@orthacms/segments-domain 0.0.0-reserve.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ortha CMS contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,7 @@
+# @orthacms/segments-domain
+
+Part of [Ortha CMS](https://github.com/ortha-source/ortha-cms).
+
+```sh
+npm install @orthacms/segments-domain
+```

package/dist/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Public API of `@orthacms/segments-domain` — who may **read** published
+ * content, decided by one pure function over two lists.
+ *
+ * Deliberately small. A segment is a named set of reader tags; an entry names
+ * the segments that may read it and the segments that may not; `canRead` is the
+ * whole decision. There is no rule object, no inheritance and no resolution
+ * step, because what an editor sets on the entry *is* what a reader gets.
+ *
+ * Not RBAC, and not `workspace_content`: those answer who may **touch**
+ * content, and they already exist.
+ */
+export { isOfferedIn, segmentIdsForTags } from './lib/segment';
+export type { Segment } from './lib/segment';
+export { ACCESS_MODE, OPEN_ACCESS, canRead, isOpen, sameAccess } from './lib/entry-access';
+export type { AccessMode, EntryAccess } from './lib/entry-access';
+export { isValidSegment, validateSegment, SEGMENT_ISSUE, SEGMENT_KEY_MAX, SEGMENT_KEY_PATTERN, SEGMENT_LABEL_MAX, SEGMENT_TAG_MAX, SEGMENT_TAGS_MAX } from './lib/validation';
+export type { SegmentDraft, SegmentIssue, SegmentIssues } from './lib/validation';
+export { anonymousSegmentResolver, staticSegmentResolver } from './lib/segment-resolver.port';
+export type { SegmentResolver } from './lib/segment-resolver.port';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC/D,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EACH,WAAW,EACX,WAAW,EACX,OAAO,EACP,MAAM,EACN,UAAU,EACb,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAIlE,OAAO,EACH,cAAc,EACd,eAAe,EACf,aAAa,EACb,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACR,YAAY,EACZ,YAAY,EACZ,aAAa,EAChB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACH,wBAAwB,EACxB,qBAAqB,EACxB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/index.js

@@ -0,0 +1,38 @@
+"use strict";
+/**
+ * Public API of `@orthacms/segments-domain` — who may **read** published
+ * content, decided by one pure function over two lists.
+ *
+ * Deliberately small. A segment is a named set of reader tags; an entry names
+ * the segments that may read it and the segments that may not; `canRead` is the
+ * whole decision. There is no rule object, no inheritance and no resolution
+ * step, because what an editor sets on the entry *is* what a reader gets.
+ *
+ * Not RBAC, and not `workspace_content`: those answer who may **touch**
+ * content, and they already exist.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.staticSegmentResolver = exports.anonymousSegmentResolver = exports.SEGMENT_TAGS_MAX = exports.SEGMENT_TAG_MAX = exports.SEGMENT_LABEL_MAX = exports.SEGMENT_KEY_PATTERN = exports.SEGMENT_KEY_MAX = exports.SEGMENT_ISSUE = exports.validateSegment = exports.isValidSegment = exports.sameAccess = exports.isOpen = exports.canRead = exports.OPEN_ACCESS = exports.ACCESS_MODE = exports.segmentIdsForTags = exports.isOfferedIn = void 0;
+var segment_1 = require("./lib/segment");
+Object.defineProperty(exports, "isOfferedIn", { enumerable: true, get: function () { return segment_1.isOfferedIn; } });
+Object.defineProperty(exports, "segmentIdsForTags", { enumerable: true, get: function () { return segment_1.segmentIdsForTags; } });
+var entry_access_1 = require("./lib/entry-access");
+Object.defineProperty(exports, "ACCESS_MODE", { enumerable: true, get: function () { return entry_access_1.ACCESS_MODE; } });
+Object.defineProperty(exports, "OPEN_ACCESS", { enumerable: true, get: function () { return entry_access_1.OPEN_ACCESS; } });
+Object.defineProperty(exports, "canRead", { enumerable: true, get: function () { return entry_access_1.canRead; } });
+Object.defineProperty(exports, "isOpen", { enumerable: true, get: function () { return entry_access_1.isOpen; } });
+Object.defineProperty(exports, "sameAccess", { enumerable: true, get: function () { return entry_access_1.sameAccess; } });
+// The field rules, read by both the admin's dialog and the server's DTO — two
+// copies of a validation rule is two copies to drift.
+var validation_1 = require("./lib/validation");
+Object.defineProperty(exports, "isValidSegment", { enumerable: true, get: function () { return validation_1.isValidSegment; } });
+Object.defineProperty(exports, "validateSegment", { enumerable: true, get: function () { return validation_1.validateSegment; } });
+Object.defineProperty(exports, "SEGMENT_ISSUE", { enumerable: true, get: function () { return validation_1.SEGMENT_ISSUE; } });
+Object.defineProperty(exports, "SEGMENT_KEY_MAX", { enumerable: true, get: function () { return validation_1.SEGMENT_KEY_MAX; } });
+Object.defineProperty(exports, "SEGMENT_KEY_PATTERN", { enumerable: true, get: function () { return validation_1.SEGMENT_KEY_PATTERN; } });
+Object.defineProperty(exports, "SEGMENT_LABEL_MAX", { enumerable: true, get: function () { return validation_1.SEGMENT_LABEL_MAX; } });
+Object.defineProperty(exports, "SEGMENT_TAG_MAX", { enumerable: true, get: function () { return validation_1.SEGMENT_TAG_MAX; } });
+Object.defineProperty(exports, "SEGMENT_TAGS_MAX", { enumerable: true, get: function () { return validation_1.SEGMENT_TAGS_MAX; } });
+var segment_resolver_port_1 = require("./lib/segment-resolver.port");
+Object.defineProperty(exports, "anonymousSegmentResolver", { enumerable: true, get: function () { return segment_resolver_port_1.anonymousSegmentResolver; } });
+Object.defineProperty(exports, "staticSegmentResolver", { enumerable: true, get: function () { return segment_resolver_port_1.staticSegmentResolver; } });

