@things-factory/figure-service 10.1.178 → 10.1.179

package/server/service/figure/figure-namespace-resolver.ts

@@ -1,41 +1,54 @@
-import { Arg, Ctx, Directive, Field, Mutation, ObjectType, Query, Resolver, UseMiddleware } from 'type-graphql'
+import { Arg, Ctx, Directive, Mutation, Query, Resolver, UseMiddleware } from 'type-graphql'
 
 import { getDataSource, SpeakRefusals } from '@things-factory/shell'
 
-import { figureNamespaceStateOf, setFigureNamespace } from './figure-namespace.js'
+import { FigureNamespace } from './figure-namespace-entity.js'
+import { createFigureNamespace, namespacesOf, setDefaultFigureNamespace, setFigureNamespaceState } from './figure-namespace.js'
 
-@ObjectType({ description: "A domain's figure namespace, as the setting screen shows it (ADR-0114)." })
-export class FigureNamespace {
-  @Field({ nullable: true, description: 'The namespace new figures are created under; null when neither the setting nor the subdomain is one.' })
-  namespace?: string
-
-  @Field({ description: 'The figure-namespace setting as written; empty when the subdomain is used.' })
-  written: string
-
-  @Field({ description: "The domain's subdomain, used when the setting is empty." })
-  subdomain: string
-
-  @Field({ description: "True once the domain's figures carry the namespace: it cannot be set any more." })
-  fixed: boolean
-}
-
-@Resolver()
+/*
+ * The namespaces a domain owns (LV figure-server design G1). Reading them is part of authoring; adding one, choosing
+ * the default and suspending one are their own gate, figure-namespace:mutation.
+ */
+@Resolver(FigureNamespace)
 @UseMiddleware(SpeakRefusals)
 export class FigureNamespaceResolver {
   @Directive('@privilege(category: "figure", privilege: "query", domainOwnerGranted: true)')
-  @Query(returns => FigureNamespace, { description: "The domain's figure namespace and whether it can still be set." })
-  async figureNamespace(@Ctx() context: ResolverContext): Promise<FigureNamespace> {
+  @Query(returns => [FigureNamespace], { description: "The domain's figure namespaces, its default first. None until it adds one or makes its first figure." })
+  async figureNamespaces(@Ctx() context: ResolverContext): Promise<FigureNamespace[]> {
     const { domain, tx } = context.state
-    return (await figureNamespaceStateOf(tx ?? getDataSource().manager, domain)) as FigureNamespace
+    return namespacesOf(tx ?? getDataSource().manager, domain)
   }
 
   @Directive('@transaction')
-  @Directive('@privilege(category: "setting", privilege: "mutation", domainOwnerGranted: true)')
+  @Directive('@privilege(category: "figure-namespace", privilege: "mutation", domainOwnerGranted: true)')
   @Mutation(returns => FigureNamespace, {
-    description: "Sets the domain's figure namespace. Empty takes the subdomain. Refused when it is not a namespace, or when the domain's figures already carry another."
+    description: 'Adds a figure namespace to the domain. Refused when it is not a namespace or another domain has it. The first is the default.'
   })
-  async setFigureNamespace(@Arg('namespace') namespace: string, @Ctx() context: ResolverContext): Promise<FigureNamespace> {
-    const { domain, tx } = context.state
-    return (await setFigureNamespace(tx, domain, namespace)) as FigureNamespace
+  async createFigureNamespace(
+    @Arg('name') name: string,
+    @Ctx() context: ResolverContext,
+    @Arg('description', { nullable: true }) description?: string,
+    @Arg('isDefault', { nullable: true, description: 'Make it the default namespace of the domain.' }) isDefault?: boolean
+  ): Promise<FigureNamespace> {
+    const { domain, user, tx } = context.state
+    return createFigureNamespace(tx, domain, user, { name, description, isDefault })
+  }
+
+  @Directive('@transaction')
+  @Directive('@privilege(category: "figure-namespace", privilege: "mutation", domainOwnerGranted: true)')
+  @Mutation(returns => FigureNamespace, { description: 'Makes one of the domain\'s active namespaces the default new figures are created under.' })
+  async setDefaultFigureNamespace(@Arg('name') name: string, @Ctx() context: ResolverContext): Promise<FigureNamespace> {
+    const { domain, user, tx } = context.state
+    return setDefaultFigureNamespace(tx, domain, user, name)
+  }
+
+  @Directive('@transaction')
+  @Directive('@privilege(category: "figure-namespace", privilege: "mutation", domainOwnerGranted: true)')
+  @Mutation(returns => FigureNamespace, {
+    description: "Suspends one of the domain's namespaces or makes it active again. A suspended namespace takes no new figure and no release; the default is not suspended."
+  })
+  async setFigureNamespaceState(@Arg('name') name: string, @Arg('state') state: string, @Ctx() context: ResolverContext): Promise<FigureNamespace> {
+    const { domain, user, tx } = context.state
+    return setFigureNamespaceState(tx, domain, user, name, state as 'active' | 'suspended')
   }
 }

