@orthacms/content-server 0.4.2 → 0.5.0

package/dist/lib/entries/infrastructure/persistence/relation-link.service.d.ts

@@ -1,6 +1,7 @@
 import { type Database } from '@orthacms/database';
 import { type AnyContentType } from '../../../types/content-type';
 import { type AnyFieldSpec } from '../../../types/fields';
+import { ContentReadScopeRegistry } from '../../../extension/read-scope';
 import type { RelationDelta, RelationFieldView, RelationRef } from '../../types/entry-list-view';
 /**
  * Reject any target row that lives in a different locale from the source.
@@ -35,7 +36,16 @@ export declare const RELATION_PAGE_SIZE = 20;
  * links to drafts and needs to see them.
  */
 export interface RelationTargetVisibility {
-    /** Restrict targets to entries that are currently published. */
+    /**
+     * Restrict targets to entries that are currently published.
+     *
+     * It also turns on the bound **read scopes** — segments' reader
+     * entitlements — against the target type. The two ride one flag because
+     * they answer one question ("may this caller reach this target?") and are
+     * needed at exactly the same call sites: every public read passes it, and
+     * no admin read does. A second flag would be a second thing to remember on
+     * a path where forgetting it means counting links a reader cannot follow.
+     */
     publishedOnly?: boolean;
 }
 /**
@@ -65,7 +75,8 @@ export type QueryRunner = Pick<Database, 'select'>;
  */
 export declare class RelationLinkService {
     private readonly db;
-    constructor(db: Database);
+    private readonly readScopes?;
+    constructor(db: Database, readScopes?: ContentReadScopeRegistry | undefined);
     /**
      * First page (+ total) of **every** relation field of `type` for one entry,
      * keyed by field name — what the editor loads on open. Each field is read
@@ -208,11 +219,33 @@ export declare class RelationLinkService {
     /**
      * The visibility predicate applied to a relation's target rows: the
      * workspace scope, the soft-delete guard, and — only when the caller asks
-     * for it — the published-only restriction. One definition, so the row read
-     * (`refsFor`) and the windowed link reads that must *count* correctly can't
-     * disagree on what a visible target is.
+     * for it — the published-only restriction plus the bound read scopes.
+     *
+     * **One definition**, and that is the load-bearing part. Every path that
+     * reads a target goes through it: the row read (`refsFor`), the windowed
+     * link reads whose `count(*) over` must not over-report, and the sub-select
+     * the join-table reads restrict their window by. So `items` and `total`
+     * cannot disagree about what a visible target is — which is exactly what
+     * they did while the read scopes were applied only when *hydrating* the
+     * items: a reader denied three of five linked records saw two items under a
+     * `total` of five, and could infer three restricted records existed.
      */
     private targetVisibleWhere;
+    /**
+     * The bound read scopes' fragments for a relation's **target** type, on a
+     * public read.
+     *
+     * Asked about the target rather than the type the request named: a reader
+     * allowed to see an article is not thereby allowed to see everything it
+     * points at, and a scope keyed to the source would leave every target
+     * unguarded.
+     *
+     * Gated on `publishedOnly`, which is the flag that marks a public read. The
+     * admin's calls pass no visibility and are untouched — an editor must see
+     * the records their entry links to in order to manage them, including ones
+     * no reader may fetch.
+     */
+    private readScopeWhere;
     /**
      * The id sub-select of a target's visible rows — how a link read that reads
      * only the JOIN table (so has no target columns of its own) restricts to

