@fuzdev/fuz_app 0.102.0 → 0.104.0

package/dist/auth/cell_action_specs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAMtB,OAAO,EAEN,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,EAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEN,0BAA0B,EAC1B,6BAA6B,EAC7B,2BAA2B,EAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEN,4BAA4B,EAC5B,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAE1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEN,2BAA2B,EAC3B,MAAM,8BAA8B,CAAC;AAGtC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,cAAc;;;EAAgC,CAAC;AAC5D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAO5D,OAAO,EAAC,6BAA6B,EAAE,6BAA6B,EAAE,2BAA2B,EAAC,CAAC;AACnG,OAAO,EAAC,0BAA0B,EAAE,6BAA6B,EAAE,2BAA2B,EAAC,CAAC;AAChG,OAAO,EACN,4BAA4B,EAC5B,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,GAC1B,CAAC;AACF,OAAO,EAAC,2BAA2B,EAAC,CAAC;AAIrC,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,EAAG,gBAAyB,CAAC;AAE9D,yEAAyE;AACzE,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,EAAG,6BAAsC,CAAC;AAExF,6EAA6E;AAC7E,eAAO,MAAM,kCAAkC,EAAG,8BAAuC,CAAC;AAE1F;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAG,0BAAmC,CAAC;AAElF;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,EACpD,oCAA6C,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,EACrD,qCAA8C,CAAC;AAIhD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,oDAAgE,CAAC;AACtF,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;kBAkBnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAIhD;;;;GAIG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;kBAa1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;kBAAmC,CAAC;AACjE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIhE;;;;;GAKG;AACH,eAAO,MAAM,YAAY;;;;kBAQtB,CAAC;AACJ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAI1D;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;kBAQ1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;kBAAmC,CAAC;AACjE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIhE,eAAO,MAAM,eAAe;;;kBAG1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,gBAAgB;;;kBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIhE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;mBA2Bb,CAAC;AACd,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAGzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAI5D;;;;;;GAMG;AACH,eAAO,MAAM,cAAc;;;;;;;;;kBAezB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;kBAAmC,CAAC;AAChE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAI9D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYC,CAAC;AAEtC,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYI,CAAC;AAEtC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWC,CAAC;AAEtC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;CAUC,CAAC;AAEtC,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYG,CAAC;AAEtC,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYE,CAAC;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWxB,CAAC"}
+{"version":3,"file":"cell_action_specs.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_action_specs.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAMtB,OAAO,EAEN,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,EAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEN,0BAA0B,EAC1B,6BAA6B,EAC7B,2BAA2B,EAE3B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEN,4BAA4B,EAC5B,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAE1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEN,2BAA2B,EAC3B,MAAM,8BAA8B,CAAC;AAGtC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,cAAc;;;EAAgC,CAAC;AAC5D,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAO5D,OAAO,EAAC,6BAA6B,EAAE,6BAA6B,EAAE,2BAA2B,EAAC,CAAC;AACnG,OAAO,EAAC,0BAA0B,EAAE,6BAA6B,EAAE,2BAA2B,EAAC,CAAC;AAChG,OAAO,EACN,4BAA4B,EAC5B,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,GAC1B,CAAC;AACF,OAAO,EAAC,2BAA2B,EAAC,CAAC;AAIrC,uEAAuE;AACvE,eAAO,MAAM,oBAAoB,EAAG,gBAAyB,CAAC;AAE9D,yEAAyE;AACzE,eAAO,MAAM,0BAA0B,EAAG,sBAA+B,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,EAAG,6BAAsC,CAAC;AAExF,6EAA6E;AAC7E,eAAO,MAAM,kCAAkC,EAAG,8BAAuC,CAAC;AAE1F;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAG,mBAA4B,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,EAAG,uBAAgC,CAAC;AAE5E;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,EAAG,yBAAkC,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,EAAG,yBAAkC,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,wCAAwC,EACpD,oCAA6C,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,EACrD,qCAA8C,CAAC;AAIhD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,oDAAgE,CAAC;AACtF,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,MAAM,CAAC;AACvC,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;kBAkCnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAIhD;;;;GAIG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;kBAqB1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;kBAAmC,CAAC;AACjE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIhE;;;;;GAKG;AACH,eAAO,MAAM,YAAY;;;;kBAQtB,CAAC;AACJ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAI1D;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;kBAQ1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;kBAAmC,CAAC;AACjE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIhE,eAAO,MAAM,eAAe;;;kBAG1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,gBAAgB;;;kBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAIhE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;mBAsCb,CAAC;AACd,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAGzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAI5D;;;;;;GAMG;AACH,eAAO,MAAM,cAAc;;;;;;;;kBAezB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;kBAAmC,CAAC;AAChE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAI9D;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;EAAmC,CAAC;AACvE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB;;;;;;;kBAM5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;kBAAmC,CAAC;AACnE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAIpE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYC,CAAC;AAEtC,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYI,CAAC;AAEtC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAWC,CAAC;AAEtC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;CAUC,CAAC;AAEtC,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYG,CAAC;AAEtC,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYE,CAAC;AAEtC,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYD,CAAC;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYxB,CAAC"}

