@aotter/mantle-runtime 0.0.11-alpha.11

package/dist/domain/port/Clock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Clock.js","sourceRoot":"","sources":["../../../src/domain/port/Clock.ts"],"names":[],"mappings":"AAYA,MAAM,CAAC,MAAM,WAAW,GAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC"}

package/dist/domain/port/DatabaseDriver.d.ts

@@ -0,0 +1,91 @@
+/**
+ * `DatabaseDriver` — runtime's adapter-agnostic interface to
+ * persistent relational state. The canonical tables (`entries`,
+ * `revisions`, `approvals`, `users`, `staff`, `sessions`,
+ * `site_config`) live behind this
+ * surface; the runtime never sees `D1Database`, `Pool` (postgres),
+ * or any concrete driver.
+ *
+ * The shape is intentionally close to D1's API (which is itself close
+ * to the SQLite C API) — that's the smallest common denominator
+ * across the adapters we expect to ship. Adapters wrap their native
+ * driver to this shape:
+ *
+ *   - `mantle-cloudflare` wraps `env.DB` (D1) directly (1:1 surface).
+ *   - A future Postgres adapter wraps `pg` to the same shape.
+ *   - The test harness ships an in-memory impl in `test/fakes/`.
+ *
+ * See ADR-0011 § DatabaseDriver for the rationale (and the alternatives
+ * — mega-port, function-injection, plugin packages — that were
+ * rejected). Renamed from `DatabasePort` per the clean-architecture
+ * naming convention (no `Port` suffix; ports are discoverable by
+ * package alone).
+ */
+export interface DatabaseDriver {
+    /** Build a parameterised statement. Bind values then execute. */
+    prepare(sql: string): PreparedStatement;
+    /** Execute multiple statements atomically. Adapters guarantee
+     *  all-or-nothing semantics — a child-row delete + parent delete
+     *  can't half-land. */
+    batch(stmts: ReadonlyArray<PreparedStatement>): Promise<readonly BatchResult[]>;
+    /** Migration runner — the runtime's `bootInit` invokes
+     *  `migrations.runAll()` once per isolate. Adapters supply the
+     *  storage; the runtime supplies the canonical migration list. */
+    readonly migrations: MigrationRunner;
+}
+/**
+ * Parameterised statement. Adapters return their native prepared-
+ * statement object cast to this shape, so `bind` reuses native binding
+ * and `first` / `all` / `run` map to the driver's typed accessors.
+ */
+export interface PreparedStatement {
+    /** Bind parameters in `?` order. Returns a new statement; original
+     *  is unchanged so a single prepared shape can be reused with
+     *  different bindings. */
+    bind(...params: ReadonlyArray<unknown>): PreparedStatement;
+    /** Run and return the first row, typed by `T`. `null` when empty. */
+    first<T = Record<string, unknown>>(): Promise<T | null>;
+    /** Run and return all rows. */
+    all<T = Record<string, unknown>>(): Promise<readonly T[]>;
+    /** Run and return only rowcount-style metadata. Use `first` / `all`
+     *  for selects; this is for INSERT/UPDATE/DELETE that don't RETURNING. */
+    run(): Promise<RunResult>;
+}
+export interface RunResult {
+    readonly success: boolean;
+    readonly meta: {
+        readonly changes: number;
+        readonly lastRowId?: number | string;
+    };
+}
+export interface BatchResult {
+    readonly success: boolean;
+    readonly meta: {
+        readonly changes: number;
+    };
+    readonly results?: readonly Record<string, unknown>[];
+}
+/**
+ * Migration runner contract. The adapter implements this against its
+ * driver; the runtime calls `runAll(migrations)` once per isolate at
+ * boot. Migration order is the array index — runtime supplies the
+ * canonical list (see `infrastructure/boot/canonicalMigrations.ts`);
+ * adapter just executes.
+ *
+ * The runner records applied migrations in a `_migrations` table so
+ * subsequent boots are idempotent.
+ */
+export interface MigrationRunner {
+    runAll(migrations: ReadonlyArray<Migration>): Promise<void>;
+}
+export interface Migration {
+    /** Stable ordinal — never reused, never renamed. Adapter records
+     *  this in `_migrations` for idempotency. */
+    readonly id: string;
+    /** Free-form description for boot logs. */
+    readonly description: string;
+    /** SQL DDL / DML to apply. Adapters split on `;` if their driver
+     *  doesn't accept multi-statement scripts. */
+    readonly sql: string;
+}
+//# sourceMappingURL=DatabaseDriver.d.ts.map