package/dist/lib/entries/infrastructure/persistence/relation-link.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relation-link.service.d.ts","sourceRoot":"","sources":["../../../../../src/lib/entries/infrastructure/persistence/relation-link.service.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAEH,KAAK,cAAc,EAEtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,KAAK,EACR,aAAa,EACb,iBAAiB,EACjB,WAAW,EACd,MAAM,6BAA6B,CAAC;AAMrC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAC5B,IAAI,EAAE,GAAG,EAAE,EACX,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GAAG,SAAS,GACjC,IAAI,CAcN;AASD,wEAAwE;AACxE,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;;;;;GASG;AACH,MAAM,WAAW,wBAAwB;IACrC,gEAAgE;IAChE,aAAa,CAAC,EAAE,OAAO,CAAC;CAC3B;AAqBD;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,CAClC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC,CAAC,CAAC,CAAC;AAEL;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AA0BnD;;;;;;;;;;;;GAYG;AACH,qBACa,mBAAmB;IACE,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ;IAI3D;;;;;;;;;OASG;IACG,OAAO,CACT,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,QAAQ,SAAqB,GAC9B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IA2C7C;;;;;;;;;;;;;;;;;OAiBG;IACG,iBAAiB,CACnB,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,MAAM,EAAE,EAChB,IAAI,EAAE,GAAG,EAAE,EACX,WAAW,EAAE,MAAM,EACnB,QAAQ,SAAqB,EAC7B,UAAU,CAAC,EAAE,wBAAwB,GACtC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAsD1D;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IA2CpB;;;;;OAKG;YACW,aAAa;IAgD3B;;;;;OAKG;YACW,WAAW;IA6DzB;;;;OAIG;YACW,cAAc;IAsD5B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IA0BpB;;;;;OAKG;IACG,SAAS,CACX,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,wBAAwB,GACtC,OAAO,CAAC,iBAAiB,CAAC;IAgG7B;;;;;;;;;;;OAWG;IACG,aAAa,CACf,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,GACT,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAqBpC;;;;;;;OAOG;IACG,UAAU,CACZ,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,aAAa,EACpB,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC;IA8GhB;;;;;;;;;OASG;IACG,UAAU,CACZ,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC;IA+ChB;;;;;;OAMG;IACG,UAAU,CACZ,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,YAAY,EAClB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC;IAgClB;;;;;;OAMG;YACW,UAAU;IAWxB,sEAAsE;YACxD,YAAY;IAc1B;;;;;;;;OAQG;IACG,WAAW,CACb,MAAM,EAAE,cAAc,EACtB,GAAG,EAAE,SAAS,MAAM,EAAE,EACtB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,GACZ,OAAO,CAAC,WAAW,EAAE,CAAC;IAIzB;;;;;;OAMG;YACW,OAAO;IA6BrB;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IAe1B;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;IAUjC,kDAAkD;IAClD,OAAO,CAAC,QAAQ;IAWhB;;;;;;;;;;;;;;OAcG;IACG,mBAAmB,CACrB,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,MAAM,EAAE,EAClB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IA+C/B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,qBAAqB,CACvB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,cAAc,EACtB,GAAG,EAAE,SAAS,MAAM,EAAE,EACtB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IA+D5C;;;;;;;;;;;OAWG;IACG,YAAY,CACd,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,SAAS,MAAM,EAAE,GAC7B,OAAO,CAAC,OAAO,CAAC;IAyCnB;;;;;OAKG;IACG,SAAS,CACX,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,EAAE,CAAC;IAapB,wEAAwE;YAC1D,oBAAoB;IA+BlC;;;;;;;;;;;;;;;;;;OAkBG;YACW,aAAa;IAqC3B;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IA8BnB;;;;OAIG;IACH,OAAO,CAAC,cAAc;CAezB"}
+{"version":3,"file":"relation-link.service.d.ts","sourceRoot":"","sources":["../../../../../src/lib/entries/infrastructure/persistence/relation-link.service.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAEH,KAAK,cAAc,EAEtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,KAAK,EACR,aAAa,EACb,iBAAiB,EACjB,WAAW,EACd,MAAM,6BAA6B,CAAC;AAMrC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAC5B,IAAI,EAAE,GAAG,EAAE,EACX,MAAM,EAAE,cAAc,EACtB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GAAG,SAAS,GACjC,IAAI,CAcN;AASD,wEAAwE;AACxE,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC,kEAAkE;AAClE,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;;;;;GASG;AACH,MAAM,WAAW,wBAAwB;IACrC;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CAC3B;AAqBD;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,CAClC,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CACzC,CAAC,CAAC,CAAC,CAAC;AAEL;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AA0BnD;;;;;;;;;;;;GAYG;AACH,qBACa,mBAAmB;IAEN,OAAO,CAAC,QAAQ,CAAC,EAAE;IAMrC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;gBANO,EAAE,EAAE,QAAQ,EAM9B,UAAU,CAAC,EAAE,wBAAwB,YAAA;IAK1D;;;;;;;;;OASG;IACG,OAAO,CACT,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,EACR,WAAW,EAAE,MAAM,EACnB,QAAQ,SAAqB,GAC9B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IA2C7C;;;;;;;;;;;;;;;;;OAiBG;IACG,iBAAiB,CACnB,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,MAAM,EAAE,EAChB,IAAI,EAAE,GAAG,EAAE,EACX,WAAW,EAAE,MAAM,EACnB,QAAQ,SAAqB,EAC7B,UAAU,CAAC,EAAE,wBAAwB,GACtC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAsD1D;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IA2CpB;;;;;OAKG;YACW,aAAa;IAgD3B;;;;;OAKG;YACW,WAAW;IA6DzB;;;;OAIG;YACW,cAAc;IAsD5B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IA0BpB;;;;;OAKG;IACG,SAAS,CACX,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,wBAAwB,GACtC,OAAO,CAAC,iBAAiB,CAAC;IAgG7B;;;;;;;;;;;OAWG;IACG,aAAa,CACf,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,GACT,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAqBpC;;;;;;;OAOG;IACG,UAAU,CACZ,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,aAAa,EACpB,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC;IA8GhB;;;;;;;;;OASG;IACG,UAAU,CACZ,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC;IA+ChB;;;;;;OAMG;IACG,UAAU,CACZ,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,GAAG,EACR,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,YAAY,EAClB,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC;IAgClB;;;;;;OAMG;YACW,UAAU;IAWxB,sEAAsE;YACxD,YAAY;IAc1B;;;;;;;;OAQG;IACG,WAAW,CACb,MAAM,EAAE,cAAc,EACtB,GAAG,EAAE,SAAS,MAAM,EAAE,EACtB,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,GACZ,OAAO,CAAC,WAAW,EAAE,CAAC;IAIzB;;;;;;OAMG;YACW,OAAO;IA6BrB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,kBAAkB;IAgB1B;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,cAAc;IAStB;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAexB;;;;OAIG;IACH,OAAO,CAAC,yBAAyB;IAUjC,kDAAkD;IAClD,OAAO,CAAC,QAAQ;IAWhB;;;;;;;;;;;;;;OAcG;IACG,mBAAmB,CACrB,MAAM,EAAE,WAAW,EACnB,MAAM,EAAE,cAAc,EACtB,QAAQ,EAAE,MAAM,EAAE,EAClB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,GAAG,SAAS,GACjC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IA+C/B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,qBAAqB,CACvB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,cAAc,EACtB,GAAG,EAAE,SAAS,MAAM,EAAE,EACtB,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IA+D5C;;;;;;;;;;;OAWG;IACG,YAAY,CACd,EAAE,EAAE,aAAa,EACjB,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,SAAS,MAAM,EAAE,GAC7B,OAAO,CAAC,OAAO,CAAC;IAyCnB;;;;;OAKG;IACG,SAAS,CACX,IAAI,EAAE,QAAQ,GAAG,aAAa,EAC9B,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,EAAE,CAAC;IAapB,wEAAwE;YAC1D,oBAAoB;IA+BlC;;;;;;;;;;;;;;;;;;OAkBG;YACW,aAAa;IAqC3B;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IA8BnB;;;;OAIG;IACH,OAAO,CAAC,cAAc;CAezB"}