package/server/service/figure/figure-namespace.ts

@@ -1,115 +1,149 @@
-import { EntityManager, IsNull, Not } from 'typeorm'
+import { EntityManager } from 'typeorm'
 
 import { isFigureNamespace } from '@hatiolab/figure-model'
 import { Domain, Refusal } from '@things-factory/shell'
-import { Setting } from '@things-factory/setting-base'
 
 import { Figure } from './figure.js'
+import { FigureNamespace } from './figure-namespace-entity.js'
 
-/** The domain setting that names the namespace this domain's figures are published under (ADR-0114). */
-export const FIGURE_NAMESPACE_SETTING = 'figure-namespace'
+/*
+ * The namespaces a domain owns (LV figure-server design G1, ADR-0114). A full name `{namespace}/{type}` points at one
+ * figure on the whole server because a namespace belongs to one domain and is unique across the server. A domain that
+ * owns none gets its subdomain as its first, default namespace when it first needs one (user, 2026-10-13: 「기본적으로는
+ * subdomain 명을 사용하면 되는데」).
+ */
+
+type Actor = { id?: string } | undefined
+
+const ORDER = { isDefault: 'DESC', name: 'ASC' } as const
+
+/** The domain's namespaces, its default first. */
+export async function namespacesOf(tx: EntityManager, domain: { id: string }): Promise<FigureNamespace[]> {
+  return tx.getRepository(FigureNamespace).find({ where: { domain: { id: domain.id } }, order: ORDER })
+}
 
 /**
- * The namespace a new figure is created under.
- *
- * It is read from the domain setting and copied onto the figure, so the full name `{namespace}/{type}` a board stores
- * never moves. A domain with no setting, or an empty one, takes its subdomain (user, 2026-10-13: 「기본적으로는
- * subdomain 명을 사용하면 되는데」) -- refused only when the subdomain is not a namespace either. A value written in
- * the setting is used as it is, and refused when it is not a namespace. Either way it is set once: a value that differs
- * from the namespace this domain's figures already carry is refused, so editing the setting cannot rename anything.
+ * The namespace a new figure is created under: the one named, when it is the domain's own and active; otherwise the
+ * domain's default, made from the subdomain when the domain owns none yet.
  */
-export async function namespaceForNewFigure(tx: EntityManager, domain: Domain): Promise<string> {
-  const namespace = await chosenNamespace(tx, domain)
-  if (!isFigureNamespace(namespace)) {
-    throw new Refusal(
-      'figure-namespace-missing',
-      { setting: FIGURE_NAMESPACE_SETTING, value: namespace },
-      'this domain has no valid figure namespace. set {setting} first, for example hatiolab.com.'
-    )
+export async function namespaceForNewFigure(tx: EntityManager, domain: Domain, chosen?: string | null, user?: Actor): Promise<string> {
+  const named = chosen?.trim()
+  if (named) {
+    return (await activeOwn(tx, domain, named)).name!
   }
-  await assertNamespaceUnchanged(tx, domain, namespace)
-  return namespace
+  const owned = await namespacesOf(tx, domain)
+  const fallback = owned.length ? owned.find(namespace => namespace.isDefault) : await firstNamespace(tx, domain, user)
+  if (!fallback) {
+    throw new Refusal('figure-namespace-missing', { domain: domain.subdomain ?? '' }, 'this domain has no default figure namespace. add one first.')
+  }
+  if (fallback.state !== 'active') {
+    throw new Refusal('figure-namespace-suspended', { namespace: fallback.name! }, 'the figure namespace {namespace} is suspended.')
+  }
+  return fallback.name!
 }
 