package/dist/domain/port/DatabaseDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DatabaseDriver.d.ts","sourceRoot":"","sources":["../../../src/domain/port/DatabaseDriver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAAC;IACxC;;2BAEuB;IACvB,KAAK,CAAC,KAAK,EAAE,aAAa,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;IAChF;;sEAEkE;IAClE,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC;;8BAE0B;IAC1B,IAAI,CAAC,GAAG,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,iBAAiB,CAAC;IAC3D,qEAAqE;IACrE,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACxD,+BAA+B;IAC/B,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC1D;8EAC0E;IAC1E,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;KACtC,CAAC;CACH;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;CACvD;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,SAAS;IACxB;iDAC6C;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,2CAA2C;IAC3C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;kDAC8C;IAC9C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB"}

package/dist/domain/port/DatabaseDriver.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=DatabaseDriver.js.map

package/dist/domain/port/DatabaseDriver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DatabaseDriver.js","sourceRoot":"","sources":["../../../src/domain/port/DatabaseDriver.ts"],"names":[],"mappings":""}

package/dist/domain/port/DeferredHookDispatcher.d.ts

@@ -0,0 +1,55 @@
+import type { LifecycleHook, StaffRole } from "@aotter/mantle-spec";
+import type { EntryRow } from "../model/EntryRow.js";
+import type { HandlerContext } from "../model/HandlerContext.js";
+/**
+ * Optional adapter port for delivering `after_*` lifecycle hooks
+ * out-of-band — later, in a separate invocation, with durability
+ * across isolate death. The adapter's consume-side handler rehydrates
+ * the envelope and drives `CmsRuntime.runDeferredHook`. Absent a
+ * dispatcher, the decorator's `fireAfter` ladder downgrades to
+ * `ctx.waitUntil` then inline-await.
+ *
+ * Contract: a thrown rejection from `enqueue` is treated as a hard
+ * delivery failure — the decorator catches it and downgrades to the
+ * next rung. Adapters should swallow transient errors they can
+ * tolerate themselves; only escalate when the hook genuinely cannot
+ * be deferred.
+ */
+export interface DeferredHookDispatcher {
+    enqueue(envelope: DeferredHookEnvelope): Promise<void>;
+}
+/**
+ * Wire envelope for a deferred `after_*` lifecycle hook. Carries
+ * everything the consume side needs to reconstruct the original
+ * `RunLifecycleHookRequest` without re-reading the database.
+ *
+ * `entry` is the row at fire time — for `after_delete` the row is
+ * already gone from the DB, so the envelope must carry it. For other
+ * `after_*` hooks the row also matches what the in-process firing path
+ * would have seen, avoiding read-skew with subsequent mutations.
+ *
+ * `ctxSnapshot` carries enough identity to rebuild a `HandlerContext`
+ * with the original actor's user/staff fields. `waitUntil` is dropped —
+ * the consume invocation owns its own request lifetime — and `env` is
+ * filled from the consume-side adapter binding.
+ */
+export interface DeferredHookEnvelope {
+    readonly hook: LifecycleHook;
+    readonly schema: string;
+    readonly entry: EntryRow;
+    readonly originalInput?: unknown;
+    readonly ctxSnapshot: CtxSnapshot | null;
+}
+export interface CtxSnapshot {
+    readonly userId: string | null;
+    readonly staffId: string | null;
+    readonly staffRole: StaffRole | null;
+}
+/**
+ * Capture identity from a `HandlerContext` into the wire-friendly
+ * `CtxSnapshot`. Returns `null` for fully anonymous contexts so the
+ * envelope stays small. Lives next to `CtxSnapshot` so the producer
+ * (decorator) and consumer (use case) share one source of truth.
+ */
+export declare function ctxSnapshotFrom(ctx: HandlerContext): CtxSnapshot | null;
+//# sourceMappingURL=DeferredHookDispatcher.d.ts.map

package/dist/domain/port/DeferredHookDispatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeferredHookDispatcher.d.ts","sourceRoot":"","sources":["../../../src/domain/port/DeferredHookDispatcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;CAC1C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,WAAW,GAAG,IAAI,CAOvE"}