package/dist/lib/entries/infrastructure/persistence/relation-link.service.js

@@ -8,6 +8,7 @@ const drizzle_orm_1 = require("drizzle-orm");
 const database_1 = require("@orthacms/database");
 const content_type_1 = require("../../../types/content-type");
 const fields_1 = require("../../../types/fields");
+const read_scope_1 = require("../../../extension/read-scope");
 const entry_row_1 = require("./entry-row");
 /**
  * Reject any target row that lives in a different locale from the source.
@@ -76,8 +77,10 @@ const RELATION_APPEND_LOCK_CLASS = 0x524c; // 'RL'
  */
 let RelationLinkService = class RelationLinkService {
     db;
-    constructor(db) {
+    readScopes;
+    constructor(db, readScopes) {
         this.db = db;
+        this.readScopes = readScopes;
     }
     // ---- reads -------------------------------------------------------------
     /**
@@ -644,15 +647,41 @@ let RelationLinkService = class RelationLinkService {
     /**
      * The visibility predicate applied to a relation's target rows: the
      * workspace scope, the soft-delete guard, and — only when the caller asks
-     * for it — the published-only restriction. One definition, so the row read
-     * (`refsFor`) and the windowed link reads that must *count* correctly can't
-     * disagree on what a visible target is.
+     * for it — the published-only restriction plus the bound read scopes.
+     *
+     * **One definition**, and that is the load-bearing part. Every path that
+     * reads a target goes through it: the row read (`refsFor`), the windowed
+     * link reads whose `count(*) over` must not over-report, and the sub-select
+     * the join-table reads restrict their window by. So `items` and `total`
+     * cannot disagree about what a visible target is — which is exactly what
+     * they did while the read scopes were applied only when *hydrating* the
+     * items: a reader denied three of five linked records saw two items under a
+     * `total` of five, and could infer three restricted records existed.
      */
     targetVisibleWhere(target, workspaceId, visibility) {
         const cols = target.table;
         return (0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(cols['workspaceId'], workspaceId), cols['deletedAt'] ? (0, drizzle_orm_1.isNull)(cols['deletedAt']) : undefined, visibility?.publishedOnly && target.publishable
             ? (0, drizzle_orm_1.eq)(cols['status'], content_type_1.ENTRY_STATUS.Published)
-            : undefined);
+            : undefined, ...this.readScopeWhere(target, workspaceId, visibility));
+    }
+    /**
+     * The bound read scopes' fragments for a relation's **target** type, on a
+     * public read.
+     *
+     * Asked about the target rather than the type the request named: a reader
+     * allowed to see an article is not thereby allowed to see everything it
+     * points at, and a scope keyed to the source would leave every target
+     * unguarded.
+     *
+     * Gated on `publishedOnly`, which is the flag that marks a public read. The
+     * admin's calls pass no visibility and are untouched — an editor must see
+     * the records their entry links to in order to manage them, including ones
+     * no reader may fetch.
+     */
+    readScopeWhere(target, workspaceId, visibility) {
+        if (!visibility?.publishedOnly)
+            return [];
+        return this.readScopes?.fragments({ type: target, workspaceId }) ?? [];
     }
     /**
      * The id sub-select of a target's visible rows — how a link read that reads
@@ -661,6 +690,8 @@ let RelationLinkService = class RelationLinkService {
      * when no extra restriction applies, so the predicate collapses away.
      */
     visibleTargetIds(target, workspaceId, visibility) {
+        // `publishedOnly` is the public-read marker, so it also gates the read
+        // scopes (see {@link targetVisibleWhere}) — one check covers both.
         if (!visibility?.publishedOnly)
             return undefined;
         const cols = target.table;
@@ -981,7 +1012,8 @@ exports.RelationLinkService = RelationLinkService;
 exports.RelationLinkService = RelationLinkService = tslib_1.__decorate([
     (0, common_1.Injectable)(),
     tslib_1.__param(0, (0, database_1.InjectDatabase)()),
-    tslib_1.__metadata("design:paramtypes", [Object])
+    tslib_1.__param(1, (0, common_1.Optional)()),
+    tslib_1.__metadata("design:paramtypes", [Object, read_scope_1.ContentReadScopeRegistry])
 ], RelationLinkService);
 /**
  * The composite map key for "this translation group, in this locale".