package/dist/lib/access-rule.d.ts

@@ -0,0 +1,120 @@
+/**
+ * The **access rule** — what an entry, a type or a workspace declares about who
+ * may read it.
+ *
+ * The shape is deliberately fixed rather than an expression language, and the
+ * three constraints below are what buy the whole design its legibility:
+ *
+ * 1. **Groups are OR-ed, types inside a group are AND-ed.** Disjunctive normal
+ *    form, and nothing else. `(Acme) OR (EU AND Pro)` is expressible;
+ *    arbitrary nesting is not.
+ * 2. **No nesting.** A group holds conditions, never other groups.
+ * 3. **One negation.** Rule-level {@link AccessRule.exclusions} are absolute and
+ *    sit above every group; a group's own `all-except` narrows only that group.
+ *
+ * Lift any of them and "why can this reader see this?" stops being a flat list
+ * and becomes a proof tree — which is exactly the failure mode this kernel
+ * exists to avoid.
+ */
+import type { SegmentTypeKey } from './segment-type';
+/** How one segment type constrains one group. */
+export declare const CONDITION_MODE: {
+    /** Does not constrain — the type is open in this group. */
+    readonly All: "all";
+    /** Everyone in the type except the named segments. */
+    readonly AllExcept: "all-except";
+    /** Only the named segments. */
+    readonly Only: "only";
+};
+/** @see CONDITION_MODE */
+export type ConditionMode = (typeof CONDITION_MODE)[keyof typeof CONDITION_MODE];
+/** The authored-only mode: take this level's value from the level above. */
+export declare const INHERIT: "inherit";
+/** A condition as **authored**, which may still defer to the level above. */
+export interface AuthoredCondition {
+    readonly mode: ConditionMode | typeof INHERIT;
+    /** Segment ids the mode refers to. Empty for `all` and `inherit`. */
+    readonly segmentIds: readonly string[];
+}
+/**
+ * A condition after inheritance has run: every `inherit` is gone.
+ *
+ * The two types are kept apart on purpose. {@link evaluate} takes only resolved
+ * conditions, so "did anyone forget to run inheritance?" is a compile error
+ * rather than a silently permissive decision at runtime.
+ */
+export interface ResolvedCondition {
+    readonly mode: ConditionMode;
+    readonly segmentIds: readonly string[];
+}
+/** One AND-group, as authored: segment type key → condition. */
+export type AuthoredConditionGroup = Readonly<Record<SegmentTypeKey, AuthoredCondition>>;
+/** One AND-group, after inheritance. */
+export interface ResolvedConditionGroup {
+    /** Segment type key → condition. A type absent here does not constrain. */
+    readonly conditions: Readonly<Record<SegmentTypeKey, ResolvedCondition>>;
+    /**
+     * Which level contributed this group — what the editor is shown as
+     * "inherited from type article". Absent for a group authored on the entry
+     * itself.
+     */
+    readonly source?: AccessLevelName;
+}
+/** What a reader who matched no group is served. */
+export declare const ACCESS_FALLBACK: {
+    /** Absent from listings, 404 on a direct read — existence stays secret. */
+    readonly Hidden: "hidden";
+    /** Returned with a teaser and `requires`, so the client can upsell. */
+    readonly Teaser: "teaser";
+    /** As `teaser`, plus whatever paywall treatment the client renders. */
+    readonly Paywall: "paywall";
+};
+/** @see ACCESS_FALLBACK */
+export type AccessFallback = (typeof ACCESS_FALLBACK)[keyof typeof ACCESS_FALLBACK];
+/** The levels a rule can be attached to, outermost first. */
+export declare const ACCESS_LEVEL: {
+    readonly Installation: "installation";
+    readonly Workspace: "workspace";
+    readonly Type: "type";
+    readonly Slice: "slice";
+    readonly Entry: "entry";
+};
+/** @see ACCESS_LEVEL */
+export type AccessLevelName = (typeof ACCESS_LEVEL)[keyof typeof ACCESS_LEVEL];
+/** Exclusions, by segment type key. Absolute: they outrank every group. */
+export type Exclusions = Readonly<Record<SegmentTypeKey, readonly string[]>>;
+/** A rule as authored at one level. */
+export interface AuthoredAccessRule {
+    /** Segments that never see the content, whatever any group says. */
+    readonly exclusions?: Exclusions;
+    /** Condition groups, OR-ed. Empty means this level adds no condition. */
+    readonly groups?: readonly AuthoredConditionGroup[];
+    /**
+     * Drop everything inherited from the levels above instead of adding to it.
+     *
+     * Merging is the default because replacing silently loses a type's own
+     * restriction the moment someone edits one entry — but "this one article is
+     * genuinely public" has to remain expressible, and this is how.
+     */
+    readonly detachInherited?: boolean;
+    /** Start of the visibility window. `null`/absent = no lower bound. */
+    readonly startsAt?: Date | null;
+    /** End of the visibility window. `null`/absent = no upper bound. */
+    readonly endsAt?: Date | null;
+    /** What a reader who matched no group gets. */
+    readonly fallback?: AccessFallback;
+}
+/** A rule after inheritance: what {@link evaluate} actually reads. */
+export interface ResolvedAccessRule {
+    readonly exclusions: Exclusions;
+    /** OR-ed groups. **Empty means unrestricted** — see {@link evaluate}. */
+    readonly groups: readonly ResolvedConditionGroup[];
+    readonly startsAt: Date | null;
+    readonly endsAt: Date | null;
+    readonly fallback: AccessFallback;
+}
+/** A rule that restricts nothing — the installation default. */
+export declare const OPEN_ACCESS: ResolvedAccessRule;
+/** Whether a resolved rule constrains anything at all. */
+export declare function isUnrestricted(rule: ResolvedAccessRule): boolean;
+//# sourceMappingURL=access-rule.d.ts.map

package/dist/lib/access-rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-rule.d.ts","sourceRoot":"","sources":["../../src/lib/access-rule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD,iDAAiD;AACjD,eAAO,MAAM,cAAc;IACvB,2DAA2D;;IAE3D,sDAAsD;;IAEtD,+BAA+B;;CAEzB,CAAC;AAEX,0BAA0B;AAC1B,MAAM,MAAM,aAAa,GACrB,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAC;AAEzD,4EAA4E;AAC5E,eAAO,MAAM,OAAO,EAAG,SAAkB,CAAC;AAE1C,6EAA6E;AAC7E,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,OAAO,CAAC;IAC9C,qEAAqE;IACrE,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,gEAAgE;AAChE,MAAM,MAAM,sBAAsB,GAAG,QAAQ,CACzC,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAC5C,CAAC;AAEF,wCAAwC;AACxC,MAAM,WAAW,sBAAsB;IACnC,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACzE;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;CACrC;AAED,oDAAoD;AACpD,eAAO,MAAM,eAAe;IACxB,2EAA2E;;IAE3E,uEAAuE;;IAEvE,uEAAuE;;CAEjE,CAAC;AAEX,2BAA2B;AAC3B,MAAM,MAAM,cAAc,GACtB,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AAE3D,6DAA6D;AAC7D,eAAO,MAAM,YAAY;;;;;;CAMf,CAAC;AAEX,wBAAwB;AACxB,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,OAAO,YAAY,CAAC,CAAC;AAE/E,2EAA2E;AAC3E,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;AAE7E,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IAC/B,oEAAoE;IACpE,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACpD;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAChC,oEAAoE;IACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;CACtC;AAED,sEAAsE;AACtE,MAAM,WAAW,kBAAkB;IAC/B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;CACrC;AAED,gEAAgE;AAChE,eAAO,MAAM,WAAW,EAAE,kBAMzB,CAAC;AAEF,0DAA0D;AAC1D,wBAAgB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAOhE"}