-/** Refuses when the domain's figures already carry another namespace than the setting now says. */
-export async function assertNamespaceUnchanged(tx: EntityManager, domain: Domain, namespace: string): Promise<void> {
-  const other = await tx.getRepository(Figure).findOne({
-    where: { domain: { id: domain.id }, namespace: Not(namespace) }
-  })
-  if (other?.namespace) {
-    throw new Refusal(
-      'figure-namespace-changed',
-      { setting: FIGURE_NAMESPACE_SETTING, value: namespace, namespace: other.namespace },
-      'the figure namespace of this domain is {namespace} and cannot change. set {setting} back to {namespace}.'
-    )
-  }
+/** A release promises boards `{namespace}/{type}`: it goes out only under a namespace the domain owns and has active. */
+export async function assertReleasableNamespace(tx: EntityManager, domain: Domain, namespace: string): Promise<void> {
+  await activeOwn(tx, domain, namespace)
 }
 
 /** The namespace a figure already carries, refused when it has none (a figure made before namespaces). */
 export function namespaceOf(figure: Figure): string {
   if (!figure.namespace) {
+    throw new Refusal('figure-namespace-missing', { domain: '' }, 'this figure has no namespace. run the figure name migration first.')
+  }
+  return figure.namespace
+}
+
+/** Adds a namespace to the domain. The domain's first is its default; `isDefault` makes another the default. */
+export async function createFigureNamespace(
+  tx: EntityManager,
+  domain: Domain,
+  user: Actor,
+  input: { name: string; description?: string | null; isDefault?: boolean | null }
+): Promise<FigureNamespace> {
+  const name = (input.name ?? '').trim()
+  if (!isFigureNamespace(name)) {
     throw new Refusal(
-      'figure-namespace-missing',
-      { setting: FIGURE_NAMESPACE_SETTING, value: '' },
-      'this figure has no namespace. run the figure name migration first.'
+      'figure-namespace-invalid',
+      { value: name },
+      '{value} is not a figure namespace. use lower-case letters, digits, dots and hyphens, for example hatiolab.com.'
     )
   }
-  return figure.namespace
+  const repository = tx.getRepository(FigureNamespace)
+  if (await repository.findOne({ where: { name } })) {
+    throw new Refusal('figure-namespace-taken', { namespace: name }, 'the figure namespace {namespace} is already taken on this server.')
+  }
+  const first = (await repository.count({ where: { domain: { id: domain.id } } })) === 0
+  const isDefault = first || !!input.isDefault
+  if (isDefault && !first) await clearDefault(tx, domain)
+  const saved = await repository.save({
+    domain,
+    name,
+    description: input.description?.trim() || null,
+    state: 'active',
+    isDefault,
+    creator: user as any,
+    updater: user as any
+  })
+  return repository.findOneOrFail({ where: { id: saved.id } })
 }
 
-/** What the setting says, or the subdomain when it says nothing: the namespace new figures are created under. */
-async function chosenNamespace(tx: EntityManager, domain: Domain): Promise<string> {
-  return (await writtenNamespace(tx, domain)) || (domain.subdomain ?? '').trim()
+/** Makes one of the domain's active namespaces its default. */
+export async function setDefaultFigureNamespace(tx: EntityManager, domain: Domain, user: Actor, name: string): Promise<FigureNamespace> {
+  const namespace = await activeOwn(tx, domain, name)
+  await clearDefault(tx, domain)
+  await tx.getRepository(FigureNamespace).update({ id: namespace.id }, { isDefault: true, updater: user as any })
+  return tx.getRepository(FigureNamespace).findOneOrFail({ where: { id: namespace.id } })
 }
 
-async function writtenNamespace(tx: EntityManager, domain: Domain): Promise<string> {
-  const setting = await tx.getRepository(Setting).findOne({
-    where: { domain: { id: domain.id }, name: FIGURE_NAMESPACE_SETTING }
-  })
-  return setting?.value?.trim() ?? ''
+/** Suspends a namespace or makes it active again. The default namespace is not suspended: make another the default first. */
+export async function setFigureNamespaceState(
+  tx: EntityManager,
+  domain: Domain,
+  user: Actor,
+  name: string,
+  state: 'active' | 'suspended'
+): Promise<FigureNamespace> {
+  if (state !== 'active' && state !== 'suspended') {
+    throw new Refusal('figure-namespace-state', { state: String(state) }, '{state} is not a namespace state. use active or suspended.')
+  }
+  const namespace = await own(tx, domain, name)
+  if (state === 'suspended' && namespace.isDefault) {
+    throw new Refusal('figure-namespace-default-suspended', { namespace: namespace.name! }, 'the default namespace {namespace} cannot be suspended. make another the default first.')
+  }
+  await tx.getRepository(FigureNamespace).update({ id: namespace.id }, { state, updater: user as any })
+  return tx.getRepository(FigureNamespace).findOneOrFail({ where: { id: namespace.id } })
 }
 
