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAenC;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,kBAAkB;IAEL,OAAO,CAAC,QAAQ,CAAC,EAAE;IAIrC,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAI1B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAO9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAKhC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAO3B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;gBA9BI,EAAE,EAAE,QAAQ,EAI9B,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,YAAY,EACpB,UAAU,EAAE,sBAAsB,EAClC,SAAS,EAAE,mBAAmB,EAI9B,aAAa,EAAE,aAAa,EAO5B,eAAe,EAAE,2BAA2B,EAK5C,SAAS,CAAC,EAAE,qBAAqB,YAAA,EAOjC,aAAa,CAAC,EAAE,kBAAkB,YAAA;IAGvD;;;;;;;;;OASG;IACH,OAAO,CAAC,EAAE;IAIV;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAOjB;;;;;;;;OAQG;IACH,OAAO,CAAC,SAAS;IAYjB;;;;;;;;;;OAUG;YACW,IAAI;IASlB;;;;;;;;;OASG;IACH,OAAO,CAAC,aAAa;IAarB;;;;;;;;;;;;;;;OAeG;YACW,sBAAsB;IAwDpC;;;;;;;OAOG;YACW,QAAQ;IAuBtB;;;;;;;OAOG;YACW,cAAc;IAmC5B;;;;;;;;;;OAUG;YACW,kBAAkB;IA0ChC;;;;;;OAMG;YACW,SAAS;IAsBvB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,MAAM,CACR,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,EACzC,MAAM,CAAC,EAAE,MAAM,EACf,aAAa,CAAC,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,EACzB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACrC,OAAO,CAAC,WAAW,CAAC;IA6LvB;;;;;OAKG;IACG,YAAY,CACd,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAM7C;;;;OAIG;IACG,gBAAgB,CAClB,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,iBAAiB,CAAC;IAe7B;;;;;;OAMG;YACW,mBAAmB;IAuCjC,yEAAyE;IACzE,OAAO,CAAC,YAAY;IAUpB,oDAAoD;IAC9C,MAAM,CACR,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,WAAW,CAAC;IAMvB;;;;;OAKG;IACG,MAAM,CACR,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,EACzC,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,EACzB,OAAO,CAAC,EAAE;QACN;;;;;;;;WAQG;QACH,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB;;;;;;;;;WASG;QACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACxC,GACF,OAAO,CAAC,WAAW,CAAC;IAmLvB;;;OAGG;IACG,aAAa,CACf,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;IAa3B;;;;;;;;;;OAUG;IACG,qBAAqB,CACvB,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,cAAc,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,IAAI,CAAC;IAShB;;;OAGG;IACG,uBAAuB,CACzB,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAIhB,mFAAmF;IAC7E,SAAS,CACX,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;IAa3B;;;;;OAKG;IACG,sBAAsB,CACxB,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAkB5B,sFAAsF;IAChF,iBAAiB,CACnB,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAoBhB;;;;OAIG;IACG,iBAAiB,CACnB,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,EAAE,CAAC;IAkBpB;;;;;;;;;;;;OAYG;IACG,aAAa,CACf,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC;IAsBlB;;;;;OAKG;IACG,MAAM,CACR,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,GAC1B,OAAO,CAAC,IAAI,CAAC;IA8ChB;;;;;OAKG;IACG,OAAO,CACT,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,GAC1B,OAAO,CAAC,WAAW,CAAC;IAqCvB,2EAA2E;IACrE,KAAK,CACP,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,GAC1B,OAAO,CAAC,IAAI,CAAC;IAkChB,wEAAwE;IAClE,UAAU,CACZ,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,GAC1B,OAAO,CAAC,gBAAgB,CAAC;IA6C5B,4EAA4E;IACtE,SAAS,CACX,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,GAC1B,OAAO,CAAC,gBAAgB,CAAC;IA8B5B;;;;;OAKG;IACG,WAAW,CACb,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,UAAU,GAAG,IAAI,GAC1B,OAAO,CAAC,gBAAgB,CAAC;IAkC5B;;;;;OAKG;IACH;;;;;;;;;;;;;;OAcG;YACW,eAAe;YAcf,aAAa;IA8C3B,2EAA2E;IAC3E,OAAO,CAAC,OAAO;IAIf;;;;OAIG;IACH,OAAO,CAAC,KAAK;IAIb;;;OAGG;IACH,OAAO,CAAC,SAAS;IAajB;;;;OAIG;IACG,QAAQ,CACV,IAAI,EAAE,cAAc,EACpB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