@fuzdev/fuz_app 0.102.0 → 0.103.0

package/dist/auth/cell_actions.js

@@ -44,7 +44,7 @@ import { jsonrpc_errors, dev_only } from '../http/jsonrpc_errors.js';
 import { is_pg_unique_violation } from '../db/pg_error.js';
 import { has_role } from './request_context.js';
 import { ROLE_ADMIN } from './role_schema.js';
-import { cell_create_action_spec, cell_get_action_spec, cell_update_action_spec, cell_delete_action_spec, cell_list_action_spec, cell_clone_action_spec, ERROR_CELL_NOT_FOUND, ERROR_CELL_PATH_ADMIN_ONLY, ERROR_CELL_PATH_TAKEN, ERROR_CELL_VISIBILITY_MANAGE_ONLY, ERROR_CELL_GET_REQUIRES_ID_OR_PATH, ERROR_CELL_CLONE_KIND_MISMATCH, ERROR_CELL_LIST_CREATED_BY_REQUIRES_AUTH, ERROR_CELL_LIST_SHARED_WITH_REQUIRES_AUTH, CELL_LIST_LIMIT_DEFAULT, CELL_RELATIONS_BUNDLE_LIMIT, } from './cell_action_specs.js';
+import { cell_create_action_spec, cell_get_action_spec, cell_update_action_spec, cell_delete_action_spec, cell_list_action_spec, cell_clone_action_spec, ERROR_CELL_NOT_FOUND, ERROR_CELL_PATH_ADMIN_ONLY, ERROR_CELL_PATH_TAKEN, ERROR_CELL_VISIBILITY_MANAGE_ONLY, ERROR_CELL_GET_REQUIRES_ID_OR_PATH, ERROR_CELL_KIND_IN_DATA, ERROR_CELL_KIND_EMPTY, ERROR_CELL_LIST_CREATED_BY_REQUIRES_AUTH, ERROR_CELL_LIST_SHARED_WITH_REQUIRES_AUTH, CELL_LIST_LIMIT_DEFAULT, CELL_RELATIONS_BUNDLE_LIMIT, } from './cell_action_specs.js';
 import { query_cell_create, query_cell_get, query_cell_get_by_path, query_cell_update, query_cell_delete, query_cell_list, query_cell_load_many, } from '../db/cell_queries.js';
 import { query_cell_grant_list_for_cell, query_cell_grants_for_caller_in_cells, } from '../db/cell_grant_queries.js';
 import { query_cell_field_list_for_source, query_cell_field_set } from '../db/cell_field_queries.js';
@@ -66,10 +66,25 @@ const to_iso_nullable = (value) => {
  * write is unambiguously a path collision.
  */
 const path_taken_error = () => jsonrpc_errors.conflict('cell.path is already taken', { reason: ERROR_CELL_PATH_TAKEN });
+/**
+ * Reject a `kind` key supplied inside `data`. `kind` is the top-level
+ * `cell.kind` column (write-once capability axis), so a copy inside the
+ * loose `data` blob would be a second source of truth that silently
+ * diverges on update. Fail-loud `invalid_params` at every wire-`data`
+ * boundary (create / update / clone-patch).
+ */
+const reject_kind_in_data = (data) => {
+    if (Object.hasOwn(data, 'kind')) {
+        throw jsonrpc_errors.invalid_params('cell.data must not contain `kind` (it is a top-level field)', {
+            reason: ERROR_CELL_KIND_IN_DATA,
+        });
+    }
+};
 export const to_cell_json = (row) => ({
     id: row.id,
     path: row.path,
     data: row.data,
+    kind: row.kind,
     visibility: row.visibility,
     refs: row.refs,
     created_by: row.created_by,
@@ -92,14 +107,14 @@ const emit_cell_audit = (ctx, event_type, row, deps, auth) => {
         ip: ctx.client_ip,
         metadata: {
             cell_id: row.id,
-            kind: row.data.kind,
+            kind: row.kind ?? undefined,
             path: row.path,
         },
     });
 };
 /** Create the six generic cell RPC actions. */
 export const create_cell_actions = (deps) => {
-    const { validate_data } = deps;
+    const { validate_data, authorize_create } = deps;
     /**
      * Run the optional `validate_data` deps callback and convert any thrown
      * `ZodError` into the standard `invalid_params` JSON-RPC error so per-
@@ -129,9 +144,28 @@ export const create_cell_actions = (deps) => {
                 reason: ERROR_CELL_PATH_ADMIN_ONLY,
             });
         }
+        // `kind` is the top-level column — reject a stray copy inside `data`,
+        // and reject an empty `kind` (a tag tags nothing — `null` is the typeless
+        // state), so `kind` stays a clean `null | non-empty-string`. Both run
+        // after the path-admin gate so an unauthorized caller sees that first.
+        reject_kind_in_data(input.data);
+        if (input.kind === '') {
+            throw jsonrpc_errors.invalid_params('cell.kind must not be empty (use null for a typeless cell)', { reason: ERROR_CELL_KIND_EMPTY });
+        }
         // Per-kind shape validation (sub-API). Unknown kinds pass through;
         // known kinds with malformed payloads surface as invalid_params.
         const validated_data = validate_data_or_throw(input.data);
+        const kind = input.kind ?? null;
+        // Creation authorizer (opt-in): may this actor create this kind? Runs
+        // after shape validation, before the insert. Deny → 404 IDOR mask (the
+        // established cell-layer deny shape — a gated kind is indistinguishable
+        // from a missing resource). Receives the **raw** `input.data` (not the
+        // `validate_data`-normalized value) to match the Rust twin, so a