package/dist/auth/cell_action_specs.js

@@ -64,12 +64,42 @@ export const ERROR_CELL_VISIBILITY_MANAGE_ONLY = 'cell_visibility_manage_only';
 /** Error reason — input shape for `cell_get` lacked both `id` and `path`. */
 export const ERROR_CELL_GET_REQUIRES_ID_OR_PATH = 'cell_get_requires_id_or_path';
 /**
- * Error reason — `cell_clone` `with_data_patch` would change `data.kind`.
- * Per-kind shape validation can pass coincidentally (e.g., one kind's
- * schema accepts most of another's fields), so we reject the cross-kind
- * patch explicitly to prevent incoherent clones.
+ * Error reason — a `kind` key was supplied inside `data`. `kind` is a
+ * top-level column (`cell.kind`), not content metadata; accepting it inside
+ * `data` would create two sources of truth. Rejected fail-loud at the
+ * create / update / clone-patch boundary so the column stays canonical.
  */
-export const ERROR_CELL_CLONE_KIND_MISMATCH = 'cell_clone_kind_mismatch';
+export const ERROR_CELL_KIND_IN_DATA = 'cell_kind_in_data';
+/**
+ * Error reason — `cell_create` was given an empty-string `kind`. `kind` is a
+ * non-empty capability tag or absent (`null` = typeless cell); `""` (a tag
+ * that tags nothing) is rejected fail-loud so `kind` stays a clean
+ * `null | non-empty-string` (twin of the Rust `ERROR_CELL_KIND_EMPTY`).
+ */
+export const ERROR_CELL_KIND_EMPTY = 'cell_kind_empty';
+/**
+ * Error reason — the parent-aware `CellCreateAuthorize` denied the create for a
+ * **viewable** parent (or a root creation): "you see it, you can't contribute
+ * here." A **403** `forbidden`, distinct from the create-path **404** mask used
+ * when the parent itself isn't viewable (twin of the Rust
+ * `ERROR_CELL_CREATE_FORBIDDEN`).
+ */
+export const ERROR_CELL_CREATE_FORBIDDEN = 'cell_create_forbidden';
+/**
+ * Error reason — `cell_moderate` caller can view the contribution but lacks
+ * moderation authority over its governing root (not admin / not the root's
+ * manager). A **403** `forbidden`. The author can view their own pending
+ * contribution, so they reach this gate — and are denied here, which is the
+ * anti-self-approval guard (twin of the Rust `ERROR_CELL_MODERATE_FORBIDDEN`).
+ */
+export const ERROR_CELL_MODERATE_FORBIDDEN = 'cell_moderate_forbidden';
+/**
+ * Error reason — `cell_moderate` target has no governing root (`root_id` is
+ * null): it's a root or an unparented cell, not a gated contribution, so there
+ * is nothing to moderate. A **400** `invalid_params` (twin of the Rust
+ * `ERROR_CELL_NOT_A_CONTRIBUTION`).
+ */
+export const ERROR_CELL_NOT_A_CONTRIBUTION = 'cell_not_a_contribution';
 /**
  * Error reason — null-auth `cell_list` caller passed a `created_by`
  * filter. The filter is a soft account-id enumeration vector ("does
@@ -136,10 +166,22 @@ export const CellJson = z.strictObject({
     id: Uuid,
     path: CellPath.nullable(),
     data: CellData,
+    kind: z.string().nullable().meta({
+        description: 'Capability / identity tag — a write-once top-level column (peer to `visibility` / `path`), not a field inside `data`. `null` for a typeless cell. The discriminator a creation authorizer gates on; fixed at birth.',
+    }),
     visibility: CellVisibility.meta({
         description: "Access-control tag. `'public'` admits everyone (including unauthenticated visitors); `'private'` (default) admits admin / owner / `cell_grant`-admitted callers. Top-level column, not inside `data`.",
     }),
     refs: z.array(FactHashSchema).nullable(),
+    parent_id: Uuid.nullable().meta({
+        description: 'Immediate container in the directory tree (the directory this cell lives in). `null` = a root (parentless). Set once at create, immutable in v1.',
+    }),
+    root_id: Uuid.nullable().meta({
+        description: 'Governing root of the directory subtree, denormalized for flat-subtree queries (`root_id = parent.root_id ?? parent.id`). `null` for a root. Set once at create, immutable in v1.',
+    }),
+    moderation: z.string().nullable().meta({
+        description: "Approval-lifecycle marker for a gated contribution (`'pending'` / `'approved'` / `'rejected'`); `null` = unmoderated. A control field with a non-author writer — peer to `visibility`, never inside `data` (set by the create authorizer's verdict, transitioned only by `cell_moderate`).",
+    }),
     created_by: Uuid.nullable(),
     updated_by: Uuid.nullable(),
     created_at: z.string(),
@@ -157,7 +199,10 @@ export const CellJson = z.strictObject({
  */
 export const CellCreateInput = z.strictObject({
     data: CellData.meta({
-        description: 'Cell data. Base fields (kind / label / summary) typed; extras loose. Per-kind shape is sub-API.',
+        description: 'Cell content. Base fields (label / summary) typed; extras loose. A `kind` key here is rejected (`ERROR_CELL_KIND_IN_DATA`) — kind is the top-level field. Per-kind shape is sub-API.',
+    }),
+    kind: z.string().nullish().meta({
+        description: 'Capability / identity tag, written to the top-level `cell.kind` column (not `data`). Write-once — fixed at birth, not updatable. Non-empty when present (an empty string is rejected `ERROR_CELL_KIND_EMPTY`); omit / null for a typeless cell. A creation authorizer (if mounted) gates on this.',
     }),
     visibility: CellVisibility.optional().meta({
         description: "Access-control tag. Top-level column (not in `data`). Default `'private'` when omitted.",
@@ -165,6 +210,9 @@ export const CellCreateInput = z.strictObject({
     path: CellPath.nullish().meta({
         description: 'Admin-only named lookup alias. Globally unique on active rows.',
     }),
+    parent_id: Uuid.nullish().meta({