package/dist/lib/adopt-relation-sets.d.ts

@@ -0,0 +1,103 @@
+import { type AuthoredAccessRule } from './access-rule';
+import type { SegmentTypeKey } from './segment-type';
+/**
+ * How an entry's access is expressed **before** segmentation, in the scheme
+ * almost every CMS reaches for first: two relation fields on the entry, one
+ * listing who may read it and one listing who may not.
+ *
+ * The names are the shape's, not this CMS's — an adopter's fields are called
+ * `subscriptions` and `excludedSubscriptions`, or `plans` and `blockedPlans`.
+ * What matters is that both sides name the *same kind of thing*, which is what
+ * makes them one axis.
+ */
+export interface RelationSets {
+    /**
+     * Segment ids that may read the entry. **Empty means everyone**, which is
+     * the convention every instance of this scheme uses — an entry nobody
+     * bothered to restrict is an open entry, not a closed one.
+     */
+    readonly included: readonly string[];
+    /** Segment ids that may not read it, whatever `included` says. */
+    readonly excluded: readonly string[];
+}
+/**
+ * Translates one entry's relation sets into the rule that means the same thing.
+ *
+ * ## Why this is a function and not a migration script
+ *
+ * There is no old scheme *in this repository* to migrate from — the scheme
+ * lives in the app adopting segmentation, in fields this CMS has never seen,
+ * under names only that app knows. A script here would have to invent the input
+ * format it claims to read. What is genuinely shared is the **mapping**, and
+ * getting it wrong is what produces content that silently opens: so the mapping
+ * is the part that ships, with a test, and the adopter's script is a loop that
+ * reads their fields, calls this, and posts the result to `/api/access`.
+ * `docs/segments-adoption.md` is that loop, written out.
+ *
+ * ## The three rules of the translation
+ *
+ * **An empty `included` is not an empty `only`.** This is the whole trap. In
+ * the relation scheme an empty include list means *everyone*; in this model an
+ * `only` naming nobody admits *nobody*. Translating one to the other literally
+ * turns every unrestricted entry in a library dark on the day of the migration
+ * — so an empty `included` produces the `all` mode, and the entry stays open.
+ *
+ * **`excluded` becomes an exclusion, never the complement.** Listing the other
+ * three hundred and ninety-seven segments would be storing the complement,
+ * which is the one thing the projection invariant forbids: onboarding a new
+ * organisation would then have to rewrite every entry in the library.
+ *
+ * **The result is one group.** The old scheme has no disjunction to preserve —
+ * it is a single include list AND-ed with a single exclude list — so a
+ * translation that produced several groups would be inventing structure the
+ * source never carried.
+ */
+export declare function ruleFromRelationSets(typeKey: SegmentTypeKey, sets: RelationSets): AuthoredAccessRule;
+/**
+ * Groups entries by the rule they translate to, so an adopter creates a handful
+ * of rules rather than one per entry.
+ *
+ * This is the difference between a usable migration and an unusable one. A
+ * library of forty thousand articles carrying the same two subscription tiers
+ * has, in practice, a few dozen distinct combinations — and one rule per entry
+ * would produce forty thousand rows nobody can read, edit, or reason about,
+ * defeating the reuse that made a rule worth having. Entries sharing a
+ * combination share a rule and get an assignment each.
+ *
+ * The signature key is the two **sorted** id lists, because the relation scheme
+ * has no order and two entries listing the same segments differently are the
+ * same rule. Entries whose sets restrict nobody are returned under
+ * {@link RelationSetGrouping.unrestricted} rather than given an empty rule:
+ * they need no assignment at all, and the count of them is the first number an
+ * adopter should sanity-check against their own.
+ */
+export declare function groupByRelationSets<T>(entries: readonly {
+    entry: T;
+    sets: RelationSets;
+}[]): RelationSetGrouping<T>;
+/** One distinct combination, and the entries carrying it. */
+export interface RelationSetGroup<T> {
+    /** The sorted-id signature the grouping keyed on. */
+    signature: string;
+    /** The normalised sets — deduplicated and sorted. */
+    sets: RelationSets;
+    /** Every entry with this combination. */
+    entries: readonly T[];
+}
+/** What {@link groupByRelationSets} returns. */
+export interface RelationSetGrouping<T> {
+    /** One entry per distinct combination — the rules to create. */
+    groups: readonly RelationSetGroup<T>[];
+    /** Entries whose sets restrict nobody. They need no rule and no assignment. */
+    unrestricted: readonly T[];
+}
+/**
+ * Whether a translation would fit the model, and what to do when it does not.
+ *
+ * Called before writing anything. The one bound worth checking up front is the
+ * group ceiling — an adopter whose scheme carries a genuine disjunction (two
+ * independent axes OR-ed) will hit it, and finding out entry by entry through
+ * failed writes is a migration that stops half done.
+ */
+export declare function relationSetsFit(count: number): boolean;
+//# sourceMappingURL=adopt-relation-sets.d.ts.map

package/dist/lib/adopt-relation-sets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adopt-relation-sets.d.ts","sourceRoot":"","sources":["../../src/lib/adopt-relation-sets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IACzB;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,oBAAoB,CAChC,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,YAAY,GACnB,kBAAkB,CA8BpB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EACjC,OAAO,EAAE,SAAS;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,EAAE,GACrD,mBAAmB,CAAC,CAAC,CAAC,CA+BxB;AAED,6DAA6D;AAC7D,MAAM,WAAW,gBAAgB,CAAC,CAAC;IAC/B,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,IAAI,EAAE,YAAY,CAAC;IACnB,yCAAyC;IACzC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;CACzB;AAED,gDAAgD;AAChD,MAAM,WAAW,mBAAmB,CAAC,CAAC;IAClC,gEAAgE;IAChE,MAAM,EAAE,SAAS,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;IACvC,+EAA+E;IAC/E,YAAY,EAAE,SAAS,CAAC,EAAE,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEtD"}

package/dist/lib/entry-access.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Which way a segment is pointed at one entry.
+ *
+ * Two values, and no third. An entry lists the segments somebody made a
+ * decision about; a segment nobody mentioned is simply absent, which is not the
+ * same as either — see {@link canRead}.
+ */
+export declare const ACCESS_MODE: {
+    /** This segment may read the entry. */
+    readonly Allow: "allow";
+    /** This segment may not, whatever any allow says. */
+    readonly Deny: "deny";
+};
+/** One value of {@link ACCESS_MODE}. */
+export type AccessMode = (typeof ACCESS_MODE)[keyof typeof ACCESS_MODE];
+/** One entry's decisions — the segment ids on each side. */
+export interface EntryAccess {
+    /** Segments that may read it. **Empty means everyone.** */
+    readonly allow: readonly string[];
+    /** Segments that may not, whatever `allow` says. */
+    readonly deny: readonly string[];
+}
+/** An entry nobody has decided anything about. */
+export declare const OPEN_ACCESS: EntryAccess;
+/**
+ * Whether a reader may read the entry.
+ *
+ * Three rules, in this order, and the order is the whole specification:
+ *
+ * 1. **A deny wins.** A reader in any denied segment is out, however many allow
+ *    lists they are also in. Put the other way round and "everyone in Europe
+ *    except this one customer" would be unsayable.
+ * 2. **An empty allow list means everyone.** Not nobody. The two look like the
+ *    same emptiness and are opposite: an entry nobody has restricted is the
+ *    state every entry starts in, and reading it as a closed door would black
+ *    out a library the day the feature is switched on.
+ * 3. **Otherwise the reader must be in the allow list.** Including the
+ *    anonymous reader, who is in no segment at all and therefore sees only
+ *    entries with an empty allow list.
+ *
+ * That is the entire model. There is no inheritance, no rule object, no
+ * ordering between entries, and nothing to resolve — an entry's two lists are
+ * the answer, so what an editor sets is exactly what a reader gets.
+ */
+export declare function canRead(access: EntryAccess, readerSegmentIds: ReadonlySet<string>): boolean;
+/**
+ * Whether an entry's lists restrict anybody.
+ *
+ * What the editor's badge and the storage layer both key on: an unrestricted
+ * entry is stored as **no row at all**, so a reader's query finds nothing and
+ * pays an index probe rather than a comparison.
+ */
+export declare function isOpen(access: EntryAccess): boolean;
+/**
+ * Whether two sets of lists say the same thing.
+ *
+ * Order-insensitive, because the lists are **sets** everywhere they matter —
+ * `canRead` asks about membership, the stored arrays come back in insertion
+ * order, and a caller that resent the same audiences in a different order is
+ * asking for no change at all.
+ *
+ * Three callers depend on that reading: the editor's staging clears itself when
+ * a toggle returns to what is stored, the entry-write extension skips a write —
+ * and therefore a permission check — that would change nothing, and the same
+ * extension decides from it whether a locale group is already in step.
+ */
+export declare function sameAccess(a: EntryAccess, b: EntryAccess): boolean;
+//# sourceMappingURL=entry-access.d.ts.map