package/dist/lib/entries/infrastructure/queries/entries.service.d.ts

@@ -1,5 +1,6 @@
 import { type Database } from '@orthacms/database';
 import { type ContentEntryExtension } from '../../../extension/entry-extension';
+import { EntryFilterProviderRegistry } from '../../../extension/entry-filter-provider';
 import type { AnyContentType } from '../../../types/content-type';
 import { type ListEntriesQueryDto } from '../../http/dto/list-entries-query.dto';
 import type { EntryListView } from '../../types/entry-list-view';
@@ -14,8 +15,9 @@ import { RelationLinkService } from '../persistence/relation-link.service';
 export declare class EntriesService {
     private readonly db;
     private readonly relationLinks;
+    private readonly filterProviders;
     private readonly extension?;
-    constructor(db: Database, relationLinks: RelationLinkService, extension?: ContentEntryExtension | undefined);
+    constructor(db: Database, relationLinks: RelationLinkService, filterProviders: EntryFilterProviderRegistry, extension?: ContentEntryExtension | undefined);
     /**
      * One page of a collection's entries: search → filter → sort → paginate, run
      * in SQL against the type's generated table, returned as the

package/dist/lib/entries/infrastructure/queries/entries.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entries.service.d.ts","sourceRoot":"","sources":["../../../../../src/lib/entries/infrastructure/queries/entries.service.ts"],"names":[],"mappings":"AAYA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,EAEH,KAAK,qBAAqB,EAE7B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAGH,KAAK,mBAAmB,EAC3B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAMjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AA+B3E;;;;;;GAMG;AACH,qBACa,cAAc;IAED,OAAO,CAAC,QAAQ,CAAC,EAAE;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAK9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBANQ,EAAE,EAAE,QAAQ,EAC9B,aAAa,EAAE,mBAAmB,EAKlC,SAAS,CAAC,EAAE,qBAAqB,YAAA;IAGtD;;;;;;OAMG;IACG,IAAI,CACN,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,mBAAmB,EAC1B,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,aAAa,CAAC;IAgDzB;;;;;;;OAOG;YACW,SAAS;IA0CvB;;;;;;;OAOG;YACW,eAAe;IAyB7B;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAWxB;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;CAsBlB"}
+{"version":3,"file":"entries.service.d.ts","sourceRoot":"","sources":["../../../../../src/lib/entries/infrastructure/queries/entries.service.ts"],"names":[],"mappings":"AAYA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,EAEH,KAAK,qBAAqB,EAE7B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,EAGH,KAAK,mBAAmB,EAC3B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAMjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AA+B3E;;;;;;GAMG;AACH,qBACa,cAAc;IAED,OAAO,CAAC,QAAQ,CAAC,EAAE;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAI9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAKhC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAVQ,EAAE,EAAE,QAAQ,EAC9B,aAAa,EAAE,mBAAmB,EAIlC,eAAe,EAAE,2BAA2B,EAK5C,SAAS,CAAC,EAAE,qBAAqB,YAAA;IAGtD;;;;;;OAMG;IACG,IAAI,CACN,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,mBAAmB,EAC1B,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,aAAa,CAAC;IAgDzB;;;;;;;OAOG;YACW,SAAS;IAiDvB;;;;;;;OAOG;YACW,eAAe;IAyB7B;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAWxB;;;;;;;;;OASG;IACH,OAAO,CAAC,OAAO;CAsBlB"}