+        description: 'Immediate container — the directory this cell is created in. Omit / null = a root (parentless). The handler resolves `root_id` from it and gates the create through the parent-aware authorizer; `root_id` / `moderation` are handler-derived, never wire input.',
+    }),
     acting: ActingActor,
 });
 export const CellCreateOutput = z.strictObject({ cell: CellJson });
@@ -245,7 +293,7 @@ export const CellDeleteOutput = z.strictObject({
  * `shared_with: 'me'` narrows to cells that admit the caller via a
  * `cell_grant` row (actor-shaped or role-shaped principal) AND that
  * the caller does not own. Authenticated only; combine with
- * `data_kind` / `path_prefix` etc. to scope further. Combining with
+ * `kind` / `path_prefix` etc. to scope further. Combining with
  * `created_by: <my-actor-id>` produces an empty result by definition
  * (owner is implicit, never appears as a grant principal); we don't
  * reject the combination at the schema layer because SQL emptiness is
@@ -258,7 +306,9 @@ export const CellListInput = z
         .max(CELL_LIST_LIMIT_MAX)
         .optional()
         .meta({ description: 'Batch-fetch by id. Visibility predicate still applies.' }),
-    data_kind: z.string().min(1).optional().meta({ description: 'Match `data.kind = ?`.' }),
+    kind: z.string().optional().meta({
+        description: 'Match `cell.kind = ?`. An empty string matches nothing — no cell carries an empty kind.',
+    }),
     visibility: CellVisibility.optional().meta({
         description: "Match `cell.visibility = ?`. The SQL-side auth-narrow already filters to public-or-admitted; this is an additional narrowing filter (e.g. `visibility: 'public'` on the discovery feed so authed callers don't see their own private entries mixed in).",
     }),
@@ -267,6 +317,12 @@ export const CellListInput = z
     path_prefix: CellPath.optional().meta({
         description: 'Match cells whose path starts with this.',
     }),
+    root_id: Uuid.optional().meta({
+        description: 'Scope to a directory subtree by governing root (`cell.root_id = ?`) — the feed + mod-queue key.',
+    }),
+    moderation: z.string().optional().meta({
+        description: "Filter by moderation lifecycle marker (`'pending'` drives the moderation queue).",
+    }),
     shared_with: z.literal('me').optional().meta({
         description: 'Narrow to cells admitting the caller via `cell_grant`, excluding cells the caller owns. Self-only — a `Uuid` form would need cross-actor role_grant loading.',
     }),
@@ -305,6 +361,30 @@ export const CellCloneInput = z.strictObject({
     acting: ActingActor,
 });
 export const CellCloneOutput = z.strictObject({ cell: CellJson });
+// -- cell_moderate ----------------------------------------------------------
+/**
+ * The terminal transition a `cell_moderate` call applies to a gated
+ * contribution's `moderation` lifecycle. The born state (`'pending'`) is set
+ * by the create authorizer, never on the wire; the verb only moves it to a
+ * terminal state. `'approved'` publishes (also flips `visibility → 'public'`);
+ * `'rejected'` leaves it private.
+ */
+export const CellModerationDecision = z.enum(['approved', 'rejected']);
+/**
+ * Input for `cell_moderate` — the `pending → approved | rejected` transition,
+ * gated on moderation authority over the **governing root** (admin / root
+ * owner in v1), not the contribution (which the author manages, and could
+ * otherwise self-approve). 404 when the target isn't viewable; 403 when it is
+ * but the caller isn't a root manager (the author lands here).
+ */
+export const CellModerateInput = z.strictObject({
+    cell_id: Uuid.meta({ description: 'Contribution to moderate.' }),
+    moderation: CellModerationDecision.meta({
+        description: 'Terminal decision: `approved` (publishes, visibility → public) or `rejected`.',
+    }),
+    acting: ActingActor,
+});
+export const CellModerateOutput = z.strictObject({ cell: CellJson });
 // -- Action specs -----------------------------------------------------------
 export const cell_create_action_spec = {
     method: 'cell_create',
@@ -376,9 +456,21 @@ export const cell_clone_action_spec = {
     rate_limit: 'account',
     description: 'Clone a cell (optionally deep). New owner is the caller; `path` is always nulled. Provenance recorded only in the `cell_clone` audit row. Per-account rate-limited — `deep: true` walks `cell_item` rows and fans out, so unbounded clone is a write-amplification vector.',
 };
+export const cell_moderate_action_spec = {
+    method: 'cell_moderate',
+    kind: 'request_response',
+    initiator: 'frontend',
+    auth: { account: 'required', actor: 'required' },
+    side_effects: true,
+    input: CellModerateInput,
+    output: CellModerateOutput,
+    async: true,
+    rate_limit: 'account',
+    description: 'Moderate a gated contribution (`pending → approved | rejected`). Gated on moderation authority over the governing root (admin / root owner), not the contribution — so the author cannot self-approve. Approval flips `moderation → approved` + `visibility → public`; rejection sets `moderation → rejected`. 404 on an unviewable target, 403 for a viewable target whose caller is not a root manager.',
+};
 /**
  * All cell-layer action specs — composed by app registries. Bundles the
- * six generic verbs (this module), the three `cell_grant_*` specs, the
+ * seven generic verbs (this module), the three `cell_grant_*` specs, the
  * three `cell_field_*` specs, the four `cell_item_*` specs, and the
  * `cell_audit_list` spec so codegen + UI clients see a single cell
  * namespace.
@@ -390,6 +482,7 @@ export const all_cell_action_specs = [
     cell_delete_action_spec,
     cell_list_action_spec,
     cell_clone_action_spec,
+    cell_moderate_action_spec,
     ...all_cell_grant_action_specs,
     ...all_cell_field_action_specs,
     ...all_cell_item_action_specs,