package/dist/lib/entry-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-access.d.ts","sourceRoot":"","sources":["../../src/lib/entry-access.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,WAAW;IACpB,uCAAuC;;IAEvC,qDAAqD;;CAE/C,CAAC;AAEX,wCAAwC;AACxC,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,OAAO,WAAW,CAAC,CAAC;AAExE,4DAA4D;AAC5D,MAAM,WAAW,WAAW;IACxB,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,kDAAkD;AAClD,eAAO,MAAM,WAAW,EAAE,WAAqC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,OAAO,CACnB,MAAM,EAAE,WAAW,EACnB,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,GACtC,OAAO,CAMT;AAED;;;;;;GAMG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAEnD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,WAAW,GAAG,OAAO,CAKlE"}

package/dist/lib/entry-access.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OPEN_ACCESS = exports.ACCESS_MODE = void 0;
+exports.canRead = canRead;
+exports.isOpen = isOpen;
+exports.sameAccess = sameAccess;
+/**
+ * Which way a segment is pointed at one entry.
+ *
+ * Two values, and no third. An entry lists the segments somebody made a
+ * decision about; a segment nobody mentioned is simply absent, which is not the
+ * same as either — see {@link canRead}.
+ */
+exports.ACCESS_MODE = {
+    /** This segment may read the entry. */
+    Allow: 'allow',
+    /** This segment may not, whatever any allow says. */
+    Deny: 'deny'
+};
+/** An entry nobody has decided anything about. */
+exports.OPEN_ACCESS = { allow: [], deny: [] };
+/**
+ * Whether a reader may read the entry.
+ *
+ * Three rules, in this order, and the order is the whole specification:
+ *
+ * 1. **A deny wins.** A reader in any denied segment is out, however many allow
+ *    lists they are also in. Put the other way round and "everyone in Europe
+ *    except this one customer" would be unsayable.
+ * 2. **An empty allow list means everyone.** Not nobody. The two look like the
+ *    same emptiness and are opposite: an entry nobody has restricted is the
+ *    state every entry starts in, and reading it as a closed door would black
+ *    out a library the day the feature is switched on.
+ * 3. **Otherwise the reader must be in the allow list.** Including the
+ *    anonymous reader, who is in no segment at all and therefore sees only
+ *    entries with an empty allow list.
+ *
+ * That is the entire model. There is no inheritance, no rule object, no
+ * ordering between entries, and nothing to resolve — an entry's two lists are
+ * the answer, so what an editor sets is exactly what a reader gets.
+ */
+function canRead(access, readerSegmentIds) {
+    for (const id of access.deny) {
+        if (readerSegmentIds.has(id))
+            return false;
+    }
+    if (!access.allow.length)
+        return true;
+    return access.allow.some((id) => readerSegmentIds.has(id));
+}
+/**
+ * Whether an entry's lists restrict anybody.
+ *
+ * What the editor's badge and the storage layer both key on: an unrestricted
+ * entry is stored as **no row at all**, so a reader's query finds nothing and
+ * pays an index probe rather than a comparison.
+ */
+function isOpen(access) {
+    return access.allow.length === 0 && access.deny.length === 0;
+}
+/**
+ * Whether two sets of lists say the same thing.
+ *
+ * Order-insensitive, because the lists are **sets** everywhere they matter —
+ * `canRead` asks about membership, the stored arrays come back in insertion
+ * order, and a caller that resent the same audiences in a different order is
+ * asking for no change at all.
+ *
+ * Three callers depend on that reading: the editor's staging clears itself when
+ * a toggle returns to what is stored, the entry-write extension skips a write —
+ * and therefore a permission check — that would change nothing, and the same
+ * extension decides from it whether a locale group is already in step.
+ */
+function sameAccess(a, b) {
+    const equal = (left, right) => left.length === right.length &&
+        [...left].sort().join() === [...right].sort().join();
+    return equal(a.allow, b.allow) && equal(a.deny, b.deny);
+}

package/dist/lib/evaluate.d.ts

@@ -0,0 +1,78 @@
+/**
+ * The access decision — the single place that answers "may this reader see
+ * this?".
+ *
+ * A domain service in the strict sense: no database, no framework, no clock of
+ * its own. That is what lets the same function run in the SQL compiler's tests,
+ * in the admin's "who sees this" panel, and on a client rendering a paywall,
+ * and give all three the same answer.
+ *
+ * The order of the checks is not interchangeable:
+ *
+ * 1. **Exclusions**, absolutely and first. "Everyone except Globex" must not be
+ *    reopened by a group that happens to match — a denied reader is denied
+ *    however good their plan is.
+ * 2. **The window**, before any group. An embargoed entry is invisible to
+ *    everyone, so evaluating groups first would only produce a match nobody is
+ *    allowed to act on.
+ * 3. **The groups**, OR-ed. One match is enough, and the rest are not even
+ *    reported as failures — which is what keeps the explanation short.
+ */
+import { type ResolvedAccessRule } from './access-rule';
+import type { SegmentTypeKey } from './segment-type';
+/** Why a reader was refused. */
+export declare const DENIAL_REASON: {
+    /** Matched a rule-level exclusion. */
+    readonly Excluded: "excluded";
+    /** The visibility window is not open. */
+    readonly Window: "window";
+    /** No condition group matched. */
+    readonly NoGroup: "no-group";
+};
+/** @see DENIAL_REASON */
+export type DenialReason = (typeof DENIAL_REASON)[keyof typeof DENIAL_REASON];
+/** The group a refused reader came closest to, and what stopped them. */
+export interface ClosestGroup {
+    /** Index into {@link ResolvedAccessRule.groups}. */
+    readonly index: number;
+    /** Segment type keys whose condition failed, in declaration order. */
+    readonly failed: readonly SegmentTypeKey[];
+    /** Segment ids that would have satisfied those failing conditions. */
+    readonly requires: Readonly<Record<SegmentTypeKey, readonly string[]>>;
+}
+/** The verdict for one reader on one entry. */
+export type AccessDecision = {
+    readonly visible: true;
+    /**
+     * Which group let them through — `-1` when the rule restricts
+     * nothing, so "unrestricted" and "matched group 0" stay
+     * distinguishable in an explanation.
+     */
+    readonly matchedGroup: number;
+} | {
+    readonly visible: false;
+    readonly reason: DenialReason;
+    readonly fallback: ResolvedAccessRule['fallback'];
+    /** Absent when the refusal was an exclusion or the window. */
+    readonly closest?: ClosestGroup;
+};
+/** What {@link evaluate} is asked about. */
+export interface EvaluationInput {
+    /** The entry's rule, after inheritance. */
+    readonly rule: ResolvedAccessRule;
+    /** The reader's segment ids, already resolved from their tags. */
+    readonly callerSegmentIds: ReadonlySet<string>;
+    /** The instant the decision is made at — passed in, never read here. */
+    readonly now: Date;
+}
+/**
+ * Decide whether one reader may see one entry.
+ *
+ * **An empty `groups` means unrestricted**, not "matches nothing". A rule with
+ * no conditions is what every entry starts life with, and reading it as a
+ * closed door would black out an installation the moment the plugin is
+ * enabled. Exclusions and the window still apply on their own, so
+ * "everyone except Globex" needs no group at all.
+ */
+export declare function evaluate(input: EvaluationInput): AccessDecision;
+//# sourceMappingURL=evaluate.d.ts.map