package/dist/domain/port/DeferredHookDispatcher.js

@@ -0,0 +1,16 @@
+/**
+ * Capture identity from a `HandlerContext` into the wire-friendly
+ * `CtxSnapshot`. Returns `null` for fully anonymous contexts so the
+ * envelope stays small. Lives next to `CtxSnapshot` so the producer
+ * (decorator) and consumer (use case) share one source of truth.
+ */
+export function ctxSnapshotFrom(ctx) {
+    if (!ctx.user && !ctx.staff)
+        return null;
+    return {
+        userId: ctx.user?.id ?? null,
+        staffId: ctx.staff?.id ?? null,
+        staffRole: ctx.staff?.role ?? null,
+    };
+}
+//# sourceMappingURL=DeferredHookDispatcher.js.map

package/dist/domain/port/DeferredHookDispatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeferredHookDispatcher.js","sourceRoot":"","sources":["../../../src/domain/port/DeferredHookDispatcher.ts"],"names":[],"mappings":"AAmDA;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAmB;IACjD,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI;QAC5B,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,IAAI;QAC9B,SAAS,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,IAAI,IAAI;KACnC,CAAC;AACJ,CAAC"}

package/dist/domain/port/EmailSender.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Optional transactional-email sender port. Lives in runtime/domain/port
+ * so the contract stays adapter-portable (Resend / Postmark / SendGrid /
+ * SMTP all implement this one interface). Not required for v0.1.0 boot —
+ * features opt in (Better Auth email-OTP / magic-link, receipts, etc.).
+ *
+ * The SDK does not own body templates. `locale` (BCP 47) is the contract:
+ * the sender decides how to branch (template lookup, i18next, single
+ * language). For Better Auth flows the adapter resolves locale from the
+ * request's `Accept-Language`, falling back to the site's canonical locale.
+ *
+ * `category` lets a sender split into per-template lanes without re-parsing
+ * the subject — e.g. `"auth.email-otp.sign-in"` vs
+ * `"auth.email-otp.email-verification"`.
+ */
+export interface EmailSender {
+    send(args: EmailSendArgs): Promise<void>;
+}
+export interface EmailSendArgs {
+    readonly to: string;
+    readonly subject: string;
+    /** Plain-text body — always required so non-HTML clients work. */
+    readonly text: string;
+    /** Optional HTML body. */
+    readonly html?: string;
+    /** BCP 47 locale the recipient is expected to read. */
+    readonly locale: string;
+    /** Optional categorization for templating / deliverability segmentation. */
+    readonly category?: string;
+}
+//# sourceMappingURL=EmailSender.d.ts.map

package/dist/domain/port/EmailSender.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailSender.d.ts","sourceRoot":"","sources":["../../../src/domain/port/EmailSender.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0BAA0B;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B"}

package/dist/domain/port/EmailSender.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=EmailSender.js.map

package/dist/domain/port/EmailSender.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailSender.js","sourceRoot":"","sources":["../../../src/domain/port/EmailSender.ts"],"names":[],"mappings":""}