+        // consumer with a transforming validator can't diverge TS↔Rust.
+        if (authorize_create &&
+            !(await authorize_create(auth, { kind, data: input.data, scope_id: null }))) {
+            throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
+        }
         let row;
         try {
             row = await query_cell_create(ctx, {
@@ -141,6 +175,7 @@ export const create_cell_actions = (deps) => {
                 // extend `Json`. The DB column is JSONB; the cast trusts the
                 // schema-validated runtime shape.
                 data: validated_data,
+                kind,
                 visibility: input.visibility,
                 path: input.path ?? null,
                 created_by: auth.actor.id,
@@ -254,7 +289,11 @@ export const create_cell_actions = (deps) => {
         // Per-kind shape validation when `data` is supplied. Patch-only —
         // we don't validate the existing row's data on update (validation
         // is for incoming patches). `data` writes fully replace, so the
-        // patch IS the post-update state.
+        // patch IS the post-update state. A stray `kind` inside it is rejected
+        // (kind is the write-once top-level column — `cell_update` cannot
+        // change it, structurally: it is not even a field on `CellUpdateInput`).
+        if (input.data !== undefined)
+            reject_kind_in_data(input.data);
         const validated_data = input.data !== undefined ? validate_data_or_throw(input.data) : undefined;
         let updated;
         try {
@@ -312,23 +351,13 @@ export const create_cell_actions = (deps) => {
      * server-stamped provenance fields.
      */
     const clone_one_cell_row = async (ctx, source, auth, options) => {
+        // A patch is wire-supplied `data` — reject a stray `kind` (kind is the
+        // immutable top-level column; the clone inherits `source.kind`).
+        if (options.patch_data !== undefined)
+            reject_kind_in_data(options.patch_data);
         // Both `source.data` and `options.patch_data` are CellData (loose
         // objects). Patch-last shallow merge composes cleanly.
         const merged_data = options.patch_data !== undefined ? { ...source.data, ...options.patch_data } : source.data;
-        // Block cross-kind patches before per-kind shape validation: a
-        // kind-A → kind-B patch can pass `validate_data` coincidentally
-        // (loose shapes accept overlapping fields) and produce an
-        // incoherent result. Reject when the merged kind diverges from the
-        // source's kind. Both undefined or equal kinds pass through;
-        // one-sided undefined is permissive (caller patching unrelated
-        // fields on a typeless source).
-        if (source.data.kind !== undefined &&
-            merged_data.kind !== undefined &&
-            source.data.kind !== merged_data.kind) {
-            throw jsonrpc_errors.invalid_params('cell_clone cannot change kind via with_data_patch', {
-                reason: ERROR_CELL_CLONE_KIND_MISMATCH,
-            });
-        }
         // Per-kind shape validation runs on the merged result (sub-API).
         // Source rows are validated on their original create; the patch
         // could violate the kind shape (e.g., remove a required field).
@@ -336,6 +365,9 @@ export const create_cell_actions = (deps) => {
         return query_cell_create(ctx, {
             // Boundary cast (see `create_handler`).
             data: validated_data,
+            // Clone inherits the source's kind verbatim — kind is fixed at
+            // birth and a `with_data_patch` can't reach the column.
+            kind: source.kind,
             visibility: source.visibility,
             path: null, // admin-only paths cannot auto-clone
             created_by: auth.actor.id,
@@ -463,7 +495,7 @@ export const create_cell_actions = (deps) => {
         // — emit directly rather than threading it through `emit_cell_audit`.
         // `kind` is read from `source.data` (not the cloned row) so the
         // audit trail attributes the clone to the source's shape.
-        const source_kind = source.data.kind;
+        const source_kind = source.kind ?? undefined;
         const cloned_child_count = deep ? cloneable_items.length : 0;
         deps.audit.emit(ctx, {
             event_type: 'cell_clone',
@@ -505,7 +537,7 @@ export const create_cell_actions = (deps) => {
         const caller_actor_id = auth?.actor?.id ?? null;
         const rows = await query_cell_list(ctx, {
             ids: input.ids,
-            data_kind: input.data_kind,
+            kind: input.kind,
             visibility: input.visibility,
             ref: input.ref,
             created_by: input.created_by,

