feat(content): hide sets via manifest visibility flag, drop hidden-sets.ts (#1707)

[astrapi69]

Description

Final step of the #1707 chain: replace the app-side hidden-sets.ts blocklist (the #1702 interim) with the declarative visibility flag now carried by learn-content-engine 0.14.0's manifest set entry and by the content search index.

The chain is fully unblocked: engine#83 → PR engine#84 shipped the additive visibility field (0.14.0), and adaptive-learner-content-test marks the graded-quiz demo fixture visibility: hidden.

What changed

• Re-pin learn-content-engine 0.13.3 → 0.14.0 (exact pin, enforced by engine-pin.test.ts == schema/engine-version.txt; the task said ^0.14.0 but the repo hard-requires an exact pin). Ran make sync-schema: the mirrored content-manifest.schema.json and the generated manifest_generated.py gain the additive optional visibility enum (absent ⇒ visible). Kept sync-schema-check + engine-parity-check green.
• Discover (search-index-loader.ts): normalizeSet drops visibility: "hidden" entries at parse time, so they never enter the catalogue, its facets/counts or the cache. queryDiscoverSets keeps a render-time visibility guard (the original two-layer design).
• Meine Inhalte (useContentSetsData.ts): filters visibility === "hidden". The manifest value flows through the engine's asContentSetEntry, so a downloaded/imported hidden set is filtered too.
• API mode (content-loader plugin SetEntryResponse): carries visibility so both storage modes filter identically (also stops extra="forbid" from 400-ing a manifest that now carries visibility).
• Deleted hidden-sets.ts + its test. Absent visibility is treated as visible everywhere.

Closes #1707. Refs #1702, #1706, astrapi69/learn-content-engine#83, astrapi69/learn-content-engine#84.

Type of Change

• Refactoring (mechanism swap; the hidden fixture stays hidden, now via repo-owned metadata instead of an app-side hardcoded list)
• Plugin addition or update (content-loader: additive visibility passthrough)

Testing

• make test passes locally — the full suite needs the full backend env; I ran the changed-surface gates instead (below). Please run make test + the Dexie-mode gate on CI.
• Frontend tsc --noEmit: clean.
• Vitest (changed + related): search-index-loader / discover-index / useContentSetsData / engine-pin (59) + src/storage + src/lib/content + src/hooks/content (1623) + src/pages/content + src/components/content (325) — all green.
• ESLint on changed files: clean.
• Backend content-loader: test_models_set_manifest.py (52, incl. new visibility cases) + test_service.py (32, incl. new SetEntryResponse visibility cases) — green.
• Schema gates: sync_schema_mirror_from_engine.py --check, generate_pydantic_models.py --check, check_engine_schema_parity.py (vs the 0.14.0 npm tarball) — all green.
• Manual device check (pending) — the Follow-up (#1702): replace the hidden-sets.ts blocklist with a manifest visibility flag (needs engine schema change) #1707 "Geräteverifikation": in a build connected to adaptive-learner-content-test, confirm the graded-quiz-demo-from-de set stays hidden in Content-Browser / Discover / Dashboard (now via visibility: hidden) and all other sets stay visible. Not runnable in this container.

Documentation

• No user-facing docs change — this is an internal mechanism swap with identical observable behaviour.
• No API-shape change beyond an additive optional field (auto-reflected in /docs).

Plugin Impact

• Affects the content-loader plugin. The change is additive/backward-compatible (optional visibility passthrough), so per the repo's plugin-versioning policy the plugin version is intentionally not bumped. Backend model/response + tests updated.

Checklist

• Self-review done
• Code commented in the non-obvious areas (why parse-drop keeps facets clean; absent ⇒ visible)
• No new warnings/errors (tsc + eslint + ruff on my lines clean; the ruff "would reformat" hunks are pre-existing version drift on untouched code)
• CHANGELOG — not updated (internal refactor, no user-facing behaviour change)
• Agree to the Code of Conduct

Notes for the reviewer

• TESTPLAN-PFLICHT: exempt — this is an internal mechanism swap with no new user path (the fixture stays hidden exactly as before), so the manual test plan is unchanged.
• The two-layer Discover design is preserved on purpose: parse-drop (keeps facets/cache clean, required because Discover.tsx computes facets over the full allSets) + a render-time guard.
• Offline edge: rowToCachedEntry (manifest-unreachable fallback) has no visibility column on the Dexie row, so an offline, previously-downloaded hidden fixture defaults to visible. Avoided a Dexie schema bump for this rare case; the live-manifest path (the normal case) filters it correctly.

🤖 Generated with Claude Code

---

Generated by Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​learn-content-engine@​0.13.3 ⏵ 0.14.0	+1		+1	+1

View full report

[astrapi69]

CI status after the first run:

Fixed (pushed c23ccd6): Plugin Tests failed because the new SetEntryResponse visibility test lived in the plugin suite, which runs each plugin in isolation without the backend app package on the path (routes.py imports app.exceptions → ModuleNotFoundError: No module named 'app'). Moved it to backend/tests/test_content_loader_routes.py as an end-to-end passthrough (a visibility: hidden manifest surfaces the flag on /sets; absent ⇒ visible). Plugin suite verified green locally (30 passed, no app import).

Pre-existing base-branch failure (not this PR): Backend Tests is red on test_check_dead_classnames_unstyled::test_real_repo_unstyled_set_matches_committed_baseline — stale baseline entries aui-composer*, aui-thread*, aui-message*, form-hint-inline. This PR's diff touches none of those files; .unstyled-classnames-baseline is byte-identical between this branch and origin/develop (107 lines). develop merged #1985 (.form-hint CSS refactor) + the assistant-ui phases (aui-*), which styled those classes without ratcheting the unstyled baseline down — so develop itself is red on this test, and this PR inherits it through the CI merge. It will clear once develop's baseline is updated and merged in; nothing to fix in this branch's concern (#1707).

All other checks green (Frontend Tests, Backend ruff + mypy, pre-commit, docs-drift, complexity gate, security).

---

Generated by Claude Code