package/dist/domain/port/EntryRepository.d.ts

@@ -0,0 +1,132 @@
+import type { ContentState } from "@aotter/mantle-spec";
+import type { EntryRow } from "../model/EntryRow.js";
+import type { HandlerContext } from "../model/HandlerContext.js";
+/**
+ * `EntryRepository` — chokepoint for every entry mutation. Content-op
+ * use cases, MCP handlers, and builtin Procedure handlers all route
+ * writes through this interface so OCC, status guards, and lifecycle
+ * hooks have exactly one place to enforce them.
+ *
+ * Concrete impls: `DatabaseDriver`-backed
+ * (`infrastructure/persistence/DatabaseEntryRepository`) +
+ * `LifecycleHookingEntryRepository` decorator that wraps it. Test
+ * harness ships an in-memory fake in `test/fakes/`.
+ *
+ * Renamed from `EntryStore` per the clean-architecture naming
+ * convention (`*Repository` for data access).
+ */
+export interface EntryRepository {
+    create(args: CreateEntryArgs): Promise<EntryRow>;
+    get(id: string): Promise<EntryRow | null>;
+    /** Throws `EntryVersionConflict` on OCC mismatch. */
+    update(args: UpdateEntryArgs): Promise<EntryRow>;
+    /** Cascades to revisions + approvals child rows for the entry id. */
+    delete(args: DeleteEntryArgs): Promise<{
+        readonly removed: boolean;
+    }>;
+    /** Throws `EntryVersionConflict` on OCC mismatch. */
+    archive(args: ArchiveEntryArgs): Promise<EntryRow>;
+    /** Status flip without data update. `expectedStatus`, when set,
+     *  atomically asserts pre-flip status to prevent races (e.g. a
+     *  concurrent publish while we try to archive). Bumps version.
+     *  Throws `EntryStatusConflict` on guard mismatch. */
+    transitionStatus(args: TransitionStatusArgs): Promise<EntryRow>;
+    /** List entries in a collection, optionally filtered by status.
+     *  Pass `cursor` from a previous `ListEntriesResult.nextCursor` to
+     *  fetch the next page. Pagination matters because D1 silently
+     *  truncates responses past ~10 MB; without it, large collections
+     *  return partial pages indistinguishable from "no more rows". */
+    list(args: ListEntriesArgs): Promise<ListEntriesResult>;
+    /** Find one entry by a top-level JSON data field. Used for runtime
+     *  referential checks such as `Schema.spec.translates`. */
+    findByDataField(args: FindEntryByDataFieldArgs): Promise<EntryRow | null>;
+    /** Find one entry by a composite set of top-level JSON data fields.
+     *  Used to enforce `Schema.spec.uniqueIndexes` at the shared
+     *  authoring chokepoint. */
+    findByDataFields(args: FindEntryByDataFieldsArgs): Promise<EntryRow | null>;
+}
+/**
+ * Hook-related fields shared by every mutating chokepoint args type.
+ * The persistence-layer impl ignores these; the
+ * `LifecycleHookingEntryRepository` decorator reads them to fire
+ * before_/after_ Triggers with the right ctx + original input.
+ *
+ * `hookContext` defaults to an anonymous `HandlerContext` in the
+ * decorator when callers don't supply one (test paths, internal
+ * boot-time writes).
+ *
+ * `collection` is required on every mutation other than `create` so
+ * the decorator can short-circuit hook firing on no-hook Schemas
+ * without paying an extra `inner.get(id)` round-trip just to learn
+ * the row's collection. Callers always know the collection at write
+ * time (use cases hold the schema; MCP carries it in the request).
+ */
+export interface MutationHookFields {
+    readonly hookContext?: HandlerContext;
+    readonly originalInput?: unknown;
+}
+export interface CreateEntryArgs extends MutationHookFields {
+    readonly id: string;
+    readonly collection: string;
+    readonly status: ContentState;
+    readonly data: Record<string, unknown>;
+    readonly authorId: string | null;
+    readonly now: number;
+}
+export interface UpdateEntryArgs extends MutationHookFields {
+    readonly id: string;
+    readonly collection: string;
+    readonly expectedVersion: number;
+    readonly data: Record<string, unknown>;
+    readonly now: number;
+}
+export interface DeleteEntryArgs extends MutationHookFields {
+    readonly id: string;
+    readonly collection: string;
+}
+export interface ArchiveEntryArgs extends MutationHookFields {
+    readonly id: string;
+    readonly collection: string;
+    readonly expectedVersion: number;
+    readonly now: number;
+}
+export interface TransitionStatusArgs extends MutationHookFields {
+    readonly id: string;
+    readonly collection: string;
+    readonly to: ContentState;
+    readonly expectedStatus?: ContentState;
+    /** OCC guard. Impls must add `AND version = ?` and throw
+     *  `EntryVersionConflict` on miss, so a concurrent UpdateDraft
+     *  between caller-side validation and the flip cannot publish
+     *  stale data. */
+    readonly expectedVersion?: number;
+    readonly now: number;
+}
+export interface ListEntriesArgs {
+    readonly collection: string;
+    readonly status?: ContentState;
+    readonly limit?: number;
+    /** Opaque continuation token from a prior `ListEntriesResult.nextCursor`.
+     *  Caller must round-trip without interpreting; format is impl-defined. */
+    readonly cursor?: string;
+}
+export interface ListEntriesResult {
+    readonly rows: readonly EntryRow[];
+    /** Present when there may be more rows beyond this page. Undefined
+     *  signals "this is the last page". Pass back as `cursor` to
+     *  continue. */
+    readonly nextCursor?: string;
+}
+export interface FindEntryByDataFieldArgs {
+    readonly collection: string;
+    readonly status?: ContentState;
+    readonly field: string;
+    readonly value: unknown;
+}
+export interface FindEntryByDataFieldsArgs {
+    readonly collection: string;
+    readonly status?: ContentState;
+    readonly fields: Readonly<Record<string, unknown>>;
+    readonly excludeId?: string;
+}
+//# sourceMappingURL=EntryRepository.d.ts.map