package/dist/auth/cell_data_schema.d.ts

@@ -11,17 +11,19 @@
  * `auth/cell_actions.ts`.
  *
  * **Discipline**: a field joins `CellData` only when at least two
- * consumers in different domains read it generically. `kind` (editor
- * dispatch + sub-API registry), `label` (list/index rendering), and
- * `summary` (card subtitle + share-target description) meet this bar.
- * Future candidates require evidence of generic usage — otherwise they
- * stay per-kind.
+ * consumers in different domains read it generically. `label` (list/index
+ * rendering) and `summary` (card subtitle + share-target description) meet
+ * this bar. Future candidates require evidence of generic usage — otherwise
+ * they stay per-kind.
  *
- * **Visibility is not in here.** Access control is a peer of `cell_grant`,
- * not content metadata — `cell.visibility` lives as a top-level column on
- * `CellJson` and `CellRow` (the `CellVisibility` enum is defined in
- * `auth/cell_action_specs.ts` next to the wire fields that use it), and is
- * enforced by `can_view_cell` reading the column directly (no JSON dive).
+ * **`kind` is not in here, and is rejected if present.** Like `visibility`,
+ * a cell's `kind` is a top-level column (`cell.kind` on `CellJson` /
+ * `CellRow`), not content metadata — it is the capability / identity axis a
+ * creation authorizer gates on, write-once at birth. A stray `kind` key
+ * inside `data` is a fail-loud `ERROR_CELL_KIND_IN_DATA` at the create /
+ * update / clone-patch boundary (single source of truth). Access control
+ * (`cell.visibility`) is likewise a peer column, enforced by `can_view_cell`
+ * reading the column directly (no JSON dive).
  *
  * @module
  */
@@ -29,14 +31,10 @@ import { z } from 'zod';
 /**
  * Base cell-data shape. All fields optional; loose mode admits arbitrary
  * additional keys so apps can attach metadata or stage new kinds without
- * touching the wire schema.
- *
- * `kind` is optional because cells without a registered kind are valid —
- * admin-curated content, in-development types, or unknown shapes pass
- * through. Known kinds get richer validation via the per-kind sub-API.
+ * touching the wire schema. `kind` lives on the top-level `cell.kind`
+ * column, not here (see the module doc).
  */
 export declare const CellData: z.ZodObject<{
-    kind: z.ZodOptional<z.ZodString>;
     label: z.ZodOptional<z.ZodString>;
     summary: z.ZodOptional<z.ZodString>;
 }, z.core.$loose>;

package/dist/auth/cell_data_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_data_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_data_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ;;;;iBAInB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC"}
+{"version":3,"file":"cell_data_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_data_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB;;;;;GAKG;AACH,eAAO,MAAM,QAAQ;;;iBAGnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC"}

package/dist/auth/cell_data_schema.js

@@ -11,17 +11,19 @@
  * `auth/cell_actions.ts`.
  *
  * **Discipline**: a field joins `CellData` only when at least two
- * consumers in different domains read it generically. `kind` (editor
- * dispatch + sub-API registry), `label` (list/index rendering), and
- * `summary` (card subtitle + share-target description) meet this bar.
- * Future candidates require evidence of generic usage — otherwise they
- * stay per-kind.
+ * consumers in different domains read it generically. `label` (list/index
+ * rendering) and `summary` (card subtitle + share-target description) meet
+ * this bar. Future candidates require evidence of generic usage — otherwise
+ * they stay per-kind.
  *
- * **Visibility is not in here.** Access control is a peer of `cell_grant`,
- * not content metadata — `cell.visibility` lives as a top-level column on
- * `CellJson` and `CellRow` (the `CellVisibility` enum is defined in
- * `auth/cell_action_specs.ts` next to the wire fields that use it), and is
- * enforced by `can_view_cell` reading the column directly (no JSON dive).
+ * **`kind` is not in here, and is rejected if present.** Like `visibility`,
+ * a cell's `kind` is a top-level column (`cell.kind` on `CellJson` /
+ * `CellRow`), not content metadata — it is the capability / identity axis a
+ * creation authorizer gates on, write-once at birth. A stray `kind` key
+ * inside `data` is a fail-loud `ERROR_CELL_KIND_IN_DATA` at the create /
+ * update / clone-patch boundary (single source of truth). Access control
+ * (`cell.visibility`) is likewise a peer column, enforced by `can_view_cell`
+ * reading the column directly (no JSON dive).
  *
  * @module
  */
@@ -29,14 +31,10 @@ import { z } from 'zod';
 /**
  * Base cell-data shape. All fields optional; loose mode admits arbitrary
  * additional keys so apps can attach metadata or stage new kinds without
- * touching the wire schema.
- *
- * `kind` is optional because cells without a registered kind are valid —
- * admin-curated content, in-development types, or unknown shapes pass
- * through. Known kinds get richer validation via the per-kind sub-API.
+ * touching the wire schema. `kind` lives on the top-level `cell.kind`
+ * column, not here (see the module doc).
  */
 export const CellData = z.looseObject({
-    kind: z.string().optional(),
     label: z.string().optional(),
     summary: z.string().optional(),
 });