-/** A domain's figure namespace as the setting screen shows it. */
-export interface FigureNamespaceState {
-  /** What new figures get, or null when neither the setting nor the subdomain is a namespace. */
-  namespace: string | null
-  /** The setting as written; empty when the subdomain is used. */
-  written: string
-  subdomain: string
-  /** The domain's figures already carry the namespace, so it cannot be set any more. */
-  fixed: boolean
+/** One of the domain's namespaces by name; refused when the domain does not own it. */
+async function own(tx: EntityManager, domain: { id: string }, name: string): Promise<FigureNamespace> {
+  const namespace = await tx.getRepository(FigureNamespace).findOne({ where: { domain: { id: domain.id }, name } })
+  if (!namespace) {
+    throw new Refusal('figure-namespace-not-owned', { namespace: name }, 'this domain does not own the figure namespace {namespace}.')
+  }
+  return namespace
 }
 
-export async function figureNamespaceStateOf(tx: EntityManager, domain: Domain): Promise<FigureNamespaceState> {
-  const written = await writtenNamespace(tx, domain)
-  const subdomain = (domain.subdomain ?? '').trim()
-  const carried = await tx.getRepository(Figure).findOne({ where: { domain: { id: domain.id }, namespace: Not(IsNull()) } })
-  const chosen = written || subdomain
-  return {
-    namespace: carried?.namespace ?? (isFigureNamespace(chosen) ? chosen : null),
-    written,
-    subdomain,
-    fixed: !!carried?.namespace
+async function activeOwn(tx: EntityManager, domain: { id: string }, name: string): Promise<FigureNamespace> {
+  const namespace = await own(tx, domain, name)
+  if (namespace.state !== 'active') {
+    throw new Refusal('figure-namespace-suspended', { namespace: name }, 'the figure namespace {namespace} is suspended.')
   }
+  return namespace
 }
 
-/**
- * Writes the domain's figure namespace (ADR-0114). Empty takes the subdomain. Refused when the value, or the subdomain
- * it falls back to, is not a namespace, and when the domain's figures already carry another one.
- */
-export async function setFigureNamespace(tx: EntityManager, domain: Domain, value: string): Promise<FigureNamespaceState> {
-  const written = value.trim()
-  const namespace = written || (domain.subdomain ?? '').trim()
-  if (!isFigureNamespace(namespace)) {
-    throw new Refusal(
-      'figure-namespace-invalid',
-      { value: namespace },
-      '{value} is not a figure namespace. use lower-case letters, digits, dots and hyphens, for example hatiolab.com.'
-    )
+async function clearDefault(tx: EntityManager, domain: { id: string }): Promise<void> {
+  const repository = tx.getRepository(FigureNamespace)
+  for (const namespace of await repository.find({ where: { domain: { id: domain.id }, isDefault: true } })) {
+    await repository.update({ id: namespace.id }, { isDefault: false })
   }
-  await assertNamespaceUnchanged(tx, domain, namespace)
-  const repository = tx.getRepository(Setting)
-  const setting = await repository.findOne({ where: { domain: { id: domain.id }, name: FIGURE_NAMESPACE_SETTING } })
-  await repository.save({ ...setting, domain, name: FIGURE_NAMESPACE_SETTING, category: 'figure', value: written })
-  return figureNamespaceStateOf(tx, domain)
+}
+
+/** The domain's first namespace, made from its subdomain; none when the subdomain is not a namespace or is taken. */
+async function firstNamespace(tx: EntityManager, domain: Domain, user: Actor): Promise<FigureNamespace | undefined> {
+  const name = (domain.subdomain ?? '').trim()
+  if (!isFigureNamespace(name)) return undefined
+  if (await tx.getRepository(FigureNamespace).findOne({ where: { name } })) return undefined
+  return createFigureNamespace(tx, domain, user, { name })
 }

package/server/service/figure/figure-package-export.ts

@@ -17,6 +17,7 @@ import { FigureHistory } from './figure-history.js'
 import { sha256Of, thumbnailAttachmentOf, thumbnailFiles, type ThumbnailFiles } from './figure-thumbnail-store.js'
 import { meshAttachmentOf } from './figure-mesh-store.js'
 import { GLB_MIMETYPE } from './figure-glb.js'
+import { publicFigureOfName } from './figure-public.js'
 