package/dist/domain/port/EntryRepository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EntryRepository.d.ts","sourceRoot":"","sources":["../../../src/domain/port/EntryRepository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC1C,qDAAqD;IACrD,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,qEAAqE;IACrE,MAAM,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACtE,qDAAqD;IACrD,OAAO,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnD;;;0DAGsD;IACtD,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE;;;;sEAIkE;IAClE,IAAI,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxD;+DAC2D;IAC3D,eAAe,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC1E;;gCAE4B;IAC5B,gBAAgB,CAAC,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;CAC7E;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC;IACtC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;IACzD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;IACzD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAgB,SAAQ,kBAAkB;IACzD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAiB,SAAQ,kBAAkB;IAC1D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,YAAY,CAAC;IACvC;;;sBAGkB;IAClB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;+EAC2E;IAC3E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,SAAS,QAAQ,EAAE,CAAC;IACnC;;oBAEgB;IAChB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B"}

package/dist/domain/port/EntryRepository.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=EntryRepository.js.map

package/dist/domain/port/EntryRepository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EntryRepository.js","sourceRoot":"","sources":["../../../src/domain/port/EntryRepository.ts"],"names":[],"mappings":""}

package/dist/domain/port/HandlerRegistry.d.ts

@@ -0,0 +1,38 @@
+import type { AnyHandler, HandlerFn } from "../model/HandlerContext.js";
+/**
+ * Handler registry keyed by `Procedure.handler.ref`. Consumers call
+ * `register` at boot — typically via the `handlers` option of
+ * `createCmsRuntime` — and the dispatcher resolves per request via
+ * `get`.
+ *
+ * The registry is a usecase-level port: use cases (specifically
+ * `InvokeProcedureUseCase`) depend on it; the consumer's
+ * `clam.config.ts` populates it. Lives here in `domain/port/` (not
+ * `usecase/port/`) because the implementation IS the port — there's
+ * no separate adapter for it.
+ *
+ * Boot-time fail-fast (Loop 3 of the SDK authoring contract,
+ * ADR-0007) verifies every Procedure's `handler.ref` resolves to a
+ * registered function before the runtime accepts traffic.
+ */
+export interface HandlerRegistry {
+    register<I, O>(ref: string, fn: HandlerFn<I, O>): void;
+    get(ref: string): AnyHandler | undefined;
+    has(ref: string): boolean;
+    /** Snapshot of registered refs — used by the boot validator to
+     *  enumerate `candidates` on `HANDLER_NOT_REGISTERED` diagnostics. */
+    list(): readonly string[];
+}
+export declare class InMemoryHandlerRegistry implements HandlerRegistry {
+    private readonly map;
+    register<I, O>(ref: string, fn: HandlerFn<I, O>): void;
+    get(ref: string): AnyHandler | undefined;
+    has(ref: string): boolean;
+    list(): readonly string[];
+}
+/**
+ * Convenience factory: build a registry from a record of handlers.
+ * Equivalent to calling `register()` for each entry.
+ */
+export declare function buildHandlerRegistry(handlers: Readonly<Record<string, AnyHandler>>): HandlerRegistry;
+//# sourceMappingURL=HandlerRegistry.d.ts.map

package/dist/domain/port/HandlerRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HandlerRegistry.d.ts","sourceRoot":"","sources":["../../../src/domain/port/HandlerRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,SAAS,EACV,MAAM,4BAA4B,CAAC;AAEpC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IACvD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IACzC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B;0EACsE;IACtE,IAAI,IAAI,SAAS,MAAM,EAAE,CAAC;CAC3B;AAED,qBAAa,uBAAwB,YAAW,eAAe;IAC7D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAiC;IAErD,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI;IAItD,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIxC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAIzB,IAAI,IAAI,SAAS,MAAM,EAAE;CAG1B;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,GAC7C,eAAe,CAMjB"}