,QAAQ,GAAG,aAAuB,GACzC,OAAO,CAAC,GAAG,GAAG,SAAS,CAAC;IAS3B;;;;OAIG;IACG,aAAa,CACf,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,EAAE,EACb,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE,QAAQ,GAAG,aAAuB,GACzC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAgB5B;;;;;;;;;;;;;OAaG;IACH;;;;;;;;;;;;;;;;;;OAkBG;YACW,qBAAqB;YA4DrB,qBAAqB;IAiHnC;;;;;;;;;;;;;;OAcG;YACW,kBAAkB;IAoDhC;;;;;;;;;;OAUG;YACW,uBAAuB;IAoBrC;;;;;;;;OAQG;IACG,sBAAsB,CACxB,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,eAAe,EAAE,CAAC;IA8B7B,qEAAqE;IACrE,OAAO,CAAC,WAAW;IAanB,0DAA0D;IAC1D,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,QAAQ;CAKnB"}

package/dist/lib/entries/infrastructure/persistence/entry-writer.service.js

@@ -10,6 +10,7 @@ const utils_server_1 = require("@orthacms/utils-server");
 const content_domain_1 = require("@orthacms/content-domain");
 const entry_extension_1 = require("../../../extension/entry-extension");
 const media_asset_resolver_1 = require("../../../extension/media-asset-resolver");
+const entry_write_extension_1 = require("../../../extension/entry-write-extension");
 const media_accept_1 = require("./media-accept");
 const content_type_1 = require("../../../types/content-type");
 const fields_1 = require("../../../types/fields");
@@ -58,19 +59,28 @@ let EntryWriterService = class EntryWriterService {
     validation;
     relations;
     revisionStore;
+    writeExtensions;
     extension;
     mediaResolver;
     constructor(db, 
     // The transaction boundary every write now runs inside, and the outbox
     // that joins it. Together they are what makes an entry's domain event
     // commit with — and never without — the row it describes.
-    uow, outbox, validation, relations, revisionStore, extension, mediaResolver) {
+    uow, outbox, validation, relations, revisionStore, 
+    // Every bound entry-write extension (segments' reader entitlements
+    // today) — state another plugin owns *about* the entry, written on this
+    // save's transaction and captured by its revision. A registry rather
+    // than a token because Nest cannot merge two bindings of one token, and
+    // an extension that silently stopped being called would silently stop
+    // restricting content.
+    writeExtensions, extension, mediaResolver) {
         this.db = db;
         this.uow = uow;
         this.outbox = outbox;
         this.validation = validation;
         this.relations = relations;
         this.revisionStore = revisionStore;
+        this.writeExtensions = writeExtensions;
         this.extension = extension;
         this.mediaResolver = mediaResolver;
     }
@@ -87,18 +97,40 @@ let EntryWriterService = class EntryWriterService {
     tx() {
         return this.uow.current();
     }
-    /** One event per affected row, built from each row's own id. */
+    /**
+     * One event per affected row, built from each row's own id **and the row
+     * itself** — the latter because an entry event carries a frozen `title`
+     * snapshot, and a title is per row rather than per batch.
+     */
     eventsFor(rows, build) {
-        return rows.map((row) => build(row['id']));
+        return rows.map((row) => build(row['id'], row));
+    }
+    /**
+     * What an entry event says about its subject: the type, the workspace, and
+     * a **frozen** human label read off the row being written.
+     *
+     * Frozen rather than looked up, for the same reason `actor_email` is: the
+     * audit row has to outlive its subject. `entry.purged` destroys the only
+     * other copy of the name, so a row that stored just the uuid could never
+     * answer "what did they delete" — not even in principle.