package/dist/auth/cell_actions.d.ts

@@ -39,10 +39,57 @@
  * @module
  */
 import { type RpcAction } from '../actions/action_rpc.js';
+import { type RequestActorContext } from './request_context.js';
 import type { RouteFactoryDeps } from './deps.js';
+import type { Uuid } from '@fuzdev/fuz_util/id.ts';
 import { type CellJson } from './cell_action_specs.js';
 import { type CellRow } from '../db/cell_queries.js';
 import type { CellData } from './cell_data_schema.js';
+/**
+ * Input to a `CellCreateAuthorize` callback — the TS twin of the Rust
+ * `CellCreateAuthorizeInput`. **Parent-aware**: it carries the directory
+ * context (`parent_id` / the handler-resolved `root_id`) so the authorizer can
+ * resolve the governing root's policy.
+ */
+export interface CellCreateAuthorizeInput {
+    /** The cell's `kind` (the top-level `cell.kind` value); `null` for a typeless cell. */
+    kind: string | null;
+    /** The cell `data` (kind-free — a `kind` key is rejected upstream). For richer M3-era policies (e.g. content pre-screen). */
+    data: CellData;
+    /** The immediate container the create targets. `null` = a root creation; otherwise a contribution under that parent. */
+    parent_id: Uuid | null;
+    /** The governing root of the directory subtree, resolved by the handler from the parent (`parent.root_id ?? parent.id`). `null` for a root creation. */
+    root_id: Uuid | null;
+    /** The governing root's `data` — the handler reads it in-tx (when an authorizer is mounted) and hands it over, so a directory-aware authorizer resolves `root.data.policy[kind]` **without a DB read of its own** (pure predicate; reading in-tx avoids the single-connection PGlite deadlock a separate handle would hit). `null` for a root creation, or when no authorizer is mounted. */
+    root_data: CellData | null;
+    /** Target scope — designed-in for M2 space-scoping; **always `null` in v1** (cells carry no scope column). */
+    scope_id: Uuid | null;
+}
+/**
+ * An authorizer's decision for a `cell_create` — the TS twin of the Rust
+ * `Verdict`. Folds the moderation outcome into the authority decision (one
+ * policy resolution, not two): `{allow: false}` denies (the handler surfaces a
+ * 403 `forbidden` for a viewable parent / a root creation), `{allow: true,
+ * moderation_required}` admits — `true` → born `pending` + private, `false` →
+ * born `approved` at the author's visibility.
+ */
+export type CellCreateVerdict = {
+    allow: false;
+} | {
+    allow: true;
+    moderation_required: boolean;
+};
+/**
+ * Opt-in, parent-aware creation authorizer — the TS twin of the Rust
+ * `CellCreateAuthorize` trait. Gates both roots (`parent_id = null`) and
+ * contributions; answers "may *this actor* create *this kind* here?" and
+ * returns a `CellCreateVerdict`. Runs in `cell_create` after `validate_data`
+ * and after the handler resolves `root_id` from the parent (an unviewable
+ * parent already 404-masks before this runs). Omitted = today's open create
+ * (all consumers untouched). Async-capable (DB / policy calls) — a DB-backed
+ * impl closes over its own `db` (the create handler stays unaware).
+ */
+export type CellCreateAuthorize = (auth: RequestActorContext, input: CellCreateAuthorizeInput) => CellCreateVerdict | Promise<CellCreateVerdict>;
 /**
  * Dependencies for `create_cell_actions`.
  *
@@ -53,9 +100,13 @@ import type { CellData } from './cell_data_schema.js';
  * `invalid_params` JSON-RPC error so per-kind validation failures
  * surface to clients with code -32602 (not -32603 / internal). When
  * omitted, payloads pass through as-is.
+ *
+ * `authorize_create` is the optional creation-gate hook (see
+ * `CellCreateAuthorize`). When omitted, create is open (today's behavior).
  */
 export type CellActionDeps = Pick<RouteFactoryDeps, 'log' | 'audit'> & {
     validate_data?: (data: CellData) => CellData;
+    authorize_create?: CellCreateAuthorize;
 };
 export declare const to_cell_json: (row: CellRow) => CellJson;
 /** Create the six generic cell RPC actions. */