package/dist/lib/evaluate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../src/lib/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAGH,KAAK,kBAAkB,EAG1B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD,gCAAgC;AAChC,eAAO,MAAM,aAAa;IACtB,sCAAsC;;IAEtC,yCAAyC;;IAEzC,kCAAkC;;CAE5B,CAAC;AAEX,yBAAyB;AACzB,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC;AAE9E,yEAAyE;AACzE,MAAM,WAAW,YAAY;IACzB,oDAAoD;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC;IAC3C,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;CAC1E;AAED,+CAA+C;AAC/C,MAAM,MAAM,cAAc,GACpB;IACI,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CACjC,GACD;IACI,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAClD,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;CACnC,CAAC;AAER,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC5B,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,kEAAkE;IAClE,QAAQ,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/C,wEAAwE;IACxE,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACtB;AAgGD;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,cAAc,CAsC/D"}

package/dist/lib/inheritance.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Inheritance — turning the chain of levels an entry sits under into the one
+ * rule {@link evaluate} reads.
+ *
+ * The chain runs installation → workspace → type → slice → entry, and the rule
+ * for merging it is the answer to a question the plan leaves open on purpose:
+ * a lower level **adds** its groups to what it inherited rather than replacing
+ * them. Replacement as the default loses a type's restriction the moment
+ * somebody edits one entry — the failure is silent and the content is already
+ * public by the time anyone notices. Detaching stays possible, but it has to be
+ * asked for ({@link AuthoredAccessRule.detachInherited}).
+ *
+ * Exclusions never merge downward the other way: they are unioned across the
+ * whole chain and a lower level cannot lift one. That is the same "deny wins"
+ * rule {@link evaluate} enforces within a single rule, applied across levels.
+ */
+import { type AccessLevelName, type AuthoredAccessRule, type ResolvedAccessRule } from './access-rule';
+/** One link in the chain: where the rule was authored, and what it says. */
+export interface AccessLevel {
+    /** Which level this is. Used to label an inherited group in the editor. */
+    readonly name: AccessLevelName;
+    /** The rule authored there, or `null`/absent when the level says nothing. */
+    readonly rule?: AuthoredAccessRule | null;
+}
+/** A resolved rule plus what it was assembled from. */
+export interface ResolvedAccess {
+    /** What {@link evaluate} takes. */
+    readonly rule: ResolvedAccessRule;
+    /** Levels that contributed anything, outermost first. */
+    readonly contributors: readonly AccessLevelName[];
+    /** The level whose `detachInherited` dropped the chain above it, if any. */
+    readonly detachedAt?: AccessLevelName;
+}
+/**
+ * Collapse the chain into a single rule.
+ *
+ * Levels are read outermost-first and each may add groups, add exclusions, set
+ * the window, set the fallback, or detach. The **nearest** level that states a
+ * window or a fallback wins, because those are single-valued — unlike groups,
+ * which accumulate.
+ */
+export declare function resolveAccess(levels: readonly AccessLevel[]): ResolvedAccess;
+//# sourceMappingURL=inheritance.d.ts.map

package/dist/lib/inheritance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inheritance.d.ts","sourceRoot":"","sources":["../../src/lib/inheritance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAKH,KAAK,eAAe,EACpB,KAAK,kBAAkB,EAGvB,KAAK,kBAAkB,EAG1B,MAAM,eAAe,CAAC;AAGvB,4EAA4E;AAC5E,MAAM,WAAW,WAAW;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CAC7C;AAED,uDAAuD;AACvD,MAAM,WAAW,cAAc;IAC3B,mCAAmC;IACnC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,yDAAyD;IACzD,QAAQ,CAAC,YAAY,EAAE,SAAS,eAAe,EAAE,CAAC;IAClD,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAC;CACzC;AA6CD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,GAAG,cAAc,CA0D5E"}

package/dist/lib/limits.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The ceilings segmentation runs under.
+ *
+ * Both are cost limits with a visible failure mode, not arbitrary round
+ * numbers, and both are stated here so the server's validation and the admin's
+ * "2 of 8" counter read the same constant.
+ */
+/**
+ * Condition groups per rule.
+ *
+ * Each group is one row of the entry's projection, so a group added at type
+ * level multiplies the projection for every entry of that type. Eight is the
+ * point past which "add another OR" stops being a cheap edit; the number is a
+ * starting position to be revisited against a real write benchmark, not a
+ * measured optimum.
+ */
+export declare const MAX_CONDITION_GROUPS = 8;
+/**
+ * Segment types active at once.
+ *
+ * Bounded by the projection's slot columns — a type claims one `allow`/`deny`
+ * pair, and the pairs are created by migration rather than by runtime DDL, so
+ * the schema stays reproducible from a checkout. Raising it is one migration
+ * that adds the next batch.
+ */
+export declare const MAX_SEGMENT_TYPES = 8;
+//# sourceMappingURL=limits.d.ts.map

package/dist/lib/limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/lib/limits.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,IAAI,CAAC;AAEtC;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,IAAI,CAAC"}

package/dist/lib/segment-resolver.port.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Where a reader's tags come from.
+ *
+ * The one thing this package cannot know: a deployment's readers are its own —
+ * a JWT claim, a header the CDN sets, a lookup against a billing system. So the
+ * host implements this, and everything above it deals in tags.
+ *
+ * **It fails closed by returning nothing, never by throwing.** An unreachable
+ * source produces the anonymous reader, who still sees every unrestricted
+ * entry; taking the site down over content most of its readers can see anyway
+ * is the wrong trade.
+ */
+export interface SegmentResolver<TRequest = unknown> {
+    /** The tags this reader carries. Empty is the anonymous reader. */
+    resolve(request: TRequest): Promise<readonly string[]>;
+}
+/** A resolver that always answers with the same tags — for tests and demos. */
+export declare function staticSegmentResolver<TRequest>(tags: readonly string[]): SegmentResolver<TRequest>;
+/**
+ * The resolver a deployment gets when it configures none: every reader is
+ * anonymous, so unrestricted content serves and restricted content does not.
+ * That is the honest default — the alternative, treating an unknown reader as
+ * unconstrained, turns every gap in configuration into an open door.
+ */
+export declare function anonymousSegmentResolver<TRequest>(): SegmentResolver<TRequest>;
+//# sourceMappingURL=segment-resolver.port.d.ts.map