+     */
+    subjectOf(type, workspaceId, row) {
+        return {
+            contentType: type.name,
+            workspaceId,
+            title: row ? (0, entry_row_1.entryTitle)(type, row) : null
+        };
     }
     /**
      * Append `events` to the transactional outbox, stamped with the acting
-     * user, from inside the active unit of work.
+     * principal, from inside the active unit of work.
      *
-     * `actor` is `null` for a write made with an API token: revisions record a
-     * *user* id and a token is not one, and an audit row naming a person who
-     * did not do it is worse than one that says "System". Attributing a token's
-     * writes is a real gap that wants its own column, not a misused one.
+     * A **token** may be the actor here, and that is the whole difference from
+     * {@link revisionActorId} below: the audit row now carries an `actor_type`,
+     * so naming a credential is a fact rather than a misused user column. A
+     * write made with a bearer token used to reach the log as "System", which
+     * left every write over the public REST API, GraphQL and MCP unattributable
+     * to the credential that made it.
      */
     async emit(events, actor) {
         if (events.length === 0)
@@ -216,6 +248,17 @@ let EntryWriterService = class EntryWriterService {
     async appendRevision(tx, type, row, workspaceId, actorId) {
         const id = row['id'];
         const links = await this.relations.snapshotLinks(tx, type, row);
+        // Whatever the bound extensions hold for this row *now* — read on the
+        // save's own transaction, after any `apply` has run, so the version
+        // records what committed. Captured unconditionally, including for a
+        // sibling row this save only touched indirectly: a version that omitted
+        // the state it did not change would restore as a version that had none.
+        const extra = await this.writeExtensions.captureAll({
+            executor: tx,
+            type,
+            entryId: id,
+            workspaceId
+        });
         await this.revisionStore.lockEntry(tx, id);
         const number = await this.revisionStore.nextNumber(tx, id);
         const revision = revision_1.Revision.createDraft({
@@ -225,7 +268,7 @@ let EntryWriterService = class EntryWriterService {
             localeGroupId: row['localeGroupId'] ?? null,
             locale: row['locale'] ?? null,
             number,
-            snapshot: (0, revision_snapshot_1.buildSnapshot)(type, row, links),
+            snapshot: (0, revision_snapshot_1.buildSnapshot)(type, row, links, extra),
             createdBy: actorId
         });
         await this.revisionStore.append(tx, revision);
@@ -241,14 +284,50 @@ let EntryWriterService = class EntryWriterService {
      * advisory lock, and a stable order across concurrent savers is what keeps
      * two of them from deadlocking on the pair.
      */
-    async appendRevisionsFor(tx, type, rows, workspaceId, actorId) {
-        if (!rows?.length)
+    async appendRevisionsFor(tx, type, rows, workspaceId, actorId, 
+    /**
+     * Ids of further rows an **entry-write extension** changed, which it
+     * reports rather than returns whole — it wrote a table of its own, not
+     * these ones, so it has no row to hand back. Merged with `rows` and
+     * deduplicated by id: one save can reach a sibling through both paths
+     * (a shared field *and* an audience), and appending two revisions for it
+     * would read as two edits.
+     */
+    alsoChangedIds = []) {
+        const byId = new Map();
+        for (const row of rows ?? [])
+            byId.set(String(row['id']), row);
+        const missing = alsoChangedIds.filter((id) => !byId.has(id));
+        for (const row of await this.rowsByIds(tx, type, missing, workspaceId)) {
+            byId.set(String(row['id']), row);
+        }
+        if (!byId.size)
             return;
-        const ordered = [...rows].sort((a, b) => String(a['id']).localeCompare(String(b['id'])));
+        const ordered = [...byId.values()].sort((a, b) => String(a['id']).localeCompare(String(b['id'])));
         for (const row of ordered) {
             await this.appendRevision(tx, type, row, workspaceId, actorId);
         }
     }
+    /**
+     * The rows behind a set of ids, on this transaction.