package/dist/db/CLAUDE.md

@@ -51,16 +51,19 @@ The wire schemas + RPC handlers + authz predicates for this layer live in
   tables; single-migration `CELL_MIGRATION_NS` (namespace `fuz_cell`).
   `cell.visibility cell_visibility NOT NULL DEFAULT 'private'` (PG ENUM
   `('private', 'public')`) — a top-level access-control column, peer to
-  `cell_grant`, not a `data` field. Nullable `created_by` / `updated_by`
-  FKs to `actor` (NULL = system origin). GIN on `data` / `refs`; global
-  partial-unique on `path`.
+  `cell_grant`, not a `data` field. `cell.kind text` (nullable) is the
+  write-once capability/identity axis — likewise a top-level column, not a
+  `data` field (`idx_cell_kind` partial-active). Nullable `created_by` /
+  `updated_by` FKs to `actor` (NULL = system origin). GIN on `data` / `refs`;
+  global partial-unique on `path`.
 - **`cell_history_ddl.ts`** — dormant `cell_history` table
   (`CELL_HISTORY_MIGRATION_NS`, namespace `fuz_cell_history`), FK → `cell.id`.
   Ships present-but-unwritten; no snapshot lifecycle yet.
 - **`cell_queries.ts`** — `query_cell_create / get / get_by_path / update /
-delete`, `_list_by_data_kind / _list_by_creator`, the
+delete`, `_list_by_kind / _list_by_creator`, the
   generic `query_cell_list` (filter + SQL-side visibility predicate mirroring
-  `can_view_cell`; the `ref` filter narrows by `cell.refs`), and
+  `can_view_cell`; the `kind` filter narrows by the `cell.kind` column, the
+  `ref` filter by `cell.refs`), and
   `query_cell_load_many` (bulk id load, no visibility filter — feeds the
   strict relation-read filter). `cell.refs` derived from
   `data` via `extract_refs` on create/update. `CellRow.grant_count` is a

package/dist/db/cell_ddl.d.ts

@@ -62,8 +62,15 @@ export declare const CELL_VISIBILITY_TYPE = "\nDO $$ BEGIN\n\tCREATE TYPE cell_v
  *
  * `path` is the global namespace axis (no tenant/hub scoping) — globally
  * unique on active rows via `idx_cell_path_unique`.
+ *
+ * `kind` is the capability / identity axis — a nullable top-level column
+ * (peer to `visibility` / `path`), **not** a field inside `data`. It is the
+ * discriminator a creation authorizer gates on (see `auth/cell_actions.ts`
+ * `CellCreateAuthorize`) and is **write-once**: set at INSERT and carried on
+ * no update path, so a cell's kind is fixed at birth. Content stays
+ * duck-typed in `data`; `kind` is a capability tag, not a content-type.
  */
-export declare const CELL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS cell (\n\tid UUID PRIMARY KEY DEFAULT gen_random_uuid(),\n\tdata JSONB NOT NULL,\n\tvisibility cell_visibility NOT NULL DEFAULT 'private',\n\tpath TEXT,\n\trefs TEXT[],\n\tcreated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n\tupdated_at TIMESTAMPTZ,\n\tdeleted_at TIMESTAMPTZ,\n\tcreated_by UUID REFERENCES actor(id) ON DELETE SET NULL,\n\tupdated_by UUID REFERENCES actor(id) ON DELETE SET NULL\n)";
+export declare const CELL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS cell (\n\tid UUID PRIMARY KEY DEFAULT gen_random_uuid(),\n\tdata JSONB NOT NULL,\n\tkind TEXT,\n\tvisibility cell_visibility NOT NULL DEFAULT 'private',\n\tpath TEXT,\n\trefs TEXT[],\n\tcreated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n\tupdated_at TIMESTAMPTZ,\n\tdeleted_at TIMESTAMPTZ,\n\tcreated_by UUID REFERENCES actor(id) ON DELETE SET NULL,\n\tupdated_by UUID REFERENCES actor(id) ON DELETE SET NULL\n)";
 /**
  * Cell indexes — all active-only, partial on `deleted_at IS NULL`.
  *
@@ -71,7 +78,9 @@ export declare const CELL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS cell (\n\tid UU
  * - `idx_cell_path_unique`: global `path` uniqueness + read-side path
  *   lookup. Partial on path + active so reused paths after soft delete are
  *   allowed.
- * - `idx_cell_data`: shape-driven queries (`data ? 'kind'`, `data @> ...`).
+ * - `idx_cell_kind`: the `cell_list` kind filter (`cell.kind = ?`) and
+ *   kind-scoped scans. Active-only.
+ * - `idx_cell_data`: shape-driven queries (`data @> ...`).
  * - `idx_cell_refs`: cells-by-fact discovery (cross-cell reference graph).
  * - `idx_cell_created_by`: "cells this actor created" queries.
  *

package/dist/db/cell_ddl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_ddl.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_ddl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAGH,OAAO,KAAK,EAAC,SAAS,EAAE,kBAAkB,EAAC,MAAM,cAAc,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,oIAI1B,CAAC;AAER;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,WAAW,4aAYtB,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,MAAM,CAYtC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,0iBAc5B,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAW5C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,+RAO5B,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAE5C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,qSAO3B,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAG3C,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,4DAA6D,CAAC;AAE3F,uBAAuB;AACvB,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CAuB5C,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}
+{"version":3,"file":"cell_ddl.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_ddl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAGH,OAAO,KAAK,EAAC,SAAS,EAAE,kBAAkB,EAAC,MAAM,cAAc,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,oIAI1B,CAAC;AAER;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,WAAW,0bAatB,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,MAAM,CActC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,0iBAc5B,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAW5C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,+RAO5B,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAE5C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,qSAO3B,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAG3C,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,4DAA6D,CAAC;AAE3F,uBAAuB;AACvB,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CAuB5C,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}

