@fuzdev/fuz_app 0.102.0 → 0.104.0

package/dist/auth/cell_audit_metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_audit_metadata.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_audit_metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAGtB;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB;;;;;;iBAMjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}
+{"version":3,"file":"cell_audit_metadata.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_audit_metadata.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAGtB;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB;;;;;;iBAMjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB;;;;;;;iBAIpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}

package/dist/auth/cell_audit_metadata.js

@@ -44,3 +44,14 @@ export const CellCloneAuditMetadata = z.looseObject({
     item_count: z.number().int().nonnegative(),
     kind: z.string().optional(),
 });
+/**
+ * Metadata envelope for `cell_moderate`. `cell_id` is the moderated
+ * contribution; `root_id` is its governing root (the container whose
+ * moderation authority gated the call); `moderation` is the terminal decision
+ * applied (`'approved'` | `'rejected'`).
+ */
+export const CellModerateAuditMetadata = z.looseObject({
+    cell_id: Uuid,
+    root_id: Uuid,
+    moderation: z.enum(['approved', 'rejected']),
+});

package/dist/auth/cell_data_schema.d.ts

@@ -11,17 +11,19 @@
  * `auth/cell_actions.ts`.
  *
  * **Discipline**: a field joins `CellData` only when at least two
- * consumers in different domains read it generically. `kind` (editor
- * dispatch + sub-API registry), `label` (list/index rendering), and
- * `summary` (card subtitle + share-target description) meet this bar.
- * Future candidates require evidence of generic usage — otherwise they
- * stay per-kind.
+ * consumers in different domains read it generically. `label` (list/index
+ * rendering) and `summary` (card subtitle + share-target description) meet
+ * this bar. Future candidates require evidence of generic usage — otherwise
+ * they stay per-kind.
  *
- * **Visibility is not in here.** Access control is a peer of `cell_grant`,
- * not content metadata — `cell.visibility` lives as a top-level column on
- * `CellJson` and `CellRow` (the `CellVisibility` enum is defined in
- * `auth/cell_action_specs.ts` next to the wire fields that use it), and is
- * enforced by `can_view_cell` reading the column directly (no JSON dive).
+ * **`kind` is not in here, and is rejected if present.** Like `visibility`,
+ * a cell's `kind` is a top-level column (`cell.kind` on `CellJson` /
+ * `CellRow`), not content metadata — it is the capability / identity axis a
+ * creation authorizer gates on, write-once at birth. A stray `kind` key
+ * inside `data` is a fail-loud `ERROR_CELL_KIND_IN_DATA` at the create /
+ * update / clone-patch boundary (single source of truth). Access control
+ * (`cell.visibility`) is likewise a peer column, enforced by `can_view_cell`
+ * reading the column directly (no JSON dive).
  *
  * @module
  */
@@ -29,14 +31,10 @@ import { z } from 'zod';
 /**
  * Base cell-data shape. All fields optional; loose mode admits arbitrary
  * additional keys so apps can attach metadata or stage new kinds without
- * touching the wire schema.
- *
- * `kind` is optional because cells without a registered kind are valid —
- * admin-curated content, in-development types, or unknown shapes pass
- * through. Known kinds get richer validation via the per-kind sub-API.
+ * touching the wire schema. `kind` lives on the top-level `cell.kind`
+ * column, not here (see the module doc).
  */
 export declare const CellData: z.ZodObject<{
-    kind: z.ZodOptional<z.ZodString>;
     label: z.ZodOptional<z.ZodString>;
     summary: z.ZodOptional<z.ZodString>;
 }, z.core.$loose>;

package/dist/auth/cell_data_schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_data_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_data_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ;;;;iBAInB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC"}
+{"version":3,"file":"cell_data_schema.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/auth/cell_data_schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB;;;;;GAKG;AACH,eAAO,MAAM,QAAQ;;;iBAGnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC"}

package/dist/auth/cell_data_schema.js

@@ -11,17 +11,19 @@
  * `auth/cell_actions.ts`.
  *
  * **Discipline**: a field joins `CellData` only when at least two
- * consumers in different domains read it generically. `kind` (editor
- * dispatch + sub-API registry), `label` (list/index rendering), and
- * `summary` (card subtitle + share-target description) meet this bar.
- * Future candidates require evidence of generic usage — otherwise they
- * stay per-kind.
+ * consumers in different domains read it generically. `label` (list/index
+ * rendering) and `summary` (card subtitle + share-target description) meet
+ * this bar. Future candidates require evidence of generic usage — otherwise
+ * they stay per-kind.
  *
- * **Visibility is not in here.** Access control is a peer of `cell_grant`,
- * not content metadata — `cell.visibility` lives as a top-level column on
- * `CellJson` and `CellRow` (the `CellVisibility` enum is defined in
- * `auth/cell_action_specs.ts` next to the wire fields that use it), and is
- * enforced by `can_view_cell` reading the column directly (no JSON dive).
+ * **`kind` is not in here, and is rejected if present.** Like `visibility`,
+ * a cell's `kind` is a top-level column (`cell.kind` on `CellJson` /
+ * `CellRow`), not content metadata — it is the capability / identity axis a
+ * creation authorizer gates on, write-once at birth. A stray `kind` key
+ * inside `data` is a fail-loud `ERROR_CELL_KIND_IN_DATA` at the create /
+ * update / clone-patch boundary (single source of truth). Access control
+ * (`cell.visibility`) is likewise a peer column, enforced by `can_view_cell`
+ * reading the column directly (no JSON dive).
  *
  * @module
  */
@@ -29,14 +31,10 @@ import { z } from 'zod';
 /**
  * Base cell-data shape. All fields optional; loose mode admits arbitrary
  * additional keys so apps can attach metadata or stage new kinds without
- * touching the wire schema.
- *
- * `kind` is optional because cells without a registered kind are valid —
- * admin-curated content, in-development types, or unknown shapes pass
- * through. Known kinds get richer validation via the per-kind sub-API.
+ * touching the wire schema. `kind` lives on the top-level `cell.kind`
+ * column, not here (see the module doc).
  */
 export const CellData = z.looseObject({
-    kind: z.string().optional(),
     label: z.string().optional(),
     summary: z.string().optional(),
 });