+     *
+     * Soft-deleted rows are **included**: a locale in the trash is still a row
+     * whose state an extension just changed, and it comes back on restore
+     * expecting a timeline that says so.
+     */
+    async rowsByIds(tx, type, ids, workspaceId) {
+        if (!ids.length)
+            return [];
+        const columns = type.table;
+        const id = columns['id'];
+        const workspace = columns['workspaceId'];
+        if (!id || !workspace)
+            return [];
+        return (await tx
+            .select()
+            .from(type.table)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.inArray)(id, [...ids]), (0, drizzle_orm_1.eq)(workspace, workspaceId))));
+    }
     /**
      * Create an entry **owned by `workspaceId`** (stamped onto the row so the
      * reader's workspace filter and every later scoped write see it). A
@@ -266,9 +345,14 @@ let EntryWriterService = class EntryWriterService {
      * extension validates them and stamps the envelope columns (a
      * `localeGroupId` makes the row a **sibling** in that translation group). A
      * duplicate `(group, locale)` surfaces as a **409** via {@link uniqueGuarded}.
+     *
+     * `extensions` is the same kind of thing one plugin further out: an opaque
+     * bag forwarded to the bound {@link EntryWriteExtensionRegistry}, so a plugin
+     * that owns state *about* an entry (segments' audiences) writes it inside
+     * this transaction and has it captured by the same version.
      */
-    async create(type, values, workspaceId, relations, locale, localeGroupId, actor) {
-        const actorId = actor?.id ?? null;
+    async create(type, values, workspaceId, relations, locale, localeGroupId, actor, extensions) {
+        const actorId = revisionActorId(actor);
         // `coerceValues` stamps every declared field onto the bag, so the
         // "sent in both places" check below has to read the RAW body — after
         // coercion every field looks present.
@@ -342,16 +426,42 @@ let EntryWriterService = class EntryWriterService {
             // group must land consistent with the group's shared values.
             // A no-op for a fresh, sibling-less group.
             const touched = await this.extension?.afterUpdate(tx, type, inserted, coerced, workspaceId, { created: true });
+            // Anything a bound plugin was asked to store about this
+            // entry — the row exists now, so it finally has something to
+            // hang off, and it lands before the snapshot below reads it
+            // back. A create is the case that forced this into the write
+            // at all: until the insert there is no id to write against.
+            const alsoChanged = await this.writeExtensions.applyAll({
+                executor: tx,
+                type,
+                entryId: id,
+                workspaceId
+            }, extensions);
+            // …and, for a row joining an existing locale group, whatever
+            // that group already holds. `applyAll` runs only for keys
+            // the caller sent, and "create a translation" sends none —
+            // so without this a translation of a restricted article was
+            // a public copy of it. After `applyAll`, so an extension the
+            // caller just told what to store is not overwritten.
+            await this.writeExtensions.inheritAll({
+                executor: tx,
+                type,
+                entryId: id,
+                workspaceId
+            });
             // Snapshot the just-created document as its first revision,
             // inside this same transaction.
             await this.appendRevision(tx, type, inserted, workspaceId, actorId ?? null);
-            // …and one for every sibling the extension rewrote, so a
-            // shared value landing on them is in their history too.
-            await this.appendRevisionsFor(tx, type, touched, workspaceId, actorId ?? null);
+            // …and one for every sibling either extension path rewrote,
+            // so a shared value — or an audience — landing on them is in
+            // their history too.
+            await this.appendRevisionsFor(tx, type, touched, workspaceId, actorId ?? null, alsoChanged);
             // Inside the transaction, so the fact and the row it
             // describes commit together or not at all — the whole point
             // of the outbox.
-            await this.emit([(0, entry_events_1.entryCreated)(id, type.name)], actor);
+            await this.emit([
+                (0, entry_events_1.entryCreated)(id, this.subjectOf(type, workspaceId, inserted))
+            ], actor);
             return inserted;
         }), type);
         return (0, entry_row_1.toRecord)(type, row);
@@ -431,7 +541,7 @@ let EntryWriterService = class EntryWriterService {
      * type validates now.