package/dist/auth/cell_actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,0BAA0B,CAAC;AAKlC,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAGhD,OAAO,EA6BN,KAAK,QAAQ,EAEb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAQN,KAAK,OAAO,EACZ,MAAM,uBAAuB,CAAC;AAkB/B,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,uBAAuB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG;IACtE,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC;CAC7C,CAAC;AAgBF,eAAO,MAAM,YAAY,GAAI,KAAK,OAAO,KAAG,QAY1C,CAAC;AA2BH,+CAA+C;AAC/C,eAAO,MAAM,mBAAmB,GAAI,MAAM,cAAc,KAAG,KAAK,CAAC,SAAS,CA6ezE,CAAC"}
+{"version":3,"file":"cell_actions.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAIH,OAAO,EAIN,KAAK,SAAS,EACd,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAW,KAAK,mBAAmB,EAAC,MAAM,sBAAsB,CAAC;AAExE,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,WAAW,CAAC;AAEhD,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAEjD,OAAO,EAoCN,KAAK,QAAQ,EAEb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EASN,KAAK,OAAO,EACZ,MAAM,uBAAuB,CAAC;AAsB/B,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,uBAAuB,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACxC,uFAAuF;IACvF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,6HAA6H;IAC7H,IAAI,EAAE,QAAQ,CAAC;IACf,wHAAwH;IACxH,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,wJAAwJ;IACxJ,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,6XAA6X;IAC7X,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IAC3B,8GAA8G;IAC9G,QAAQ,EAAE,IAAI,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAAC,KAAK,EAAE,KAAK,CAAA;CAAC,GAAG;IAAC,KAAK,EAAE,IAAI,CAAC;IAAC,mBAAmB,EAAE,OAAO,CAAA;CAAC,CAAC;AAE7F;;;;;;;;;GASG;AACH,MAAM,MAAM,mBAAmB,GAAG,CACjC,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE,wBAAwB,KAC3B,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEpD;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG;IACtE,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC;IAC7C,gBAAgB,CAAC,EAAE,mBAAmB,CAAC;CACvC,CAAC;AAkCF,eAAO,MAAM,YAAY,GAAI,KAAK,OAAO,KAAG,QAgB1C,CAAC;AA2BH,+CAA+C;AAC/C,eAAO,MAAM,mBAAmB,GAAI,MAAM,cAAc,KAAG,KAAK,CAAC,SAAS,CAinBzE,CAAC"}