package/dist/domain/port/HandlerRegistry.js

@@ -0,0 +1,27 @@
+export class InMemoryHandlerRegistry {
+    map = new Map();
+    register(ref, fn) {
+        this.map.set(ref, fn);
+    }
+    get(ref) {
+        return this.map.get(ref);
+    }
+    has(ref) {
+        return this.map.has(ref);
+    }
+    list() {
+        return [...this.map.keys()];
+    }
+}
+/**
+ * Convenience factory: build a registry from a record of handlers.
+ * Equivalent to calling `register()` for each entry.
+ */
+export function buildHandlerRegistry(handlers) {
+    const r = new InMemoryHandlerRegistry();
+    for (const [ref, fn] of Object.entries(handlers)) {
+        r.register(ref, fn);
+    }
+    return r;
+}
+//# sourceMappingURL=HandlerRegistry.js.map

package/dist/domain/port/HandlerRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HandlerRegistry.js","sourceRoot":"","sources":["../../../src/domain/port/HandlerRegistry.ts"],"names":[],"mappings":"AA8BA,MAAM,OAAO,uBAAuB;IACjB,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAC;IAErD,QAAQ,CAAO,GAAW,EAAE,EAAmB;QAC7C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAgB,CAAC,CAAC;IACtC,CAAC;IAED,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAA8C;IAE9C,MAAM,CAAC,GAAG,IAAI,uBAAuB,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/domain/port/IdGenerator.d.ts

@@ -0,0 +1,28 @@
+/**
+ * `IdGenerator` — abstracted id source for new entries / revisions /
+ * approvals / sessions / media bearer tokens / R2 object keys.
+ *
+ * # Security invariant
+ *
+ * **Production injections MUST be cryptographically random** (CSPRNG-
+ * backed, ≥122 bits of entropy). Several call sites use the result as
+ * a bearer-token-equivalent — for example, `R2MediaStorage` returns
+ * the generated `uploadId` to the client and accepts it back on
+ * commit; an attacker who can guess pending `uploadId`s can commit
+ * someone else's upload. `R2MediaStorage` also derives R2 object keys
+ * from this generator, so a predictable id leaks pre-commit storage
+ * key locations.
+ *
+ * The default `RandomUuidGenerator` (UUID v4 via Web Crypto) satisfies
+ * this. Counter-based / sortable / "debuggable" alternatives MUST be
+ * confined to test code — never wired into a `createCmsRuntime` /
+ * adapter ctor at runtime.
+ */
+export interface IdGenerator {
+    next(): string;
+}
+/** Default production id source. UUID v4, ~122 bits CSPRNG entropy
+ *  via the Workers / Node Web Crypto API. Safe for bearer tokens,
+ *  R2 object keys, and primary keys. */
+export declare const RandomUuidGenerator: IdGenerator;
+//# sourceMappingURL=IdGenerator.d.ts.map

package/dist/domain/port/IdGenerator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdGenerator.d.ts","sourceRoot":"","sources":["../../../src/domain/port/IdGenerator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,WAAW;IAC1B,IAAI,IAAI,MAAM,CAAC;CAChB;AAED;;wCAEwC;AACxC,eAAO,MAAM,mBAAmB,EAAE,WAAiD,CAAC"}

package/dist/domain/port/IdGenerator.js

@@ -0,0 +1,5 @@
+/** Default production id source. UUID v4, ~122 bits CSPRNG entropy
+ *  via the Workers / Node Web Crypto API. Safe for bearer tokens,
+ *  R2 object keys, and primary keys. */
+export const RandomUuidGenerator = { next: () => crypto.randomUUID() };
+//# sourceMappingURL=IdGenerator.js.map

package/dist/domain/port/IdGenerator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdGenerator.js","sourceRoot":"","sources":["../../../src/domain/port/IdGenerator.ts"],"names":[],"mappings":"AAwBA;;wCAEwC;AACxC,MAAM,CAAC,MAAM,mBAAmB,GAAgB,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC"}