      */
     async update(type, id, values, workspaceId, relations, actor, options) {
-        const actorId = actor?.id ?? null;
+        const actorId = revisionActorId(actor);
         let coerced = (0, entry_row_1.coerceValues)(type, values);
         // The row's own locale is what a relation link must match. Read up front
         // (one indexed lookup, and only on localized types) so the pre-transaction
@@ -504,19 +614,32 @@ let EntryWriterService = class EntryWriterService {
             // locale siblings) run inside the same transaction — a failure
             // rolls the whole save back.
             const touched = await this.extension?.afterUpdate(tx, type, updated, coerced, workspaceId, { created: false });
+            // Whatever a bound plugin was asked to store about this entry, on
+            // this transaction and before the snapshot reads it back — so the
+            // version records the audiences the save actually applied rather
+            // than the ones it replaced. This runs even when no version is
+            // appended (publish-a-version): the state is the entry's, not the
+            // revision's.
+            const alsoChanged = await this.writeExtensions.applyAll({ executor: tx, type, entryId: id, workspaceId }, options?.extensions);
             // Snapshot the updated document as a new draft revision, inside this
             // same transaction — unless the caller is re-applying a version that
             // already exists in the timeline (publish-a-version).
             if (options?.appendRevision ?? true) {
                 await this.appendRevision(tx, type, updated, workspaceId, actorId ?? null);
             }
-            // …and one for every sibling the extension rewrote.
-            await this.appendRevisionsFor(tx, type, touched, workspaceId, actorId ?? null);
+            // …and one for every sibling either extension path rewrote — the
+            // rows i18n synced a shared field to, and the rows a write extension
+            // reports it also changed (segments writes an entry's audiences to
+            // its whole locale group). Both are the same defect if skipped: a
+            // row whose state moved while its timeline did not.
+            await this.appendRevisionsFor(tx, type, touched, workspaceId, actorId ?? null, alsoChanged);
             // A save that changed no field value raises nothing: it is a round
             // trip, not an editorial change, and the log is read by people.
             const fields = this.changedFields(type, before, updated);
             if (fields.length > 0) {
-                await this.emit([(0, entry_events_1.entryUpdated)(id, type.name, fields)], actor);
+                await this.emit([
+                    (0, entry_events_1.entryUpdated)(id, this.subjectOf(type, workspaceId, updated), fields)
+                ], actor);
             }
             return updated;
         });
@@ -685,7 +808,9 @@ let EntryWriterService = class EntryWriterService {
                     .returning(), type);
             if (!row)
                 throw this.notFound(type, id);
-            await this.emit([(0, entry_events_1.entryDeleted)(id, type.name, Boolean(type.paranoid))], actor);
+            await this.emit([
+                (0, entry_events_1.entryDeleted)(id, this.subjectOf(type, workspaceId, row), Boolean(type.paranoid))
+            ], actor);
         });
     }
     /**
@@ -709,7 +834,9 @@ let EntryWriterService = class EntryWriterService {
                 .returning(), type);
             if (!row)
                 throw this.notFound(type, id);
-            await this.emit([(0, entry_events_1.entryRestored)(id, type.name)], actor);
+            await this.emit([
+                (0, entry_events_1.entryRestored)(id, this.subjectOf(type, workspaceId, row))
+            ], actor);
             return (0, entry_row_1.toRecord)(type, row);
         });
     }
@@ -727,7 +854,9 @@ let EntryWriterService = class EntryWriterService {
                 throw this.notFound(type, id);
             // The one content action that leaves nothing behind to inspect, so
             // the event is the only remaining record that it happened.
-            await this.emit([(0, entry_events_1.entryPurged)(id, type.name)], actor);
+            await this.emit([
+                (0, entry_events_1.entryPurged)(id, this.subjectOf(type, workspaceId, row))
+            ], actor);
         });
     }
     /** Delete a set of entries: soft for paranoid types, hard otherwise. */
@@ -753,7 +882,7 @@ let EntryWriterService = class EntryWriterService {
                     .returning(), type);
             // One event per row actually removed, not one per id asked for:
             // batching is a way of asking, and the log records what happened.