 /** The most releases one package carries. */
 export const FIGURE_PACKAGE_MAX = 200
@@ -92,9 +93,11 @@ export async function figurePackageOf(request: FigurePackageRequest): Promise<{
 }
 
 async function releaseOf(ref: FigureRef, domain: FigurePackageRequest['domain']): Promise<{ figure: Figure; history: FigureHistory }> {
-  const figure = await getRepository(Figure).findOne({
-    where: { domain: { id: In([domain.id, domain.parentId].filter(Boolean)) }, type: ref.type, namespace: ref.namespace }
-  })
+  /* Its own or its parent's, or another domain's public figure (G2): a package is made of what this domain may read. */
+  const figure =
+    (await getRepository(Figure).findOne({
+      where: { domain: { id: In([domain.id, domain.parentId].filter(Boolean)) }, type: ref.type, namespace: ref.namespace }
+    })) ?? (await publicFigureOfName(ref.namespace, ref.type))
   const history = figure
     ? await getRepository(FigureHistory).findOne({ where: { originalId: figure.id, state: 'released', version: ref.version } })
     : null

package/server/service/figure/figure-proposal-db.test.ts

@@ -11,6 +11,7 @@ const authBase = require('@things-factory/auth-base')
 const settingBase = require('@things-factory/setting-base')
 const { createFigureAsset, addFigureBox, serializeFigureAsset } = require('@hatiolab/figure-model')
 
+let FigureNamespace: any
 let dataSource: DataSource | null = null
 let Figure: any
 let FigureHistory: any
@@ -29,6 +30,7 @@ function loadCompiled(modulePath: string): any {
 
 beforeAll(async () => {
   Figure = loadCompiled('service/figure/figure').Figure
+  FigureNamespace = loadCompiled('service/figure/figure-namespace-entity').FigureNamespace
   FigureHistory = loadCompiled('service/figure/figure-history').FigureHistory
   FigureProposalRecord = loadCompiled('service/figure/figure-proposal-record').FigureProposalRecord
   FigureMutation = loadCompiled('service/figure/figure-mutation').FigureMutation
@@ -39,7 +41,7 @@ beforeAll(async () => {
     synchronize: true,
     dropSchema: true,
     namingStrategy: new shell.NamingStrategy(),
-    entities: [...shell.entities, ...authBase.entities, ...settingBase.entities, Figure, FigureHistory, FigureProposalRecord],
+    entities: [...shell.entities, ...authBase.entities, ...settingBase.entities, Figure, FigureHistory, FigureProposalRecord, FigureNamespace],
     logging: false
   })
   await dataSource.initialize()
@@ -50,9 +52,9 @@ afterAll(async () => {
   dataSource = null
 })
 
-/** The domain setting every figure here is created under (ADR-0114). */
+/** The domain's own default namespace, its subdomain, that every figure here is created and released under (G1). */
 async function namespaced(domain: any) {
-  await dataSource!.getRepository(settingBase.Setting).save({ domain, name: 'figure-namespace', category: 'figure', value: 'system' })
+  await dataSource!.getRepository(FigureNamespace).save({ domain, name: domain.subdomain, state: 'active', isDefault: true })
   return domain
 }
 