package/dist/db/cell_ddl.js

@@ -65,11 +65,19 @@ END $$`;
  *
  * `path` is the global namespace axis (no tenant/hub scoping) — globally
  * unique on active rows via `idx_cell_path_unique`.
+ *
+ * `kind` is the capability / identity axis — a nullable top-level column
+ * (peer to `visibility` / `path`), **not** a field inside `data`. It is the
+ * discriminator a creation authorizer gates on (see `auth/cell_actions.ts`
+ * `CellCreateAuthorize`) and is **write-once**: set at INSERT and carried on
+ * no update path, so a cell's kind is fixed at birth. Content stays
+ * duck-typed in `data`; `kind` is a capability tag, not a content-type.
  */
 export const CELL_SCHEMA = `
 CREATE TABLE IF NOT EXISTS cell (
 	id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
 	data JSONB NOT NULL,
+	kind TEXT,
 	visibility cell_visibility NOT NULL DEFAULT 'private',
 	path TEXT,
 	refs TEXT[],
@@ -86,7 +94,9 @@ CREATE TABLE IF NOT EXISTS cell (
  * - `idx_cell_path_unique`: global `path` uniqueness + read-side path
  *   lookup. Partial on path + active so reused paths after soft delete are
  *   allowed.
- * - `idx_cell_data`: shape-driven queries (`data ? 'kind'`, `data @> ...`).
+ * - `idx_cell_kind`: the `cell_list` kind filter (`cell.kind = ?`) and
+ *   kind-scoped scans. Active-only.
+ * - `idx_cell_data`: shape-driven queries (`data @> ...`).
  * - `idx_cell_refs`: cells-by-fact discovery (cross-cell reference graph).
  * - `idx_cell_created_by`: "cells this actor created" queries.
  *
@@ -99,6 +109,8 @@ export const CELL_INDEXES = [
     `CREATE UNIQUE INDEX IF NOT EXISTS idx_cell_path_unique
 		ON cell(path)
 		WHERE path IS NOT NULL AND deleted_at IS NULL`,
+    `CREATE INDEX IF NOT EXISTS idx_cell_kind ON cell(kind)
+		WHERE deleted_at IS NULL`,
     `CREATE INDEX IF NOT EXISTS idx_cell_data ON cell USING gin(data)
 		WHERE deleted_at IS NULL`,
     `CREATE INDEX IF NOT EXISTS idx_cell_refs ON cell USING gin(refs)

package/dist/db/cell_queries.d.ts

@@ -42,6 +42,7 @@ import type { CellVisibility } from '../auth/cell_action_specs.js';
 export interface CellRow {
     id: Uuid;
     data: CellData;
+    kind: string | null;
     visibility: CellVisibility;
     path: string | null;
     refs: Array<FactHash> | null;
@@ -52,9 +53,14 @@ export interface CellRow {
     updated_by: Uuid | null;
     grant_count: number;
 }
-/** Input for `query_cell_create`. `refs` is derived from `data`. */
+/**
+ * Input for `query_cell_create`. `refs` is derived from `data`. `kind` is
+ * the write-once capability axis (`cell.kind` column) — set here at INSERT
+ * and absent from `CellUpdatePatch`, so it can never change post-create.
+ */
 export interface CellCreateQueryInput {
     data: Json;
+    kind?: string | null;
     visibility?: CellVisibility;
     path?: string | null;
     created_by?: Uuid | null;
@@ -153,15 +159,15 @@ export declare const query_cell_delete: (deps: QueryDeps, id: Uuid, options?: {
     deleted_by?: Uuid | null;
 }) => Promise<boolean>;
 /**
- * List cells whose `data.kind` matches the given value, newest first.
- * Uses the `idx_cell_data` GIN index (`data @> ...`).
+ * List active cells with the given `kind`, newest first. Uses the
+ * `idx_cell_kind` index (`cell.kind = ?`).
  *
  * @param deps - query deps
- * @param kind - `data.kind` value to match (e.g. `'collection'`, `'entry'`)
+ * @param kind - `cell.kind` value to match (e.g. `'collection'`, `'entry'`)
  * @param options - pagination
  * @returns matching active rows
  */
-export declare const query_cell_list_by_data_kind: (deps: QueryDeps, kind: string, options?: Pick<CellListOptions, "limit" | "offset">) => Promise<Array<CellRow>>;
+export declare const query_cell_list_by_kind: (deps: QueryDeps, kind: string, options?: Pick<CellListOptions, "limit" | "offset">) => Promise<Array<CellRow>>;
 /**
  * List active cells created by an actor, newest first. Backed by the
  * `idx_cell_created_by` partial index.
@@ -221,8 +227,8 @@ export declare const query_cell_list_by_creator: (deps: QueryDeps, actor_id: Uui
 export declare const query_cell_list: (deps: QueryDeps, params: CellListParams) => Promise<Array<CellRow>>;
 /** Parameters for `query_cell_list`. All filter dimensions are optional. */
 export interface CellListParams {
-    /** Match `data.kind = ?` via `data @> {"kind": ?}` (uses `idx_cell_data`). */
-    data_kind?: string;
+    /** Match `cell.kind = ?` (uses `idx_cell_kind`). */
+    kind?: string;
     /**
      * Match `cell.visibility = ?` directly on the top-level column.
      * Additional narrowing on top of the SQL-side auth visibility
@@ -286,7 +292,7 @@ export interface CellListParams {
     /**
      * When `true`, narrow to cells admitting the caller via a
      * `cell_grant` row AND that the caller does not own. Authenticated
-     * only (`viewer_actor_id` must be set). Combine with `data_kind` /
+     * only (`viewer_actor_id` must be set). Combine with `kind` /
      * `path_prefix` etc. to scope further.
      */
     shared_with_caller_only?: boolean;