package/dist/lib/entries/infrastructure/queries/entries.service.js

@@ -7,6 +7,7 @@ const drizzle_orm_1 = require("drizzle-orm");
 const database_1 = require("@orthacms/database");
 const utils_server_1 = require("@orthacms/utils-server");
 const entry_extension_1 = require("../../../extension/entry-extension");
+const entry_filter_provider_1 = require("../../../extension/entry-filter-provider");
 const fields_1 = require("../../../types/fields");
 const list_entries_query_dto_1 = require("../../http/dto/list-entries-query.dto");
 const entries_constants_1 = require("../../entries.constants");
@@ -43,10 +44,16 @@ function previewFields(type, raw) {
 let EntriesService = class EntriesService {
     db;
     relationLinks;
+    filterProviders;
     extension;
-    constructor(db, relationLinks, extension) {
+    constructor(db, relationLinks, 
+    // Virtual filter fields contributed by plugins other than the single
+    // bound extension — segments' audience fields today. A registry rather
+    // than a token, for the reason its own file documents.
+    filterProviders, extension) {
         this.db = db;
         this.relationLinks = relationLinks;
+        this.filterProviders = filterProviders;
         this.extension = extension;
     }
     /**
@@ -105,7 +112,11 @@ let EntriesService = class EntriesService {
         // into the schema, resolved to its own SQL) and an extra scope
         // predicate (e.g. the active locale). Both are no-ops for types the
         // extension doesn't apply to.
-        const filterExtension = this.extension?.filterExtension(type);
+        // The bound extension (i18n) plus every registered provider (segments'
+        // audience fields), folded into one contribution — see
+        // `EntryFilterProviderRegistry`, which exists because that port is a
+        // single binding and a second plugin would otherwise replace it.
+        const filterExtension = this.filterProviders.compose(type, this.extension?.filterExtension(type));
         // Building the surface walks the type's whole relation graph to the
         // hop budget, so only pay for it when there is actually a filter to
         // translate — an unfiltered list (the common case) skips it entirely.
@@ -196,7 +207,8 @@ exports.EntriesService = EntriesService;
 exports.EntriesService = EntriesService = tslib_1.__decorate([
     (0, common_1.Injectable)(),
     tslib_1.__param(0, (0, database_1.InjectDatabase)()),
-    tslib_1.__param(2, (0, common_1.Optional)()),
-    tslib_1.__param(2, (0, common_1.Inject)(entry_extension_1.CONTENT_ENTRY_EXTENSION)),
-    tslib_1.__metadata("design:paramtypes", [Object, relation_link_service_1.RelationLinkService, Object])
+    tslib_1.__param(3, (0, common_1.Optional)()),
+    tslib_1.__param(3, (0, common_1.Inject)(entry_extension_1.CONTENT_ENTRY_EXTENSION)),
+    tslib_1.__metadata("design:paramtypes", [Object, relation_link_service_1.RelationLinkService,
+        entry_filter_provider_1.EntryFilterProviderRegistry, Object])
 ], EntriesService);

package/dist/lib/entries/infrastructure/queries/entry-match.query.d.ts

@@ -0,0 +1,82 @@
+import { type Database } from '@orthacms/database';
+import { type ContentEntryExtension } from '../../../extension/entry-extension';
+import { EntryFilterProviderRegistry } from '../../../extension/entry-filter-provider';
+import type { AnyContentType } from '../../../types/content-type';
+/** Options narrowing a {@link EntryMatchQuery.matchingIds} scan. */
+export interface EntryMatchOptions {
+    /**
+     * Restrict the scan to these entry ids. This is what turns a
+     * collection-wide predicate into the point check an event-driven caller
+     * needs — "does *this* row match?" is the same SQL with an extra
+     * `id IN (...)`, so one code path serves both and they cannot disagree
+     * about what a filter means.
+     */
+    entryIds?: readonly string[];
+    /** Upper bound on returned ids. */
+    limit?: number;
+    /** Rows to skip — for batching a full-collection scan. */
+    offset?: number;
+}
+/**
+ * Answers "which entries of this type match this filter?" against the same
+ * surface, parser and translator the records list uses.
+ *
+ * It exists so a downstream plugin can reuse content's filter semantics
+ * without reaching for the database or rebuilding the surface: the filterable
+ * paths, the relation-hop budget, the workspace scoping of every relation
+ * subquery, and the 400 on a malformed tree are all inherited rather than
+ * re-implemented. `@orthacms/alarms-server` evaluates its rules through this,
+ * which is what makes "the rule I saved from the list means what the list
+ * showed me" true by construction rather than by review.
+ *
+ * Two deliberate differences from the list query:
+ *
+ * - **No locale scoping.** The entries extension's `listScope` narrows a list
+ *   to the active locale; a rule is a statement about the collection, so it
+ *   must see every translation. The extension's *virtual filter fields* are
+ *   still wired, so a rule may filter on them explicitly.
+ * - **Trashed rows are excluded, always.** There is no trash view here, and a
+ *   tombstoned row is not something anyone can act on.
+ */
+export declare class EntryMatchQuery {
+    private readonly db;
+    private readonly filterProviders;
+    private readonly extension?;
+    constructor(db: Database, filterProviders: EntryFilterProviderRegistry, extension?: ContentEntryExtension | undefined);
+    /**
+     * Parses `filter` against `type`'s surface without running it, throwing a
+     * `FilterException` when it does not hold up. Callers store filters that
+     * will be replayed by a background subscriber for months, so the parse
+     * belongs at the moment the filter is written — a tree that only fails at
+     * evaluation time fails somewhere nobody is looking.
+     */
+    assertParses(type: AnyContentType, filter: unknown, workspaceId: string): void;
+    /**
+     * Ids of `type` in `workspaceId` matching `filter`, oldest-id first so a
+     * batched scan is stable across calls.
+     */
+    matchingIds(type: AnyContentType, filter: unknown, workspaceId: string, options?: EntryMatchOptions): Promise<string[]>;
+    /** How many entries of `type` match `filter` right now. */
+    countMatching(type: AnyContentType, filter: unknown, workspaceId: string): Promise<number>;
+    /**
+     * How many entries of `type` the workspace holds at all — the denominator
+     * the rule editor shows beside a match count ("14 of 312"), which is what
+     * turns a number into a judgement about whether the rule is too broad.
+     */
+    countAll(type: AnyContentType, workspaceId: string): Promise<number>;
+    /**
+     * The workspace an entry belongs to, or `null` when no such row exists.
+     *
+     * A domain event names an entry and its content type but not its workspace
+     * — every content table carries its own `workspace_id`, so there is nothing
+     * for the envelope to add that a one-column lookup cannot answer. Exposed
+     * here rather than left to each subscriber, so a downstream plugin never
+     * has a reason to query a `content_<name>` table directly.
+     */
+    workspaceOf(type: AnyContentType, entryId: string): Promise<string | null>;
+    /** The workspace + not-trashed guard every scan starts from. */
+    private scope;
+    /** Scope + translated filter + optional id restriction. */
+    private predicate;
+}
+//# sourceMappingURL=entry-match.query.d.ts.map