-            await this.emit(this.eventsFor(rows, (id) => (0, entry_events_1.entryDeleted)(id, type.name, Boolean(type.paranoid))), actor);
+            await this.emit(this.eventsFor(rows, (id, row) => (0, entry_events_1.entryDeleted)(id, this.subjectOf(type, workspaceId, row), Boolean(type.paranoid))), actor);
             return { count: rows.length };
         });
     }
@@ -769,7 +898,7 @@ let EntryWriterService = class EntryWriterService {
                 .delete(type.table)
                 .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.inArray)(t['id'], ids), this.scope(type, workspaceId), (0, drizzle_orm_1.isNotNull)(t['deletedAt'])))
                 .returning(), type);
-            await this.emit(this.eventsFor(rows, (id) => (0, entry_events_1.entryPurged)(id, type.name)), actor);
+            await this.emit(this.eventsFor(rows, (id, row) => (0, entry_events_1.entryPurged)(id, this.subjectOf(type, workspaceId, row))), actor);
             return { count: rows.length };
         });
     }
@@ -794,7 +923,7 @@ let EntryWriterService = class EntryWriterService {
             })
                 .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.inArray)(t['id'], ids), this.scope(type, workspaceId), (0, drizzle_orm_1.isNotNull)(t['deletedAt'])))
                 .returning(), type);
-            await this.emit(this.eventsFor(rows, (id) => (0, entry_events_1.entryRestored)(id, type.name)), actor);
+            await this.emit(this.eventsFor(rows, (id, row) => (0, entry_events_1.entryRestored)(id, this.subjectOf(type, workspaceId, row))), actor);
             return { count: rows.length };
         });
     }
@@ -1221,12 +1350,34 @@ exports.EntryWriterService = EntryWriterService = tslib_1.__decorate([
     (0, common_1.Injectable)(),
     tslib_1.__param(0, (0, database_1.InjectDatabase)()),
     tslib_1.__param(5, (0, revision_store_1.InjectRevisionStore)()),
-    tslib_1.__param(6, (0, common_1.Optional)()),
-    tslib_1.__param(6, (0, common_1.Inject)(entry_extension_1.CONTENT_ENTRY_EXTENSION)),
     tslib_1.__param(7, (0, common_1.Optional)()),
-    tslib_1.__param(7, (0, media_asset_resolver_1.InjectMediaAssetResolver)()),
+    tslib_1.__param(7, (0, common_1.Inject)(entry_extension_1.CONTENT_ENTRY_EXTENSION)),
+    tslib_1.__param(8, (0, common_1.Optional)()),
+    tslib_1.__param(8, (0, media_asset_resolver_1.InjectMediaAssetResolver)()),
     tslib_1.__metadata("design:paramtypes", [Object, database_1.UnitOfWork,
         database_1.OutboxWriter,
         entry_validation_service_1.EntryValidationService,
-        relation_link_service_1.RelationLinkService, Object, Object, Object])
+        relation_link_service_1.RelationLinkService, Object, entry_write_extension_1.EntryWriteExtensionRegistry, Object, Object])
 ], EntryWriterService);
+/**
+ * The **user** id to stamp on a revision, or `null` when the writer is not a
+ * person.
+ *
+ * `content_entry_revisions.created_by` records a `users` row. A token is not
+ * one, so writing its id there would make the history resolve every version to
+ * a nonexistent person — which is why the public API used to pass no actor at
+ * all rather than pass the token. The audit path has since gained an
+ * `actor_type` and can name a credential honestly, so the two answers had to be
+ * separated: {@link EntryWriterService.emit} gets the real principal, and this
+ * gets a user id or nothing.
+ *
+ * An actor with no `type` is a person — every actor predates the field except
+ * the token ones that introduced it.
+ */
+function revisionActorId(actor) {
+    if (!actor)
+        return null;
+    return (actor.type ?? database_1.EVENT_ACTOR_TYPE.User) === database_1.EVENT_ACTOR_TYPE.User
+        ? actor.id
+        : null;
+}