package/dist/db/cell_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,0BAA0B,CAAC;AACnD,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAyB,KAAK,QAAQ,EAAC,MAAM,+BAA+B,CAAC;AAGpF,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,6BAA6B,CAAC;AAC1D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAEjE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,QAAQ,CAAC;IACf,UAAU,EAAE,cAAc,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACpB;AAgBD,oEAAoE;AACpE,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,OAAO,oBAAoB,KACzB,OAAO,CAAC,OAAO,CAgBjB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAC,KACnC,OAAO,CAAC,OAAO,GAAG,IAAI,CAUxB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,MAAM,MAAM,KACV,OAAO,CAAC,OAAO,GAAG,IAAI,CAQxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,KAAK,aAAa,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQxB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,OAAO,eAAe,KACpB,OAAO,CAAC,OAAO,GAAG,IAAI,CA4BxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAC,KAClC,OAAO,CAAC,OAAO,CAWjB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,SAAS,EACf,MAAM,MAAM,EACZ,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CASvB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,SAAS,EACf,UAAU,IAAI,EACd,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQvB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,eAAe,GAC3B,MAAM,SAAS,EACf,QAAQ,cAAc,KACpB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CA0DxB,CAAC;AAiGF,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC9B,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,4EAA4E;IAC5E,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,0EAA0E;IAC1E,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB;;;;OAIG;IACH,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,aAAa,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACzD;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,yCAAyC;IACzC,QAAQ,CAAC,EAAE,YAAY,GAAG,YAAY,CAAC;IACvC,sCAAsC;IACtC,eAAe,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,iBAAiB;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B"}
+{"version":3,"file":"cell_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,0BAA0B,CAAC;AACnD,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAyB,KAAK,QAAQ,EAAC,MAAM,+BAA+B,CAAC;AAGpF,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,6BAA6B,CAAC;AAC1D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAEjE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,cAAc,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACpB;AAgBD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,OAAO,oBAAoB,KACzB,OAAO,CAAC,OAAO,CAiBjB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAC,KACnC,OAAO,CAAC,OAAO,GAAG,IAAI,CAUxB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,MAAM,MAAM,KACV,OAAO,CAAC,OAAO,GAAG,IAAI,CAQxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,KAAK,aAAa,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQxB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,OAAO,eAAe,KACpB,OAAO,CAAC,OAAO,GAAG,IAAI,CA4BxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAC,KAClC,OAAO,CAAC,OAAO,CAWjB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,MAAM,MAAM,EACZ,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CASvB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,SAAS,EACf,UAAU,IAAI,EACd,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQvB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,eAAe,GAC3B,MAAM,SAAS,EACf,QAAQ,cAAc,KACpB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CA0DxB,CAAC;AAiGF,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC9B,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,4EAA4E;IAC5E,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,0EAA0E;IAC1E,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB;;;;OAIG;IACH,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,aAAa,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACzD;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,yCAAyC;IACzC,QAAQ,CAAC,EAAE,YAAY,GAAG,YAAY,CAAC;IACvC,sCAAsC;IACtC,eAAe,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,iBAAiB;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B"}