package/dist/lib/entries/infrastructure/queries/entry-match.query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-match.query.d.ts","sourceRoot":"","sources":["../../../../../src/lib/entries/infrastructure/queries/entry-match.query.ts"],"names":[],"mappings":"AAGA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,EAEH,KAAK,qBAAqB,EAC7B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAalE,oEAAoE;AACpE,MAAM,WAAW,iBAAiB;IAC9B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBACa,eAAe;IAEF,OAAO,CAAC,QAAQ,CAAC,EAAE;IAIrC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAGhC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAPQ,EAAE,EAAE,QAAQ,EAI9B,eAAe,EAAE,2BAA2B,EAG5C,SAAS,CAAC,EAAE,qBAAqB,YAAA;IAGtD;;;;;;OAMG;IACH,YAAY,CACR,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,MAAM,GACpB,IAAI;IAWP;;;OAGG;IACG,WAAW,CACb,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,iBAAsB,GAChC,OAAO,CAAC,MAAM,EAAE,CAAC;IAmBpB,2DAA2D;IACrD,aAAa,CACf,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,CAAC;IASlB;;;;OAIG;IACG,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ1E;;;;;;;;OAQG;IACG,WAAW,CACb,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUzB,gEAAgE;IAChE,OAAO,CAAC,KAAK;IAQb,2DAA2D;YAC7C,SAAS;CAoC1B"}