package/dist/auth/cell_actions.js

@@ -44,8 +44,8 @@ import { jsonrpc_errors, dev_only } from '../http/jsonrpc_errors.js';
 import { is_pg_unique_violation } from '../db/pg_error.js';
 import { has_role } from './request_context.js';
 import { ROLE_ADMIN } from './role_schema.js';
-import { cell_create_action_spec, cell_get_action_spec, cell_update_action_spec, cell_delete_action_spec, cell_list_action_spec, cell_clone_action_spec, ERROR_CELL_NOT_FOUND, ERROR_CELL_PATH_ADMIN_ONLY, ERROR_CELL_PATH_TAKEN, ERROR_CELL_VISIBILITY_MANAGE_ONLY, ERROR_CELL_GET_REQUIRES_ID_OR_PATH, ERROR_CELL_CLONE_KIND_MISMATCH, ERROR_CELL_LIST_CREATED_BY_REQUIRES_AUTH, ERROR_CELL_LIST_SHARED_WITH_REQUIRES_AUTH, CELL_LIST_LIMIT_DEFAULT, CELL_RELATIONS_BUNDLE_LIMIT, } from './cell_action_specs.js';
-import { query_cell_create, query_cell_get, query_cell_get_by_path, query_cell_update, query_cell_delete, query_cell_list, query_cell_load_many, } from '../db/cell_queries.js';
+import { cell_create_action_spec, cell_get_action_spec, cell_update_action_spec, cell_delete_action_spec, cell_list_action_spec, cell_clone_action_spec, cell_moderate_action_spec, ERROR_CELL_NOT_FOUND, ERROR_CELL_PATH_ADMIN_ONLY, ERROR_CELL_PATH_TAKEN, ERROR_CELL_VISIBILITY_MANAGE_ONLY, ERROR_CELL_GET_REQUIRES_ID_OR_PATH, ERROR_CELL_KIND_IN_DATA, ERROR_CELL_KIND_EMPTY, ERROR_CELL_CREATE_FORBIDDEN, ERROR_CELL_MODERATE_FORBIDDEN, ERROR_CELL_NOT_A_CONTRIBUTION, ERROR_CELL_LIST_CREATED_BY_REQUIRES_AUTH, ERROR_CELL_LIST_SHARED_WITH_REQUIRES_AUTH, CELL_LIST_LIMIT_DEFAULT, CELL_RELATIONS_BUNDLE_LIMIT, } from './cell_action_specs.js';
+import { query_cell_create, query_cell_get, query_cell_get_by_path, query_cell_update, query_cell_delete, query_cell_set_moderation, query_cell_list, query_cell_load_many, } from '../db/cell_queries.js';
 import { query_cell_grant_list_for_cell, query_cell_grants_for_caller_in_cells, } from '../db/cell_grant_queries.js';
 import { query_cell_field_list_for_source, query_cell_field_set } from '../db/cell_field_queries.js';
 import { query_cell_item_insert, query_cell_item_list_for_parent, } from '../db/cell_item_queries.js';
@@ -66,12 +66,30 @@ const to_iso_nullable = (value) => {
  * write is unambiguously a path collision.
  */
 const path_taken_error = () => jsonrpc_errors.conflict('cell.path is already taken', { reason: ERROR_CELL_PATH_TAKEN });
+/**
+ * Reject a `kind` key supplied inside `data`. `kind` is the top-level
+ * `cell.kind` column (write-once capability axis), so a copy inside the
+ * loose `data` blob would be a second source of truth that silently
+ * diverges on update. Fail-loud `invalid_params` at every wire-`data`
+ * boundary (create / update / clone-patch).
+ */
+const reject_kind_in_data = (data) => {
+    if (Object.hasOwn(data, 'kind')) {
+        throw jsonrpc_errors.invalid_params('cell.data must not contain `kind` (it is a top-level field)', {
+            reason: ERROR_CELL_KIND_IN_DATA,
+        });
+    }
+};
 export const to_cell_json = (row) => ({
     id: row.id,
     path: row.path,
     data: row.data,
+    kind: row.kind,
     visibility: row.visibility,
     refs: row.refs,
+    parent_id: row.parent_id,
+    root_id: row.root_id,
+    moderation: row.moderation,
     created_by: row.created_by,
     updated_by: row.updated_by,
     created_at: typeof row.created_at === 'string' ? row.created_at : row.created_at.toISOString(),
@@ -92,14 +110,14 @@ const emit_cell_audit = (ctx, event_type, row, deps, auth) => {
         ip: ctx.client_ip,
         metadata: {
             cell_id: row.id,
-            kind: row.data.kind,
+            kind: row.kind ?? undefined,
             path: row.path,
         },
     });
 };
 /** Create the six generic cell RPC actions. */
 export const create_cell_actions = (deps) => {
-    const { validate_data } = deps;
+    const { validate_data, authorize_create } = deps;
     /**
      * Run the optional `validate_data` deps callback and convert any thrown
      * `ZodError` into the standard `invalid_params` JSON-RPC error so per-
@@ -129,9 +147,88 @@ export const create_cell_actions = (deps) => {
                 reason: ERROR_CELL_PATH_ADMIN_ONLY,
             });
         }
+        // `kind` is the top-level column — reject a stray copy inside `data`,
+        // and reject an empty `kind` (a tag tags nothing — `null` is the typeless
+        // state), so `kind` stays a clean `null | non-empty-string`. Both run
+        // after the path-admin gate so an unauthorized caller sees that first.
+        reject_kind_in_data(input.data);
+        if (input.kind === '') {
+            throw jsonrpc_errors.invalid_params('cell.kind must not be empty (use null for a typeless cell)', { reason: ERROR_CELL_KIND_EMPTY });
+        }
         // Per-kind shape validation (sub-API). Unknown kinds pass through;
         // known kinds with malformed payloads surface as invalid_params.
         const validated_data = validate_data_or_throw(input.data);
+        const kind = input.kind ?? null;
+        // Directory tree: resolve the governing `root_id` from the parent (and
+        // the root's `data` for the authorizer's policy read). Runs whether or
+        // not an authorizer is mounted — `root_id` is written regardless, and an
+        // unviewable parent 404-masks the attempt (the same IDOR mask the read
+        // path uses; never reveals a hidden container). A root creation
+        // (`parent_id` null/absent) has `root_id = null`. `root_data` is read
+        // **in-tx** (only when an authorizer is mounted), reusing the parent row
+        // when the parent *is* the root, else one read by `root_id` — so the
+        // authorizer stays pure + the read rides the handler's connection (no
+        // separate-handle deadlock on the single-connection PGlite).
+        const parent_id = input.parent_id ?? null;
+        let root_id = null;
+        let root_data = null;
+        if (parent_id !== null) {
+            const parent = await query_cell_get(ctx, parent_id);
+            if (!parent)
+                throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
+            const parent_grants = await query_cell_grant_list_for_cell(ctx, parent.id);
+            if (!can_view_cell(auth, parent, parent_grants)) {
+                throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
+            }
+            root_id = parent.root_id ?? parent.id;
+            if (authorize_create) {
+                root_data =
+                    root_id === parent.id
+                        ? parent.data
+                        : ((await query_cell_get(ctx, root_id))?.data ?? null);
+            }
+        }
+        // Parent-aware creation authorizer (opt-in). Runs after shape validation
+        // and after the parent-resolve (a hidden parent already 404-masked).
+        // `{allow: false}` for a *viewable* parent / a root creation is a 403
+        // `forbidden` (not the 404 mask); an `{allow: true}` verdict folds the
+        // moderation outcome. Receives the **raw** `input.data` (not the
+        // `validate_data`-normalized value) to match the Rust twin, so a consumer
+        // with a transforming validator can't diverge TS↔Rust. `scope_id` is
+        // `null` in v1. Without an authorizer, create is open: `moderation` stays
+        // null and the author's visibility holds.
+        let moderation = null;
+        let visibility = input.visibility;
+        if (authorize_create) {
+            const verdict = await authorize_create(auth, {
+                kind,
+                data: input.data,
+                parent_id,
+                root_id,
+                root_data,
+                scope_id: null,
+            });
+            if (!verdict.allow) {
+                throw jsonrpc_errors.forbidden('cell creation is not permitted here', {
+                    reason: ERROR_CELL_CREATE_FORBIDDEN,
+                });
+            }
+            // Moderation is a *contribution* concept — only stamp it for a create
+            // with a parent. A root / unparented create stays `moderation = null`
+            // at the author's visibility even under a mounted authorizer (there is
+            // no container to be moderated under).
+            if (parent_id !== null) {