package/server/service/figure/figure-public-db.test.ts

@@ -0,0 +1,180 @@
+/**
+ * Public figures (LV figure-server design G2), on sqlite: a domain makes a released figure public, and every other
+ * domain then reads its releases, draws it by full name, puts it in a package and is given its files -- never its
+ * draft, never a write. Only released figures are made public, and only by their own domain.
+ */
+import type { DataSource } from 'typeorm'
+
+const { DataSource: TypeOrmDataSource } = require('typeorm')
+const { createHash } = require('crypto')
+const JSZip = require('jszip')
+const shell = require('@things-factory/shell')
+const authBase = require('@things-factory/auth-base')
+const settingBase = require('@things-factory/setting-base')
+const attachmentBase = require('@things-factory/attachment-base')
+const { createFigureAsset, addFigureBox, serializeFigureAsset, applyFigureAuthoring, proposeFigureOccupancy, readFigurePackage } = require('@hatiolab/figure-model')
+
+let dataSource: DataSource | null = null
+let Figure: any
+let FigureHistory: any
+let FigureNamespace: any
+let FigureMutation: any
+let FigureQuery: any
+let figurePackageOf: any
+let publicDomainsOfFile: any
+let readableFigure: any
+
+function loadCompiled(modulePath: string): any {
+  const { existsSync } = require('fs')
+  const { join } = require('path')
+  const resolved = join(__dirname, '..', '..', '..', 'dist-server', `${modulePath}.js`)
+  if (!existsSync(resolved))
+    throw new Error(`figure-service 산출물이 없다: ${resolved}\n먼저 빌드할 것:\n  yarn workspace @things-factory/figure-service build:server`)
+  return require(resolved)
+}
+
+beforeAll(async () => {
+  Figure = loadCompiled('service/figure/figure').Figure
+  FigureHistory = loadCompiled('service/figure/figure-history').FigureHistory
+  FigureNamespace = loadCompiled('service/figure/figure-namespace-entity').FigureNamespace
+  const Subscriber = loadCompiled('service/figure/event-subscriber').FigureHistoryEntitySubscriber
+  ;({ FigureMutation } = loadCompiled('service/figure/figure-mutation'))
+  ;({ FigureQuery } = loadCompiled('service/figure/figure-query'))
+  ;({ figurePackageOf } = loadCompiled('service/figure/figure-package-export'))
+  ;({ publicDomainsOfFile, readableFigure } = loadCompiled('service/figure/figure-public'))
+  dataSource = new TypeOrmDataSource({
+    type: 'sqlite',
+    database: ':memory:',
+    synchronize: true,
+    dropSchema: true,
+    namingStrategy: new shell.NamingStrategy(),
+    entities: [...shell.entities, ...authBase.entities, ...settingBase.entities, ...attachmentBase.entities, Figure, FigureHistory, FigureNamespace],
+    subscribers: [Subscriber],
+    logging: false
+  })
+  await dataSource.initialize()
+  shell.addDataSource('default', dataSource)
+  shell.addDataSource('tx', dataSource)
+})
+
+afterAll(async () => {
+  await dataSource?.destroy()
+  dataSource = null
+})
+
+const releasable = (label = 'Mixer') => {
+  let a = addFigureBox(createFigureAsset(label), { id: 'body', size: { x: 100, y: 100, z: 100 }, position: { x: 0, y: 50, z: 0 } })
+  a = applyFigureAuthoring(a, { kind: 'attach', part: 'body', face: 'bottom', to: { plane: 'mounting-plane' } })
+  return serializeFigureAsset(applyFigureAuthoring(a, { kind: 'declare-occupancy', proposal: proposeFigureOccupancy(a, { over: 'range' }), placement: 'floor' }))
+}
+
+let seq = 0
+async function domain() {
+  const name = `pub-${++seq}`
+  const saved = await dataSource!.getRepository(shell.Domain).save({ name, subdomain: name })
+  await dataSource!.getRepository(FigureNamespace).save({ domain: saved, name, state: 'active', isDefault: true })
+  return { domain: saved, context: { state: { domain: saved, user: undefined, tx: dataSource!.manager } }, namespace: name }
+}
+async function released(owner: any, type: string) {
+  const figure = await new FigureMutation().saveFigure(releasable(type), owner.context, undefined, undefined, require('crypto').randomUUID(), undefined, type)
+  await new FigureMutation().releaseFigure(figure.id, 'first', owner.context)
+  return figure
+}
+const noFiles = { put: async () => ({}), send: async () => {}, read: async () => Buffer.alloc(0) }
+const sha256 = (bytes: Uint8Array) => createHash('sha256').update(bytes).digest('hex')
+
+describe('making a figure public', () => {
+  it('only a released figure, only by its own domain; it can be made private again', async () => {
+    const owner = await domain()
+    const reader = await domain()
+    const draft = await new FigureMutation().saveFigure(releasable(), owner.context, undefined, undefined, require('crypto').randomUUID(), undefined, 'sketch')
+    await expect(new FigureMutation().setFigurePublic(draft.id, true, owner.context)).rejects.toMatchObject({ code: 'figure-public-unreleased' })
+    const figure = await released(owner, 'mixer')
+    await expect(new FigureMutation().setFigurePublic(figure.id, true, reader.context)).rejects.toThrow(/찾을 수 없다/)
+    expect((await new FigureMutation().setFigurePublic(figure.id, true, owner.context)).public).toBe(true)
+    expect((await new FigureMutation().setFigurePublic(figure.id, false, owner.context)).public).toBe(false)