package/dist/db/cell_queries.js

@@ -51,10 +51,11 @@ const grant_count_projection = (cell_alias) => `(SELECT COUNT(*)::int FROM cell_
 export const query_cell_create = async (deps, input) => {
     const refs = derive_refs(input.data);
     const row = await deps.db.query_one(`INSERT INTO cell
-		   (data, visibility, path, refs, created_by)
-		 VALUES ($1::jsonb, COALESCE($2::cell_visibility, 'private'::cell_visibility), $3, $4::text[], $5)
+		   (data, kind, visibility, path, refs, created_by)
+		 VALUES ($1::jsonb, $2, COALESCE($3::cell_visibility, 'private'::cell_visibility), $4, $5::text[], $6)
 		 RETURNING *, ${grant_count_projection('cell')}`, [
         JSON.stringify(input.data),
+        input.kind ?? null,
         input.visibility ?? null,
         input.path ?? null,
         refs,
@@ -171,20 +172,20 @@ export const query_cell_delete = async (deps, id, options) => {
     return row !== undefined;
 };
 /**
- * List cells whose `data.kind` matches the given value, newest first.
- * Uses the `idx_cell_data` GIN index (`data @> ...`).
+ * List active cells with the given `kind`, newest first. Uses the
+ * `idx_cell_kind` index (`cell.kind = ?`).
  *
  * @param deps - query deps
- * @param kind - `data.kind` value to match (e.g. `'collection'`, `'entry'`)
+ * @param kind - `cell.kind` value to match (e.g. `'collection'`, `'entry'`)
  * @param options - pagination
  * @returns matching active rows
  */
-export const query_cell_list_by_data_kind = async (deps, kind, options) => deps.db.query(`SELECT *, ${grant_count_projection('cell')}
+export const query_cell_list_by_kind = async (deps, kind, options) => deps.db.query(`SELECT *, ${grant_count_projection('cell')}
 		 FROM cell
-		 WHERE data @> $1::jsonb
+		 WHERE kind = $1
 		   AND deleted_at IS NULL
 		 ORDER BY created_at DESC
-		 LIMIT $2 OFFSET $3`, [JSON.stringify({ kind }), options?.limit ?? null, options?.offset ?? 0]);
+		 LIMIT $2 OFFSET $3`, [kind, options?.limit ?? null, options?.offset ?? 0]);
 /**
  * List active cells created by an actor, newest first. Backed by the
  * `idx_cell_created_by` partial index.
@@ -284,7 +285,7 @@ export const query_cell_list = async (deps, params) => {
         : build_general_sql(order_column, order_direction);
     return deps.db.query(sql, [
         params.include_deleted === true,
-        params.data_kind ?? null,
+        params.kind ?? null,
         params.ref ?? null,
         params.created_by ?? null,
         params.path_prefix ?? null,
@@ -333,7 +334,7 @@ const CALLER_ROLE_GRANTS_CTE = `WITH caller_role_grants AS (
 const build_general_sql = (order_column, order_direction) => `${CALLER_ROLE_GRANTS_CTE}
 	 SELECT c.*, ${grant_count_projection('c')} FROM cell c
 	 WHERE ($1::bool OR c.deleted_at IS NULL)
-	   AND ($2::text IS NULL OR c.data @> jsonb_build_object('kind', $2::text))
+	   AND ($2::text IS NULL OR c.kind = $2::text)
 	   AND ($14::cell_visibility IS NULL OR c.visibility = $14::cell_visibility)
 	   AND ($3::text IS NULL OR c.refs @> ARRAY[$3]::text[])
 	   AND ($4::uuid IS NULL OR c.created_by = $4)
@@ -369,7 +370,7 @@ const build_general_sql = (order_column, order_direction) => `${CALLER_ROLE_GRAN
 const build_shared_with_sql = (order_column, order_direction) => `${CALLER_ROLE_GRANTS_CTE}
 	 SELECT c.*, ${grant_count_projection('c')} FROM cell c
 	 WHERE ($1::bool OR c.deleted_at IS NULL)
-	   AND ($2::text IS NULL OR c.data @> jsonb_build_object('kind', $2::text))
+	   AND ($2::text IS NULL OR c.kind = $2::text)
 	   AND ($14::cell_visibility IS NULL OR c.visibility = $14::cell_visibility)
 	   AND ($3::text IS NULL OR c.refs @> ARRAY[$3]::text[])
 	   AND ($4::uuid IS NULL OR c.created_by = $4)

package/dist/testing/CLAUDE.md

@@ -897,8 +897,9 @@ source of truth for wire-shape conformance.
 
 - `testing/cross_backend/capabilities.ts` — `BackendCapabilities` vocabulary
   (the **gating** flags `ws` / `sse` / `cell_crud` / `cell_relations` /
-  `account_lifecycle` / `fact_serving` / `ready` / `account_status` /
-  `oversized_reject_closes_connection` / `peer_request` — each has a `test_if`
+  `cell_gated_create` / `account_lifecycle` / `fact_serving` / `ready` /
+  `account_status` / `oversized_reject_closes_connection` / `peer_request` —
+  each has a `test_if`
   reader; `peer_request` (server-initiated requests — the ActionPeer
   `peer/ping` round-trip) is `true` for both the Rust spine and the TS spine
   (`BackendWebsocketTransport.request_connection`); `ts_default_capabilities`
@@ -914,6 +915,13 @@ source of truth for wire-shape conformance.
   parity suite — both `true` on every backend that live-mounts the full cell
   surface (TS spine binary, in-process app, Rust stub). A backend mounting only
   plain CRUD would declare `cell_crud: true, cell_relations: false`.
+  `cell_gated_create` gates `describe_cell_gated_create_cross_tests` (the
+  cell-creation-authorizer parity proof); unlike `cell_crud`/`cell_relations`
+  it is **cross-only** (`false` in-process) — `true` only on the reference
+  spine binaries that live-mount the `test_cell_gated_create_authorize` policy
+  (the TS spine `full_spine_mount` + the Rust `testing_spine_stub`), since the
+  authorizer adds no method/column/wire shape and so the schema + manifest
+  parity gates are blind to an authorizer divergence.
   `account_lifecycle` gates `describe_account_lifecycle_cross_tests` (the
   `account_delete` / `account_undelete` / `account_purge` parity suite); unlike
   cells those verbs **are** on the declared surface (in `create_admin_actions`,
@@ -1154,7 +1162,7 @@ the stream \_can't* open on a spine without SSE — a self-cleaning tripwire for
 the spine that should grow it, distinct from the consumer-legit capability
 skip the shared suite emits.
 
