A share can now be published in 'approved' mode: public readers by URL see
the last manually-saved version (page_history.kind='manual') instead of the
live draft. The content swap lives in the single canonical resolver
resolveReadableSharePage, so EVERY public read path is frozen consistently —
the shared-page view, the SEO controller, AND the share assistant's page-read
tool (owner decision: a visitor and the assistant see the same bytes). Swaps
only content+title; page.id/workspaceId stay LIVE so attachment tokens keep
minting for the right owner. MVP residue kept live: the assistant's page
LIST/TREE tools and transclusions.
- migration 20260712T130000: shares.published_mode varchar(20) NOT NULL
DEFAULT 'live' (additive, standalone; existing shares stay live)
- db.d.ts: publishedMode on Shares (Share/Insertable/Updatable derive)
- page-history.repo: findLatestByPageIdAndKind(pageId, kind, {includeContent})
- share.repo: thread publishedMode through baseFields/insert/update
- share.service.getShareForPage: 4-point CTE threading (anchor + union +
returned object + repo allowlist) — type-guarded, so dropping any point
fails the build/tests
- createShare/updateShare: accept publishedMode; reject approved+includeSubPages
(BadRequestException); auto-mint the first manual baseline ON ENABLE
- share.dto: publishedMode @IsOptional @IsIn(['live','approved'])
- client: "Publish only the saved version" toggle (XOR with sub-pages),
version caption + "unsaved changes newer than the published version" hint;
share types/api carry publishedMode
- tests: resolve-swap (content+title swapped, id+workspaceId preserved),
assistant getSharePage sees frozen content, getShareForPage threading
(direct + descendant), baseline auto-create, XOR reject, migration up/down
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
agent_coder
fbac8e6976