package/dist/domain/port/KvCache.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `KvCache` — read-mostly cache for the publish pipeline. The runtime
+ * stores pre-rendered HTML, per-locale `.md` mirrors, and `llms.txt`
+ * here. Reads are on the public-content hot path; writes happen only
+ * during publish / unpublish.
+ *
+ * CF adapter: Workers KV. Future: Redis, FS, S3-compatible store.
+ *
+ * Distinct from `DatabaseDriver` — KV is eventually-consistent across
+ * regions (Workers KV) and tuned for high-fanout reads. The canonical
+ * source of truth for entries lives in the DB; KV is a derivative
+ * cache that the publish pipeline writes through.
+ *
+ * Renamed from `KvPort` per the clean-architecture naming convention.
+ */
+export interface KvCache {
+    get(key: string): Promise<string | null>;
+    put(key: string, value: string, opts?: KvPutOptions): Promise<void>;
+    delete(key: string): Promise<void>;
+    /** List keys with a prefix. Used by sitemap / `llms.txt` aggregation
+     *  + cache invalidation paths. Cursor is opaque; consumers loop
+     *  until cursor is `null`. */
+    list(prefix: string, cursor?: string | null): Promise<KvListResult>;
+}
+export interface KvPutOptions {
+    /** Seconds until the entry expires. Adapters that don't support
+     *  TTL silently ignore. */
+    readonly expirationTtl?: number;
+}
+export interface KvListResult {
+    readonly keys: readonly string[];
+    readonly cursor: string | null;
+}
+//# sourceMappingURL=KvCache.d.ts.map

package/dist/domain/port/KvCache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KvCache.d.ts","sourceRoot":"","sources":["../../../src/domain/port/KvCache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,OAAO;IACtB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC;;kCAE8B;IAC9B,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,YAAY;IAC3B;+BAC2B;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC"}

package/dist/domain/port/KvCache.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=KvCache.js.map

package/dist/domain/port/KvCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"KvCache.js","sourceRoot":"","sources":["../../../src/domain/port/KvCache.ts"],"names":[],"mappings":""}

package/dist/domain/port/LifecycleHookRunner.d.ts

@@ -0,0 +1,41 @@
+import type { LifecycleHook } from "@aotter/mantle-spec";
+import type { EntryRow } from "../model/EntryRow.js";
+import type { HandlerContext } from "../model/HandlerContext.js";
+/**
+ * Fires every Trigger bound to (schema, hook) in alphabetical name
+ * order (POC ADR-0014). Implemented by `usecase/lifecycle/
+ * RunLifecycleHooksUseCase`; consumed by the entry-writer decorator
+ * (`infrastructure/persistence/LifecycleHookingEntryRepository`).
+ *
+ * Honors per-Trigger `errorPolicy`:
+ *   - `abort` (only allowed on before_*): handler throw → `run` throws
+ *     a DiagnosticError so the surrounding mutation cancels.
+ *   - `continue`: handler throw is logged via `console.error` and
+ *     swallowed. (POC v0.1.x parity; observability table is v0.2.)
+ *
+ * The runner itself awaits every Trigger inline. The decorator decides
+ * whether to ride on `ctx.waitUntil` (CF Workers fast-path) or
+ * inline-await the result; it's not the runner's concern.
+ *
+ * Lives in `domain/port/` per Aotter clean-arch convention; the
+ * implementing use case lives in `usecase/lifecycle/` and is wired at
+ * the assembly root.
+ */
+export interface LifecycleHookRunner {
+    run(request: RunLifecycleHookRequest): Promise<void>;
+}
+export interface RunLifecycleHookRequest {
+    readonly hook: LifecycleHook;
+    readonly schema: string;
+    /** Pre-mutation row for `before_*` hooks; persisted post-mutation
+     *  row for `after_*`. `null` only on `before_create` (no row exists
+     *  yet). */
+    readonly entry: EntryRow | null;
+    readonly ctx: HandlerContext;
+    /** Pre-projection original input. For builtin Procedure path this is
+     *  the procedure's full input (incl. side-channel fields like a
+     *  CAPTCHA token); for non-builtin paths (admin / MCP createDraft)
+     *  it's typically the raw write payload. May be undefined. */
+    readonly originalInput?: unknown;
+}
+//# sourceMappingURL=LifecycleHookRunner.d.ts.map

package/dist/domain/port/LifecycleHookRunner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LifecycleHookRunner.d.ts","sourceRoot":"","sources":["../../../src/domain/port/LifecycleHookRunner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,mBAAmB;IAClC,GAAG,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;gBAEY;IACZ,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;IAC7B;;;kEAG8D;IAC9D,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC"}

package/dist/domain/port/LifecycleHookRunner.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=LifecycleHookRunner.js.map

package/dist/domain/port/LifecycleHookRunner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LifecycleHookRunner.js","sourceRoot":"","sources":["../../../src/domain/port/LifecycleHookRunner.ts"],"names":[],"mappings":""}