+    expect(await dataSource!.getRepository(FigureHistory).count({ where: { originalId: figure.id } })).toBe(1)
+  })
+
+  it('asks figure-release:mutation, as releasing does', () => {
+    const { readFileSync } = require('fs')
+    const { join } = require('path')
+    const source = readFileSync(join(__dirname, 'figure-mutation.ts'), 'utf-8')
+    const preceding = source.slice(0, source.indexOf('async setFigurePublic('))
+    expect(preceding.slice(preceding.lastIndexOf("@Directive('@privilege("))).toContain('category: "figure-release", privilege: "mutation"')
+  })
+})
+
+describe('what another domain reads of a public figure', () => {
+  it('its releases, by id and by full name, once it is public -- never its draft', async () => {
+    const owner = await domain()
+    const reader = await domain()
+    const figure = await released(owner, 'conveyor')
+    const name = `${owner.namespace}/conveyor`
+    const query = new FigureQuery()
+
+    expect(await query.figureReleased(figure.id, reader.context)).toBeNull()
+    expect(await query.figureVersions(figure.id, reader.context)).toEqual([])
+    expect((await query.figureBlueprints([name], reader.context)).refused.map((r: any) => r.code)).toEqual(['figure-not-released'])
+
+    await new FigureMutation().setFigurePublic(figure.id, true, owner.context)
+    expect((await query.figureReleased(figure.id, reader.context))?.version).toBe(1)
+    expect((await query.figureVersions(figure.id, reader.context)).map((v: any) => v.version)).toEqual([1])
+    const answer = await query.figureBlueprints([name], reader.context)
+    expect(answer.items.map((i: any) => [i.type, i.ref])).toEqual([[name, `${name}@1`]])
+    expect(await query.figure(figure.id, reader.context)).toBeNull()
+  })
+
+  it('lists other domains\' public figures with their domain; not its own, not a private one', async () => {
+    const owner = await domain()
+    const reader = await domain()
+    const shown = await released(owner, 'lifter')
+    await released(owner, 'kept-private')
+    const own = await released(reader, 'own-public')
+    await new FigureMutation().setFigurePublic(shown.id, true, owner.context)
+    await new FigureMutation().setFigurePublic(own.id, true, reader.context)
+    const { items } = await new FigureQuery().publicFigures({ filters: [{ name: 'type', operator: 'in', value: ['lifter', 'kept-private', 'own-public'] }] }, reader.context)
+    expect(items.map((f: any) => [f.type, f.domain?.id])).toEqual([['lifter', owner.domain.id]])
+  })
+
+  it('puts its releases in a package', async () => {
+    const owner = await domain()
+    const reader = await domain()
+    const figure = await released(owner, 'shuttle')
+    const ref = `${owner.namespace}/shuttle@1`
+    const ask = () => figurePackageOf({ refs: [ref], domain: reader.domain, exportedBy: null, sourceUrl: 'x', files: noFiles })
+    await expect(ask()).rejects.toMatchObject({ code: 'figure-package-release-not-found' })
+    await new FigureMutation().setFigurePublic(figure.id, true, owner.context)
+    const zip = await JSZip.loadAsync((await ask()).bytes)
+    const files = new Map<string, Uint8Array>()
+    for (const path of Object.keys(zip.files)) if (!zip.files[path].dir) files.set(path, await zip.files[path].async('uint8array'))
+    expect(readFigurePackage(files, sha256).releases.map((r: any) => r.ref)).toEqual([ref])
+  })
+
+  it('is given its picture and the files its releases draw from, from the domain that keeps them', async () => {
+    const owner = await domain()
+    const reader = await domain()
+    const figure = await released(owner, 'crane')
+    const hash = 'a'.repeat(64)
+    await dataSource!.getRepository(FigureHistory).update({ originalId: figure.id }, { source: `{"mesh":"sha256-${hash}"}` })
+    expect(await readableFigure(reader.domain, figure.id)).toBeNull()
+    expect(await publicDomainsOfFile(hash, reader.domain)).toEqual([])
+    await new FigureMutation().setFigurePublic(figure.id, true, owner.context)
+    expect((await readableFigure(reader.domain, figure.id))?.id).toBe(figure.id)
+    expect(await publicDomainsOfFile(hash, reader.domain)).toEqual([owner.domain.id])
+    expect(await publicDomainsOfFile('b'.repeat(64), reader.domain)).toEqual([])
+    /* Its own domain does not reach for its own files this way: it keeps them. */
+    expect(await publicDomainsOfFile(hash, owner.domain)).toEqual([])
+  })
+
+  it('no write reaches it from another domain', async () => {
+    const owner = await domain()
+    const reader = await domain()
+    const figure = await released(owner, 'robot')
+    await new FigureMutation().setFigurePublic(figure.id, true, owner.context)
+    await expect(new FigureMutation().updateFigure(figure.id, { description: 'theirs' }, reader.context)).rejects.toThrow(/찾을 수 없다/)
+    await expect(new FigureMutation().setFigureDeprecation(figure.id, true, reader.context)).rejects.toThrow(/찾을 수 없다/)
+    await expect(new FigureMutation().deleteFigure(figure.id, reader.context)).resolves.toBe(true)
+    expect(await dataSource!.getRepository(Figure).findOne({ where: { id: figure.id } })).not.toBeNull()
+  })
+})