+                if (verdict.moderation_required) {
+                    // Born pending: stays private until `cell_moderate` approves it.
+                    moderation = 'pending';
+                    visibility = 'private';
+                }
+                else {
+                    // Born approved + live immediately at the author's visibility.
+                    moderation = 'approved';
+                }
+            }
+        }
         let row;
         try {
             row = await query_cell_create(ctx, {
@@ -141,8 +238,12 @@ export const create_cell_actions = (deps) => {
                 // extend `Json`. The DB column is JSONB; the cast trusts the
                 // schema-validated runtime shape.
                 data: validated_data,
-                visibility: input.visibility,
+                kind,
+                visibility,
                 path: input.path ?? null,
+                parent_id,
+                root_id,
+                moderation,
                 created_by: auth.actor.id,
             });
         }
@@ -254,7 +355,11 @@ export const create_cell_actions = (deps) => {
         // Per-kind shape validation when `data` is supplied. Patch-only —
         // we don't validate the existing row's data on update (validation
         // is for incoming patches). `data` writes fully replace, so the
-        // patch IS the post-update state.
+        // patch IS the post-update state. A stray `kind` inside it is rejected
+        // (kind is the write-once top-level column — `cell_update` cannot
+        // change it, structurally: it is not even a field on `CellUpdateInput`).
+        if (input.data !== undefined)
+            reject_kind_in_data(input.data);
         const validated_data = input.data !== undefined ? validate_data_or_throw(input.data) : undefined;
         let updated;
         try {
@@ -299,6 +404,51 @@ export const create_cell_actions = (deps) => {
         emit_cell_audit(ctx, 'cell_delete', existing, deps, auth);
         return { ok: true, deleted: true };
     };
+    const moderate_handler = async (input, ctx) => {
+        const auth = ctx.auth;
+        const existing = await query_cell_get(ctx, input.cell_id);
+        // 404 covers miss + unviewable so a pending (private) contribution
+        // doesn't leak existence to a non-viewer.
+        if (!existing)
+            throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
+        const grants = await query_cell_grant_list_for_cell(ctx, existing.id);
+        if (!can_view_cell(auth, existing, grants)) {
+            throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
+        }
+        // Only a contribution (with a governing root) is moderatable.
+        if (existing.root_id === null) {
+            throw jsonrpc_errors.invalid_params('cell is not a contribution (no governing root to moderate under)', { reason: ERROR_CELL_NOT_A_CONTRIBUTION });
+        }
+        // Authority is over the governing ROOT (admin / root owner), not the
+        // contribution — the author manages the contribution and could otherwise
+        // self-approve. A viewable-but-unauthorized caller (incl. the author) → 403.
+        const root = await query_cell_get(ctx, existing.root_id);
+        if (!root)
+            throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
+        if (!can_manage_cell(auth, root)) {
+            throw jsonrpc_errors.forbidden('cell_moderate requires moderation authority over the governing root', { reason: ERROR_CELL_MODERATE_FORBIDDEN });
+        }
+        const approved = input.moderation === 'approved';
+        const updated = await query_cell_set_moderation(ctx, input.cell_id, input.moderation, {
+            set_visibility_public: approved,
+            updated_by: auth.actor.id,
+        });
+        // Raced with a deleter between the authz check and the UPDATE.
+        if (!updated)
+            throw jsonrpc_errors.not_found('cell', { reason: ERROR_CELL_NOT_FOUND });
+        deps.audit.emit(ctx, {
+            event_type: 'cell_moderate',
+            actor_id: auth.actor.id,
+            account_id: auth.account.id,
+            ip: ctx.client_ip,
+            metadata: {
+                cell_id: updated.id,
+                root_id: existing.root_id,
+                moderation: input.moderation,
+            },
+        });
+        return { cell: to_cell_json(updated) };
+    };
     /**
      * Insert one cloned cell row owned by the caller.
      *
@@ -312,23 +462,13 @@ export const create_cell_actions = (deps) => {
      * server-stamped provenance fields.
      */
     const clone_one_cell_row = async (ctx, source, auth, options) => {
+        // A patch is wire-supplied `data` — reject a stray `kind` (kind is the
+        // immutable top-level column; the clone inherits `source.kind`).
+        if (options.patch_data !== undefined)
+            reject_kind_in_data(options.patch_data);
         // Both `source.data` and `options.patch_data` are CellData (loose
         // objects). Patch-last shallow merge composes cleanly.
         const merged_data = options.patch_data !== undefined ? { ...source.data, ...options.patch_data } : source.data;
-        // Block cross-kind patches before per-kind shape validation: a
-        // kind-A → kind-B patch can pass `validate_data` coincidentally
-        // (loose shapes accept overlapping fields) and produce an
-        // incoherent result. Reject when the merged kind diverges from the
-        // source's kind. Both undefined or equal kinds pass through;
-        // one-sided undefined is permissive (caller patching unrelated
-        // fields on a typeless source).
-        if (source.data.kind !== undefined &&
-            merged_data.kind !== undefined &&
-            source.data.kind !== merged_data.kind) {
-            throw jsonrpc_errors.invalid_params('cell_clone cannot change kind via with_data_patch', {
-                reason: ERROR_CELL_CLONE_KIND_MISMATCH,
-            });
-        }
         // Per-kind shape validation runs on the merged result (sub-API).
         // Source rows are validated on their original create; the patch
         // could violate the kind shape (e.g., remove a required field).
@@ -336,6 +476,9 @@ export const create_cell_actions = (deps) => {
         return query_cell_create(ctx, {
             // Boundary cast (see `create_handler`).
             data: validated_data,
+            // Clone inherits the source's kind verbatim — kind is fixed at
+            // birth and a `with_data_patch` can't reach the column.
+            kind: source.kind,
             visibility: source.visibility,
             path: null, // admin-only paths cannot auto-clone
             created_by: auth.actor.id,
@@ -463,7 +606,7 @@ export const create_cell_actions = (deps) => {
         // — emit directly rather than threading it through `emit_cell_audit`.
         // `kind` is read from `source.data` (not the cloned row) so the
         // audit trail attributes the clone to the source's shape.
-        const source_kind = source.data.kind;
+        const source_kind = source.kind ?? undefined;
         const cloned_child_count = deep ? cloneable_items.length : 0;
         deps.audit.emit(ctx, {
             event_type: 'cell_clone',
@@ -505,11 +648,13 @@ export const create_cell_actions = (deps) => {
         const caller_actor_id = auth?.actor?.id ?? null;
         const rows = await query_cell_list(ctx, {
             ids: input.ids,
-            data_kind: input.data_kind,
+            kind: input.kind,
             visibility: input.visibility,
             ref: input.ref,
             created_by: input.created_by,
             path_prefix: input.path_prefix,
+            root_id: input.root_id,
+            moderation: input.moderation,
             viewer_actor_id: caller_actor_id,
             viewer_is_admin: auth ? has_role(auth, ROLE_ADMIN) : false,
             caller_actor_id,
@@ -540,5 +685,6 @@ export const create_cell_actions = (deps) => {
         rpc_action(cell_delete_action_spec, delete_handler),
         rpc_action(cell_list_action_spec, list_handler),
         rpc_action(cell_clone_action_spec, clone_handler),
+        rpc_action(cell_moderate_action_spec, moderate_handler),
     ];
 };