package/dist/lib/entries/infrastructure/queries/entry-match.query.js

@@ -0,0 +1,152 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EntryMatchQuery = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const drizzle_orm_1 = require("drizzle-orm");
+const database_1 = require("@orthacms/database");
+const utils_server_1 = require("@orthacms/utils-server");
+const entry_extension_1 = require("../../../extension/entry-extension");
+const entry_filter_provider_1 = require("../../../extension/entry-filter-provider");
+const entry_filter_surface_1 = require("./entry-filter-surface");
+/**
+ * Answers "which entries of this type match this filter?" against the same
+ * surface, parser and translator the records list uses.
+ *
+ * It exists so a downstream plugin can reuse content's filter semantics
+ * without reaching for the database or rebuilding the surface: the filterable
+ * paths, the relation-hop budget, the workspace scoping of every relation
+ * subquery, and the 400 on a malformed tree are all inherited rather than
+ * re-implemented. `@orthacms/alarms-server` evaluates its rules through this,
+ * which is what makes "the rule I saved from the list means what the list
+ * showed me" true by construction rather than by review.
+ *
+ * Two deliberate differences from the list query:
+ *
+ * - **No locale scoping.** The entries extension's `listScope` narrows a list
+ *   to the active locale; a rule is a statement about the collection, so it
+ *   must see every translation. The extension's *virtual filter fields* are
+ *   still wired, so a rule may filter on them explicitly.
+ * - **Trashed rows are excluded, always.** There is no trash view here, and a
+ *   tombstoned row is not something anyone can act on.
+ */
+let EntryMatchQuery = class EntryMatchQuery {
+    db;
+    filterProviders;
+    extension;
+    constructor(db, 
+    // Same pair as `EntriesService`: an alarm rule stores the records
+    // list's filter verbatim, so it has to parse against exactly the
+    // surface that list offers — including the fields other plugins add.
+    filterProviders, extension) {
+        this.db = db;
+        this.filterProviders = filterProviders;
+        this.extension = extension;
+    }
+    /**
+     * Parses `filter` against `type`'s surface without running it, throwing a
+     * `FilterException` when it does not hold up. Callers store filters that
+     * will be replayed by a background subscriber for months, so the parse
+     * belongs at the moment the filter is written — a tree that only fails at
+     * evaluation time fails somewhere nobody is looking.
+     */
+    assertParses(type, filter, workspaceId) {
+        const { schema } = (0, entry_filter_surface_1.buildEntryFilterSurface)(type, {
+            workspaceId,
+            extensionFields: this.filterProviders.compose(type, this.extension?.filterExtension(type))?.fields
+        });
+        (0, utils_server_1.parseFilterTree)(filter, schema);
+    }
+    /**
+     * Ids of `type` in `workspaceId` matching `filter`, oldest-id first so a
+     * batched scan is stable across calls.
+     */
+    async matchingIds(type, filter, workspaceId, options = {}) {
+        // An empty restriction means "none of them", not "all of them" — an
+        // `inArray(col, [])` would be a false predicate anyway, but returning
+        // early keeps a caller that batched its ids from paying for a query
+        // whose answer is known.
+        if (options.entryIds && options.entryIds.length === 0)
+            return [];
+        const where = await this.predicate(type, filter, workspaceId, options);
+        const table = type.table;
+        const rows = await this.db
+            .select({ id: table['id'] })
+            .from(type.table)
+            .where(where)
+            .orderBy(table['id'])
+            .limit(options.limit ?? Number.MAX_SAFE_INTEGER)
+            .offset(options.offset ?? 0);
+        return rows.map((row) => String(row.id));
+    }
+    /** How many entries of `type` match `filter` right now. */
+    async countMatching(type, filter, workspaceId) {
+        const where = await this.predicate(type, filter, workspaceId, {});
+        const [row] = await this.db
+            .select({ total: (0, drizzle_orm_1.count)() })
+            .from(type.table)
+            .where(where);
+        return Number(row?.total ?? 0);
+    }
+    /**
+     * How many entries of `type` the workspace holds at all — the denominator
+     * the rule editor shows beside a match count ("14 of 312"), which is what
+     * turns a number into a judgement about whether the rule is too broad.
+     */
+    async countAll(type, workspaceId) {
+        const [row] = await this.db
+            .select({ total: (0, drizzle_orm_1.count)() })
+            .from(type.table)
+            .where(this.scope(type, workspaceId));
+        return Number(row?.total ?? 0);
+    }
+    /**
+     * The workspace an entry belongs to, or `null` when no such row exists.
+     *
+     * A domain event names an entry and its content type but not its workspace
+     * — every content table carries its own `workspace_id`, so there is nothing
+     * for the envelope to add that a one-column lookup cannot answer. Exposed
+     * here rather than left to each subscriber, so a downstream plugin never
+     * has a reason to query a `content_<name>` table directly.
+     */
+    async workspaceOf(type, entryId) {
+        const table = type.table;
+        const [row] = await this.db
+            .select({ workspaceId: table['workspaceId'] })
+            .from(type.table)
+            .where((0, drizzle_orm_1.eq)(table['id'], entryId))
+            .limit(1);
+        return row?.workspaceId ? String(row.workspaceId) : null;
+    }
+    /** The workspace + not-trashed guard every scan starts from. */
+    scope(type, workspaceId) {
+        const table = type.table;
+        return (0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(table['workspaceId'], workspaceId), type.paranoid ? (0, drizzle_orm_1.isNull)(table['deletedAt']) : undefined);
+    }
+    /** Scope + translated filter + optional id restriction. */
+    async predicate(type, filter, workspaceId, options) {
+        const filterExtension = this.filterProviders.compose(type, this.extension?.filterExtension(type));
+        const { schema } = (0, entry_filter_surface_1.buildEntryFilterSurface)(type, {
+            workspaceId,
+            extensionFields: filterExtension?.fields
+        });
+        const tree = (0, utils_server_1.parseFilterTree)(filter, schema);
+        const filterSql = await (0, utils_server_1.applyFilterTree)(tree, schema, type.table, this.db, filterExtension
+            ? {
+                resolveExtension: (rule) => filterExtension.resolve(rule, { type, workspaceId })
+            }
+            : {});
+        const table = type.table;
+        return (0, drizzle_orm_1.and)(this.scope(type, workspaceId), filterSql, options.entryIds
+            ? (0, drizzle_orm_1.inArray)(table['id'], [...options.entryIds])
+            : undefined);
+    }
+};
+exports.EntryMatchQuery = EntryMatchQuery;
+exports.EntryMatchQuery = EntryMatchQuery = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(0, (0, database_1.InjectDatabase)()),
+    tslib_1.__param(2, (0, common_1.Optional)()),
+    tslib_1.__param(2, (0, common_1.Inject)(entry_extension_1.CONTENT_ENTRY_EXTENSION)),
+    tslib_1.__metadata("design:paramtypes", [Object, entry_filter_provider_1.EntryFilterProviderRegistry, Object])
+], EntryMatchQuery);