package/server/service/figure/figure-public.ts

@@ -0,0 +1,60 @@
+import { In, Like, Not } from 'typeorm'
+
+import { getRepository } from '@things-factory/shell'
+
+import { Figure } from './figure.js'
+import { FigureHistory } from './figure-history.js'
+
+/*
+ * Public figures (LV figure-server design G2): a figure its domain made public is read by every domain -- its releases,
+ * its picture, the files its releases draw from -- and drawn by its full name {namespace}/{type}, which points at one
+ * figure on the server because a namespace belongs to one domain (G1). Its draft stays its domain's. Writing it stays
+ * its domain's (G3). Each reader asks its own domain and its parent first; a public figure is the last place looked.
+ */
+
+type Reader = { id: string; parentId?: string | null }
+
+/** The domains a reader reads as its own: itself and its parent. */
+export const ownScope = (domain: Reader) => In([domain.id, domain.parentId].filter(Boolean) as string[])
+
+/** A figure the reader may read the releases of: its own or its parent's, or any domain's public one. */
+export async function readableFigure(domain: Reader, id: string, select?: Record<string, unknown>): Promise<Figure | null> {
+  return getRepository(Figure).findOne({
+    where: [
+      { domain: { id: ownScope(domain) }, id },
+      { public: true, id }
+    ],
+    relations: { domain: true },
+    ...(select ? { select } : {})
+  })
+}
+
+/** Whether the figure is another domain's public one: the reader sees its releases, never its draft. */
+export function foreignPublic(domain: Reader, figure: Figure): boolean {
+  const owner = figure.domain?.id ?? figure.domainId
+  return !!figure.public && owner !== domain.id && owner !== domain.parentId
+}
+
+/** The public figure of a full name, in whatever domain owns its namespace. */
+export async function publicFigureOfName(namespace: string, type: string): Promise<Figure | null> {
+  return getRepository(Figure).findOne({ where: { namespace, type, public: true }, relations: { domain: true } })
+}
+
+/**
+ * The domains whose kept file this is, among the public figures whose releases draw from it -- the places a reader may
+ * be given that file from beyond its own domain and its parent.
+ */
+export async function publicDomainsOfFile(hash: string, reader: Reader): Promise<string[]> {
+  const figures = await getRepository(Figure).find({
+    where: { public: true, domain: { id: Not(ownScope(reader)) } },
+    relations: { domain: true },
+    select: { id: true, domain: { id: true } }
+  })
+  if (!figures.length) return []
+  const histories = await getRepository(FigureHistory).find({
+    where: { originalId: In(figures.map(figure => figure.id)), state: 'released', source: Like(`%${hash}%`) },
+    select: { originalId: true }
+  })
+  const drawing = new Set(histories.map(history => history.originalId))
+  return [...new Set(figures.filter(figure => drawing.has(figure.id)).map(figure => figure.domain!.id))]
+}