package/dist/auth/cell_audit_events.d.ts

@@ -20,7 +20,7 @@ import type { z } from 'zod';
 /**
  * Cell-layer `event_type → metadata schema` map for `extra_events`.
  *
- * Covers the six generic cell verbs' mutation events plus the grant /
+ * Covers the seven generic cell verbs' mutation events plus the grant /
  * field / item relation events. Read-only verbs (`cell_get`, `cell_list`,
  * `cell_*_list`, `cell_audit_list`) emit nothing and are absent here.
  */

package/dist/auth/cell_audit_events.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_audit_events.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_audit_events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAiB3B;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAYjE,CAAC"}
+{"version":3,"file":"cell_audit_events.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_audit_events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAqB3B;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAajE,CAAC"}

package/dist/auth/cell_audit_events.js

@@ -16,14 +16,14 @@
  *
  * @module
  */
-import { CellAuditMetadata, CellCloneAuditMetadata } from './cell_audit_metadata.js';
+import { CellAuditMetadata, CellCloneAuditMetadata, CellModerateAuditMetadata, } from './cell_audit_metadata.js';
 import { CellGrantCreateAuditMetadata, CellGrantRevokeAuditMetadata, } from './cell_grant_audit_metadata.js';
 import { CellFieldSetAuditMetadata, CellFieldDeleteAuditMetadata, } from './cell_field_audit_metadata.js';
 import { CellItemInsertAuditMetadata, CellItemMoveAuditMetadata, CellItemDeleteAuditMetadata, } from './cell_item_audit_metadata.js';
 /**
  * Cell-layer `event_type → metadata schema` map for `extra_events`.
  *
- * Covers the six generic cell verbs' mutation events plus the grant /
+ * Covers the seven generic cell verbs' mutation events plus the grant /
  * field / item relation events. Read-only verbs (`cell_get`, `cell_list`,
  * `cell_*_list`, `cell_audit_list`) emit nothing and are absent here.
  */
@@ -32,6 +32,7 @@ export const cell_audit_events = {
     cell_update: CellAuditMetadata,
     cell_delete: CellAuditMetadata,
     cell_clone: CellCloneAuditMetadata,
+    cell_moderate: CellModerateAuditMetadata,
     cell_grant_create: CellGrantCreateAuditMetadata,
     cell_grant_revoke: CellGrantRevokeAuditMetadata,
     cell_field_set: CellFieldSetAuditMetadata,

package/dist/auth/cell_audit_metadata.d.ts

@@ -45,4 +45,19 @@ export declare const CellCloneAuditMetadata: z.ZodObject<{
     kind: z.ZodOptional<z.ZodString>;
 }, z.core.$loose>;
 export type CellCloneAuditMetadata = z.infer<typeof CellCloneAuditMetadata>;
+/**
+ * Metadata envelope for `cell_moderate`. `cell_id` is the moderated
+ * contribution; `root_id` is its governing root (the container whose
+ * moderation authority gated the call); `moderation` is the terminal decision
+ * applied (`'approved'` | `'rejected'`).
+ */
+export declare const CellModerateAuditMetadata: z.ZodObject<{
+    cell_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
+    root_id: z.core.$ZodBranded<z.ZodUUID, "Uuid", "out">;
+    moderation: z.ZodEnum<{
+        rejected: "rejected";
+        approved: "approved";
+    }>;
+}, z.core.$loose>;
+export type CellModerateAuditMetadata = z.infer<typeof CellModerateAuditMetadata>;
 //# sourceMappingURL=cell_audit_metadata.d.ts.map