package/dist/lib/extension/entry-filter-provider.d.ts

@@ -0,0 +1,79 @@
+/**
+ * The **virtual filter-field registry** — how more than one plugin contributes
+ * fields to a content type's `?filter=` surface.
+ *
+ * `CONTENT_ENTRY_EXTENSION.filterExtension` already declares virtual fields
+ * (i18n's `hasLocale` / `missingLocale` / `localeCount`), but that port is a
+ * documented **single binding**: one provider per app, and i18n holds it. Nest
+ * has no multi-provider, so a second plugin binding the token would silently
+ * replace the first — for a filter surface that means fields quietly vanishing
+ * from the picker and saved filters starting to 400.
+ *
+ * So a plugin registers here instead (`@orthacms/segments-server` contributes
+ * "can be seen by" / "cannot be seen by" / "restricted"), the same shape and the
+ * same reason as `contentReadScopeRegistrar`. The bound extension keeps its
+ * method; {@link EntryFilterProviderRegistry.compose} folds the two together
+ * into the one `EntryFilterExtension` the query path already knows how to use,
+ * so nothing downstream changed.
+ *
+ * ## What a contribution owes
+ *
+ * **Every emitted subquery MUST scope to the workspace it is handed.** A virtual
+ * field is a subquery over a table this package knows nothing about; one that
+ * forgets the workspace turns a filter into a cross-tenant read.
+ *
+ * **Only declare fields you can answer, with only the operators you support.**
+ * The declared `fields` become the SQL whitelist, so an operator the resolver
+ * refuses reaches the user as "couldn't load this collection" over a rule the
+ * picker itself proposed. Narrow the operator set in the admin's `FilterField`
+ * to match.
+ *
+ * **A filter narrows what is listed; it is not a visibility rule.** Reachability
+ * is `CONTENT_READ_SCOPE`'s job and is applied separately. A field here must not
+ * be relied on to hide anything.
+ */
+import { type Provider, type Type } from '@nestjs/common';
+import type { AnyContentType } from '../types/content-type';
+import type { EntryFilterExtension } from './entry-extension';
+/** One plugin's virtual filter fields. */
+export interface EntryFilterProvider {
+    /**
+     * The fields this plugin adds to `type`'s filter surface, or `undefined`
+     * when it adds none — which is what a plugin that is installed but
+     * unconfigured must return, so a bare install pays nothing.
+     */
+    filterFor(type: AnyContentType): EntryFilterExtension | undefined;
+}
+/** Every registered provider, in registration order. */
+export declare class EntryFilterProviderRegistry {
+    private readonly logger;
+    private readonly providers;
+    /** Adds a provider. Registering the same instance twice is a no-op. */
+    register(provider: EntryFilterProvider): void;
+    /**
+     * Fold the bound extension's contribution and every registered provider's
+     * into one {@link EntryFilterExtension}.
+     *
+     * Returns `undefined` when nobody contributed anything, so a type with no
+     * virtual fields builds exactly the surface it did before this registry
+     * existed — and `entries.service` keeps its "no extension, no
+     * `resolveExtension`" branch.
+     *
+     * `resolve` routes by the rule's **field name**, to whoever declared it.
+     * A name declared twice is kept by its first declarer and the duplicate is
+     * dropped with a warning: silently letting the last writer win would make
+     * the meaning of a saved filter depend on plugin registration order.
+     */
+    compose(type: AnyContentType, bound: EntryFilterExtension | undefined): EntryFilterExtension | undefined;
+}
+/**
+ * Builds the DI provider that registers `providers` with content's filter-field
+ * registry at bootstrap.
+ *
+ * A factory with an explicit `inject` list rather than a class with reflected
+ * parameters, for the reason `contentReadScopeRegistrar` documents: an optional
+ * dependency typed `Foo | null` emits `Object` for `design:paramtypes`, Nest
+ * injects `undefined` with no error, and the plugin registers nothing.
+ */
+export declare function entryFilterProviderRegistrar(label: string, ...providers: Type<EntryFilterProvider>[]): Provider;
+//# sourceMappingURL=entry-filter-provider.d.ts.map

package/dist/lib/extension/entry-filter-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-filter-provider.d.ts","sourceRoot":"","sources":["../../../src/lib/extension/entry-filter-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAIH,KAAK,QAAQ,EACb,KAAK,IAAI,EACZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,0CAA0C;AAC1C,MAAM,WAAW,mBAAmB;IAChC;;;;OAIG;IACH,SAAS,CAAC,IAAI,EAAE,cAAc,GAAG,oBAAoB,GAAG,SAAS,CAAC;CACrE;AAED,wDAAwD;AACxD,qBACa,2BAA2B;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgD;IACvE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IAEvD,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI;IAM7C;;;;;;;;;;;;;OAaG;IACH,OAAO,CACH,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,oBAAoB,GAAG,SAAS,GACxC,oBAAoB,GAAG,SAAS;CAyCtC;AA0BD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CACxC,KAAK,EAAE,MAAM,EACb,GAAG,SAAS,EAAE,IAAI,CAAC,mBAAmB,CAAC,EAAE,GAC1C,QAAQ,CAYV"}