-### `cross_backend/cell_crud.ts` + `cell_relations.ts` — cell parity suites
+### `cross_backend/cell_crud.ts` + `cell_relations.ts` + `cell_gated_create.ts` — cell parity suites
 
 The cell-layer parity coverage is split across two sibling suites. Cells
 can't ride the generic `describe_rpc_round_trip_tests` (stateful verbs need a
@@ -1189,10 +1197,23 @@ backdoor, cell).
   holder who can `cell_get` still gets the IDOR 404). Only **actor-shaped**
   grants are exercised — role-shaped principals need a closed role registry the
   Rust spine deliberately lacks.
-
-Both gate `true` on TS + Rust (cells run on both, no `.skip`). Cross-process
-wiring is `src/test/cross_backend/cell.cross.test.ts` (both suites); the
-in-process legs (plain `gro test`) are `src/test/auth/cell_crud_parity.db.test.ts`
+- **`describe_cell_gated_create_cross_tests`** (gates on
+  `capabilities.cell_gated_create`, **cross-only**) — the cell-creation
+  authorizer (`CellCreateAuthorize`) parity proof. Both spines mount the same
+  `test_cell_gated_create_authorize` policy (gate `kind: 'gated'` behind the
+  `participant` role or admin): a non-participant is denied with the
+  `cell_not_found` 404 IDOR mask, an ungated kind is open, a `participant` is
+  admitted, and admin bypasses. The authorizer adds no method/column/wire
+  shape, so schema + manifest parity are **blind** to a divergence — this is the
+  only gate that catches one. In-process hook coverage is the standalone
+  `auth/cell_create_authorize.db.test.ts` (this cross suite skips in-process,
+  where the default app mounts no authorizer).
+
+`cell_crud` / `cell_relations` gate `true` on TS + Rust (cells run on both, no
+`.skip`); `cell_gated_create` is cross-only (the policy is a spine-binary
+fixture). Cross-process wiring is `src/test/cross_backend/cell.cross.test.ts`
+(all three suites); the in-process legs (plain `gro test`) for crud/relations
+are `src/test/auth/cell_crud_parity.db.test.ts`
 
 - `cell_relations_parity.db.test.ts`, sharing the full-surface
   `create_cell_parity_setup` (`cell_parity_helpers.ts`) which mounts every cell

package/dist/testing/cross_backend/capabilities.d.ts

@@ -159,6 +159,20 @@ export interface BackendCapabilities {
      * coverage.
      */
     readonly peer_request: boolean;
+    /**
+     * A test `CellCreateAuthorize` policy is live-mounted on the backend's cell
+     * layer — creating a `kind: 'gated'` cell requires the `participant` role
+     * or admin; every other kind (and a typeless cell) is open. Gates
+     * `describe_cell_gated_create_cross_tests`, the TS↔Rust cell-creation-
+     * authorizer parity proof. The authorizer adds no method / column / wire
+     * shape, so schema-snapshot + action-manifest parity are **blind** to an
+     * authorizer divergence — this behavioral cross case is the only gate that
+     * catches one. `true` only on the reference spine binaries that mount the
+     * test policy (the TS spine `full_spine_mount` + the Rust
+     * `testing_spine_stub`); consumers and the in-process default app don't
+     * mount it.
+     */
+    readonly cell_gated_create: boolean;
 }
 /**
  * Capability declarations for the in-process Hono transport. Nearly every

package/dist/testing/cross_backend/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwC9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC;IACrD;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAWpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAwC9B;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,kCAAkC,EAAE,OAAO,CAAC;IACrD;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,EAAE,mBAcpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,iBAInC,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,OAAO,GAAI,MAAM,OAAO,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAG,IAMrF,CAAC"}

package/dist/testing/cross_backend/capabilities.js

@@ -56,6 +56,9 @@ export const in_process_capabilities = Object.freeze({
     account_status: true,
     oversized_reject_closes_connection: true,
     peer_request: false,
+    // Cross-process-only: the test `CellCreateAuthorize` policy is mounted on the
+    // spine binaries' full mount + the Rust stub, not the in-process default app.
+    cell_gated_create: false,
 });
 /**
  * Shape notes for the in-process Hono transport — every wiring fact present

package/dist/testing/cross_backend/cell_crud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AAsD9B,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,YAAY,CAAC;AAGzD,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IA6VlF,CAAC"}
+{"version":3,"file":"cell_crud.d.ts","sourceRoot":"../src/lib/","sources":["../../../src/lib/testing/cross_backend/cell_crud.ts"],"names":[],"mappings":"AAAA,OAAO,sBAAsB,CAAC;AA2D9B,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,YAAY,CAAC;AAGzD,eAAO,MAAM,8BAA8B,GAAI,SAAS,wBAAwB,KAAG,IAublF,CAAC"}