package/dist/lib/segment-resolver.port.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"segment-resolver.port.d.ts","sourceRoot":"","sources":["../../src/lib/segment-resolver.port.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe,CAAC,QAAQ,GAAG,OAAO;IAC/C,mEAAmE;IACnE,OAAO,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;CAC1D;AAED,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,QAAQ,EAC1C,IAAI,EAAE,SAAS,MAAM,EAAE,GACxB,eAAe,CAAC,QAAQ,CAAC,CAE3B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACpC,QAAQ,KACP,eAAe,CAAC,QAAQ,CAAC,CAE7B"}

package/dist/lib/segment-resolver.port.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.staticSegmentResolver = staticSegmentResolver;
+exports.anonymousSegmentResolver = anonymousSegmentResolver;
+/** A resolver that always answers with the same tags — for tests and demos. */
+function staticSegmentResolver(tags) {
+    return { resolve: async () => tags };
+}
+/**
+ * The resolver a deployment gets when it configures none: every reader is
+ * anonymous, so unrestricted content serves and restricted content does not.
+ * That is the honest default — the alternative, treating an unknown reader as
+ * unconstrained, turns every gap in configuration into an open door.
+ */
+function anonymousSegmentResolver() {
+    return { resolve: async () => [] };
+}

package/dist/lib/segment-type.d.ts

@@ -0,0 +1,87 @@
+/**
+ * A **segment type** — one axis of the access decision, and the unit of AND
+ * logic. "Organisation", "Plan", "Region" and "Role" are all segment types; the
+ * kernel knows none of them by name, only that each owns a tag namespace and
+ * that types are AND-ed with one another.
+ */
+/** A reader's raw entitlement tag, namespaced by its type key: `org:acme`. */
+export type SegmentTag = string;
+/** The namespace half of a tag — and the key of the type that owns it. */
+export type SegmentTypeKey = string;
+/**
+ * How many segments a type is expected to hold, and therefore how the admin
+ * renders it: `low` earns matrix columns, `high` gets a searchable picker. A
+ * hint for the UI, never consulted by {@link evaluate}.
+ */
+export declare const SEGMENT_CARDINALITY: {
+    readonly Low: "low";
+    readonly High: "high";
+};
+/** @see SEGMENT_CARDINALITY */
+export type SegmentCardinality = (typeof SEGMENT_CARDINALITY)[keyof typeof SEGMENT_CARDINALITY];
+/**
+ * Where a type's segments come from. The kernel does not read any of these —
+ * it is the server package that populates segments from the named source — but
+ * the vocabulary lives here so both runtimes name the four the same way.
+ */
+export declare const SEGMENT_SOURCE_KIND: {
+    /** Maintained by hand in the admin (plans, tiers). */
+    readonly Manual: "manual";
+    /** A fixed list declared in configuration (regions). */
+    readonly Static: "static";
+    /** Mirrors a content collection — one segment per record (organisations). */
+    readonly ContentType: "contentType";
+    /** Mirrors an external directory, read through the resolver's adapter. */
+    readonly External: "external";
+};
+/** @see SEGMENT_SOURCE_KIND */
+export type SegmentSourceKind = (typeof SEGMENT_SOURCE_KIND)[keyof typeof SEGMENT_SOURCE_KIND];
+/**
+ * A type's lifecycle. `draining` is the state that makes slot reuse safe: the
+ * type has left the predicate and the UI, but its slot columns still hold the
+ * old ids and must be zeroed before another type may claim it. Skipping it is
+ * how a new type would silently inherit a stranger's segments.
+ */
+export declare const SEGMENT_TYPE_STATE: {
+    readonly Active: "active";
+    readonly Draining: "draining";
+    readonly Free: "free";
+};
+/** @see SEGMENT_TYPE_STATE */
+export type SegmentTypeState = (typeof SEGMENT_TYPE_STATE)[keyof typeof SEGMENT_TYPE_STATE];
+/** Who owns a type's definition — and therefore whether the admin may edit it. */
+export declare const SEGMENT_TYPE_MANAGED_BY: {
+    /** Declared in `ortha.config.ts`; read-only in the admin. */
+    readonly Config: "config";
+    /** Created in the admin; editable there. */
+    readonly Ui: "ui";
+};
+/** @see SEGMENT_TYPE_MANAGED_BY */
+export type SegmentTypeManagedBy = (typeof SEGMENT_TYPE_MANAGED_BY)[keyof typeof SEGMENT_TYPE_MANAGED_BY];
+/** One declared axis of the access decision. */
+export interface SegmentType {
+    /** Stable id. */
+    readonly id: string;
+    /** Tag namespace this type owns, e.g. `org` for `org:acme`. */
+    readonly key: SegmentTypeKey;
+    /** Human-readable name, shown in the editor. */
+    readonly label: string;
+    /** Rendering hint. @see SEGMENT_CARDINALITY */
+    readonly cardinality: SegmentCardinality;
+    /** Which projection slot pair this type reads and writes. */
+    readonly slot: number;
+    /** @see SEGMENT_TYPE_STATE */
+    readonly state: SegmentTypeState;
+    /** @see SEGMENT_TYPE_MANAGED_BY */
+    readonly managedBy: SegmentTypeManagedBy;
+}
+/**
+ * The namespace a tag belongs to — everything before the first `:`.
+ *
+ * A tag with no separator has **no** namespace rather than being its own: a
+ * bare `pro` must not be swept up by a mask over some type that happens to be
+ * called `pro`, and returning `undefined` is what keeps
+ * {@link segmentMatchesTag} from guessing.
+ */
+export declare function tagNamespace(tag: SegmentTag): SegmentTypeKey | undefined;
+//# sourceMappingURL=segment-type.d.ts.map

package/dist/lib/segment-type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"segment-type.d.ts","sourceRoot":"","sources":["../../src/lib/segment-type.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,8EAA8E;AAC9E,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC;AAEhC,0EAA0E;AAC1E,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC;AAEpC;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;CAGtB,CAAC;AAEX,+BAA+B;AAC/B,MAAM,MAAM,kBAAkB,GAC1B,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAEnE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;IAC5B,sDAAsD;;IAEtD,wDAAwD;;IAExD,6EAA6E;;IAE7E,0EAA0E;;CAEpE,CAAC;AAEX,+BAA+B;AAC/B,MAAM,MAAM,iBAAiB,GACzB,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB;;;;CAIrB,CAAC;AAEX,8BAA8B;AAC9B,MAAM,MAAM,gBAAgB,GACxB,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAC;AAEjE,kFAAkF;AAClF,eAAO,MAAM,uBAAuB;IAChC,6DAA6D;;IAE7D,4CAA4C;;CAEtC,CAAC;AAEX,mCAAmC;AACnC,MAAM,MAAM,oBAAoB,GAC5B,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,OAAO,uBAAuB,CAAC,CAAC;AAE3E,gDAAgD;AAChD,MAAM,WAAW,WAAW;IACxB,iBAAiB;IACjB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;IAC7B,gDAAgD;IAChD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+CAA+C;IAC/C,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;IACzC,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8BAA8B;IAC9B,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,mCAAmC;IACnC,QAAQ,CAAC,SAAS,EAAE,oBAAoB,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,UAAU,GAAG,cAAc,GAAG,SAAS,CAGxE"}

package/dist/lib/segment.d.ts

@@ -0,0 +1,56 @@
+/**
+ * One audience — a named set of reader tags.
+ *
+ * The **tags** are the indirection that makes the whole thing worth having. A
+ * reader arrives carrying identifiers your application already knows (`acme`,
+ * `plan-pro`, an organisation id); a segment says which of those it answers to.
+ * So when an identifier changes upstream, one segment row is edited and every
+ * entry that named the segment keeps working — nothing outside this file ever
+ * compares a raw tag.
+ */
+export interface Segment {
+    /** Stable id — what an entry's allow/deny list holds. */
+    readonly id: string;
+    /** Url-safe key, unique in the installation. */
+    readonly key: string;
+    /** Human-readable name, shown in the entry editor. */
+    readonly label: string;
+    /**
+     * Reader tags this segment answers to — **any one** is enough. Defaults to
+     * the key, which is what an installation that never renames anything wants.
+     */
+    readonly tags: readonly string[];
+    /**
+     * The workspaces this audience is offered in. **Empty means every one.**
+     *
+     * The same reading as an entry's empty allow list, and it is deliberate
+     * rather than convenient: it is the state every segment starts in, and
+     * taking emptiness for "nowhere" would make an audience nobody had scoped
+     * yet disappear from every editor.
+     *
+     * It narrows **where the audience can be chosen**, never who it lets in. A
+     * decision already made on an entry stays as its editor left it even if the
+     * segment is later scoped away from that workspace — see `isOfferedIn`.
+     */
+    readonly workspaceIds?: readonly string[];
+}
+/**
+ * Whether an audience may be chosen on content in this workspace.
+ *
+ * Not a reader rule. `canRead` never consults it, and it must not: a stored
+ * decision means what its editor meant, and re-deciding it from a screen about
+ * where an audience is *offered* would change who can read published content
+ * with nothing on either screen to say so. This answers the editor's question —
+ * "may I pick this here?" — and nothing else.
+ */
+export declare function isOfferedIn(segment: Segment, workspaceId: string | undefined): boolean;
+/**
+ * The segments a reader's tags resolve to.
+ *
+ * An exact, case-sensitive match on any tag. There is deliberately no pattern,
+ * no prefix and no namespace: those exist to express "any of this kind", which
+ * is a question this model answers by not asking it — an entry lists the
+ * segments that may read it, and "any" is the empty list.
+ */
+export declare function segmentIdsForTags(segments: readonly Segment[], tags: readonly string[]): Set<string>;
+//# sourceMappingURL=segment.d.ts.map

package/dist/lib/segment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"segment.d.ts","sourceRoot":"","sources":["../../src/lib/segment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,WAAW,OAAO;IACpB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,sDAAsD;IACtD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CACvB,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,MAAM,GAAG,SAAS,GAChC,OAAO,CAKT;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC7B,QAAQ,EAAE,SAAS,OAAO,EAAE,EAC5B,IAAI,EAAE,SAAS,MAAM,EAAE,GACxB,GAAG,CAAC,MAAM,CAAC,CAUb"}

package/dist/lib/segment.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isOfferedIn = isOfferedIn;
+exports.segmentIdsForTags = segmentIdsForTags;
+/**
+ * Whether an audience may be chosen on content in this workspace.
+ *
+ * Not a reader rule. `canRead` never consults it, and it must not: a stored
+ * decision means what its editor meant, and re-deciding it from a screen about
+ * where an audience is *offered* would change who can read published content
+ * with nothing on either screen to say so. This answers the editor's question —
+ * "may I pick this here?" — and nothing else.
+ */
+function isOfferedIn(segment, workspaceId) {
+    if (!segment.workspaceIds?.length)
+        return true;
+    return workspaceId !== undefined
+        ? segment.workspaceIds.includes(workspaceId)
+        : false;
+}
+/**
+ * The segments a reader's tags resolve to.
+ *
+ * An exact, case-sensitive match on any tag. There is deliberately no pattern,
+ * no prefix and no namespace: those exist to express "any of this kind", which
+ * is a question this model answers by not asking it — an entry lists the
+ * segments that may read it, and "any" is the empty list.
+ */
+function segmentIdsForTags(segments, tags) {
+    if (!tags.length)
+        return new Set();
+    const carried = new Set(tags);
+    const ids = new Set();
+    for (const segment of segments) {
+        if (segment.tags.some((tag) => carried.has(tag))) {
+            ids.add(segment.id);
+        }
+    }
+    return ids;
+}

package/dist/lib/validation.d.ts

@@ -0,0 +1,64 @@
+/**
+ * What a segment's fields may hold — the rules, in one place.
+ *
+ * The admin's dialog and the server's DTO both read from here rather than each
+ * spelling out a pattern of its own. Two copies of a validation rule is two
+ * copies to drift, and the way it shows up is the worst one available: a form
+ * that accepts what the API then refuses, with the refusal arriving as a 400
+ * carrying a message written for a different audience.
+ */
+/**
+ * A segment key: lowercase, url-safe, starting with a letter or digit.
+ *
+ * It is also the **default reader tag**, which is why it is this narrow. A key
+ * with a space or a capital in it would become a tag nobody's resolver produces,
+ * and the segment would silently match nobody.
+ */
+export declare const SEGMENT_KEY_PATTERN: RegExp;
+/** Longest accepted key. */
+export declare const SEGMENT_KEY_MAX = 120;
+/** Longest accepted label. */
+export declare const SEGMENT_LABEL_MAX = 200;
+/** Longest accepted single reader tag. */
+export declare const SEGMENT_TAG_MAX = 200;
+/** Most reader tags one segment may answer to. */
+export declare const SEGMENT_TAGS_MAX = 20;
+/** Why one field was refused. Stable keys — the admin renders its own copy. */
+export declare const SEGMENT_ISSUE: {
+    readonly Required: "required";
+    readonly TooLong: "too-long";
+    readonly Malformed: "malformed";
+    readonly TooMany: "too-many";
+    readonly Duplicate: "duplicate";
+};
+/** One value of {@link SEGMENT_ISSUE}. */
+export type SegmentIssue = (typeof SEGMENT_ISSUE)[keyof typeof SEGMENT_ISSUE];
+/** What was wrong, per field. A field with nothing wrong is absent. */
+export type SegmentIssues = {
+    key?: SegmentIssue;
+    label?: SegmentIssue;
+    tags?: SegmentIssue;
+};
+/** What is being checked. */
+export interface SegmentDraft {
+    /** Absent when editing — the key is immutable. */
+    readonly key?: string;
+    readonly label: string;
+    readonly tags: readonly string[];
+}
+/**
+ * Checks one draft, returning an issue per bad field.
+ *
+ * Returns a **map, not a first error**: a form shows every field's problem at
+ * once, and reporting them one at a time turns fixing three fields into three
+ * round trips through the same button.
+ *
+ * `existingKeys` catches the collision the server answers 409 for. Checking it
+ * here is not a second authority — the server still decides, and still wins a
+ * race between two people creating the same key — it just means the common case
+ * is answered inline instead of as a failed submit.
+ */
+export declare function validateSegment(draft: SegmentDraft, existingKeys?: readonly string[]): SegmentIssues;
+/** Whether a draft has nothing wrong with it. */
+export declare function isValidSegment(issues: SegmentIssues): boolean;
+//# sourceMappingURL=validation.d.ts.map

package/dist/lib/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/lib/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,QAA2B,CAAC;AAE5D,4BAA4B;AAC5B,eAAO,MAAM,eAAe,MAAM,CAAC;AACnC,8BAA8B;AAC9B,eAAO,MAAM,iBAAiB,MAAM,CAAC;AACrC,0CAA0C;AAC1C,eAAO,MAAM,eAAe,MAAM,CAAC;AACnC,kDAAkD;AAClD,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC,+EAA+E;AAC/E,eAAO,MAAM,aAAa;;;;;;CAMhB,CAAC;AAEX,0CAA0C;AAC1C,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC;AAE9E,uEAAuE;AACvE,MAAM,MAAM,aAAa,GAAG;IACxB,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,IAAI,CAAC,EAAE,YAAY,CAAC;CACvB,CAAC;AAEF,6BAA6B;AAC7B,MAAM,WAAW,YAAY;IACzB,kDAAkD;IAClD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC3B,KAAK,EAAE,YAAY,EACnB,YAAY,GAAE,SAAS,MAAM,EAAO,GACrC,aAAa,CAoCf;AAED,iDAAiD;AACjD,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAE7D"}

package/dist/lib/validation.js

@@ -0,0 +1,93 @@
+"use strict";
+/**
+ * What a segment's fields may hold — the rules, in one place.
+ *
+ * The admin's dialog and the server's DTO both read from here rather than each
+ * spelling out a pattern of its own. Two copies of a validation rule is two
+ * copies to drift, and the way it shows up is the worst one available: a form
+ * that accepts what the API then refuses, with the refusal arriving as a 400
+ * carrying a message written for a different audience.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SEGMENT_ISSUE = exports.SEGMENT_TAGS_MAX = exports.SEGMENT_TAG_MAX = exports.SEGMENT_LABEL_MAX = exports.SEGMENT_KEY_MAX = exports.SEGMENT_KEY_PATTERN = void 0;
+exports.validateSegment = validateSegment;
+exports.isValidSegment = isValidSegment;
+/**
+ * A segment key: lowercase, url-safe, starting with a letter or digit.
+ *
+ * It is also the **default reader tag**, which is why it is this narrow. A key
+ * with a space or a capital in it would become a tag nobody's resolver produces,
+ * and the segment would silently match nobody.
+ */
+exports.SEGMENT_KEY_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
+/** Longest accepted key. */
+exports.SEGMENT_KEY_MAX = 120;
+/** Longest accepted label. */
+exports.SEGMENT_LABEL_MAX = 200;
+/** Longest accepted single reader tag. */
+exports.SEGMENT_TAG_MAX = 200;
+/** Most reader tags one segment may answer to. */
+exports.SEGMENT_TAGS_MAX = 20;
+/** Why one field was refused. Stable keys — the admin renders its own copy. */
+exports.SEGMENT_ISSUE = {
+    Required: 'required',
+    TooLong: 'too-long',
+    Malformed: 'malformed',
+    TooMany: 'too-many',
+    Duplicate: 'duplicate'
+};
+/**
+ * Checks one draft, returning an issue per bad field.
+ *
+ * Returns a **map, not a first error**: a form shows every field's problem at
+ * once, and reporting them one at a time turns fixing three fields into three
+ * round trips through the same button.
+ *
+ * `existingKeys` catches the collision the server answers 409 for. Checking it
+ * here is not a second authority — the server still decides, and still wins a
+ * race between two people creating the same key — it just means the common case
+ * is answered inline instead of as a failed submit.
+ */
+function validateSegment(draft, existingKeys = []) {
+    const issues = {};
+    const label = draft.label.trim();
+    if (!label) {
+        issues.label = exports.SEGMENT_ISSUE.Required;
+    }
+    else if (label.length > exports.SEGMENT_LABEL_MAX) {
+        issues.label = exports.SEGMENT_ISSUE.TooLong;
+    }
+    if (draft.key !== undefined) {
+        const key = draft.key.trim();
+        if (!key) {
+            issues.key = exports.SEGMENT_ISSUE.Required;
+        }
+        else if (key.length > exports.SEGMENT_KEY_MAX) {
+            issues.key = exports.SEGMENT_ISSUE.TooLong;
+        }
+        else if (!exports.SEGMENT_KEY_PATTERN.test(key)) {
+            issues.key = exports.SEGMENT_ISSUE.Malformed;
+        }
+        else if (existingKeys.includes(key)) {
+            issues.key = exports.SEGMENT_ISSUE.Duplicate;
+        }
+    }
+    // Blanks are dropped rather than refused — they are what a trailing newline
+    // in a pasted list produces, and refusing a paste over its last character
+    // is an argument with the user about something they cannot see.
+    const tags = draft.tags.map((tag) => tag.trim()).filter(Boolean);
+    if (tags.length > exports.SEGMENT_TAGS_MAX) {
+        issues.tags = exports.SEGMENT_ISSUE.TooMany;
+    }
+    else if (tags.some((tag) => tag.length > exports.SEGMENT_TAG_MAX)) {
+        issues.tags = exports.SEGMENT_ISSUE.TooLong;
+    }
+    else if (new Set(tags).size !== tags.length) {
+        issues.tags = exports.SEGMENT_ISSUE.Duplicate;
+    }
+    return issues;
+}
+/** Whether a draft has nothing wrong with it. */
+function isValidSegment(issues) {
+    return Object.keys(issues).length === 0;
+}

package/package.json

@@ -0,0 +1,33 @@
+{
+    "name": "@orthacms/segments-domain",
+    "version": "0.0.0-reserve.0",
+    "description": "@orthacms/segments-domain — part of Ortha CMS.",
+    "license": "MIT",
+    "homepage": "https://github.com/ortha-source/ortha-cms/tree/main/packages/segments/domain",
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/ortha-source/ortha-cms.git",
+        "directory": "packages/segments/domain"
+    },
+    "bugs": {
+        "url": "https://github.com/ortha-source/ortha-cms/issues"
+    },
+    "main": "./dist/index.js",
+    "types": "./dist/index.d.ts",
+    "exports": {
+        ".": {
+            "types": "./dist/index.d.ts",
+            "default": "./dist/index.js"
+        },
+        "./package.json": "./package.json"
+    },
+    "files": [
+        "dist"
+    ],
+    "dependencies": {
+        "tslib": "^2.3.0"
+    },
+    "publishConfig": {
+        "access": "public"
+    }
+}