package/dist/db/CLAUDE.md

@@ -51,18 +51,31 @@ The wire schemas + RPC handlers + authz predicates for this layer live in
   tables; single-migration `CELL_MIGRATION_NS` (namespace `fuz_cell`).
   `cell.visibility cell_visibility NOT NULL DEFAULT 'private'` (PG ENUM
   `('private', 'public')`) — a top-level access-control column, peer to
-  `cell_grant`, not a `data` field. Nullable `created_by` / `updated_by`
-  FKs to `actor` (NULL = system origin). GIN on `data` / `refs`; global
-  partial-unique on `path`.
+  `cell_grant`, not a `data` field. `cell.kind text` (nullable) is the
+  write-once capability/identity axis — likewise a top-level column, not a
+  `data` field (`idx_cell_kind` partial-active). `cell.parent_id` / `root_id`
+  (nullable self-FKs to `cell.id`) are the **directory tree** — immediate
+  container + governing root (`root_id = parent.root_id ?? parent.id`, null for a
+  root), immutable in v1 (`idx_cell_root` partial-active for subtree feeds).
+  `cell.moderation text` (nullable — `pending` / `approved` / `rejected`) is the
+  approval-lifecycle marker, peer to `visibility` (partial `idx_cell_moderation_pending`
+  on `root_id WHERE moderation = 'pending'` for the mod queue), set by the create
+  authorizer's verdict + the `cell_moderate` verb, never in `data`. Nullable
+  `created_by` / `updated_by` FKs to `actor` (NULL = system origin). GIN on `data`
+  / `refs`; global partial-unique on `path`.
 - **`cell_history_ddl.ts`** — dormant `cell_history` table
   (`CELL_HISTORY_MIGRATION_NS`, namespace `fuz_cell_history`), FK → `cell.id`.
   Ships present-but-unwritten; no snapshot lifecycle yet.
 - **`cell_queries.ts`** — `query_cell_create / get / get_by_path / update /
-delete`, `_list_by_data_kind / _list_by_creator`, the
+delete / set_moderation`, `_list_by_kind / _list_by_creator`, the
   generic `query_cell_list` (filter + SQL-side visibility predicate mirroring
-  `can_view_cell`; the `ref` filter narrows by `cell.refs`), and
+  `can_view_cell`; the `kind` filter narrows by the `cell.kind` column, the
+  `ref` filter by `cell.refs`, plus `root_id` / `moderation` filters for the
+  per-root feed + mod queue), and
   `query_cell_load_many` (bulk id load, no visibility filter — feeds the
-  strict relation-read filter). `cell.refs` derived from
+  strict relation-read filter). `query_cell_set_moderation` is the dedicated
+  `cell_moderate` write (`moderation` is absent from `CellUpdatePatch`, so an
+  author can't self-approve via `cell_update`). `cell.refs` derived from
   `data` via `extract_refs` on create/update. `CellRow.grant_count` is a
   derived projection (correlated subquery on `idx_cell_grant_cell`).
 - **`cell_grant_queries.ts`** — resource-side ACL: `query_cell_grant_create`

package/dist/db/cell_ddl.d.ts

@@ -62,8 +62,24 @@ export declare const CELL_VISIBILITY_TYPE = "\nDO $$ BEGIN\n\tCREATE TYPE cell_v
  *
  * `path` is the global namespace axis (no tenant/hub scoping) — globally
  * unique on active rows via `idx_cell_path_unique`.
+ *
+ * `kind` is the capability / identity axis — a nullable top-level column
+ * (peer to `visibility` / `path`), **not** a field inside `data`. It is the
+ * discriminator a creation authorizer gates on (see `auth/cell_actions.ts`
+ * `CellCreateAuthorize`) and is **write-once**: set at INSERT and carried on
+ * no update path, so a cell's kind is fixed at birth. Content stays
+ * duck-typed in `data`; `kind` is a capability tag, not a content-type.
+ *
+ * `parent_id` / `root_id` are the **directory tree** (containment): `parent_id`
+ * is the immediate container (nullable self-FK; `NULL` = a root), `root_id` is
+ * the governing root denormalized for flat-subtree queries (`root_id =
+ * parent.root_id ?? parent.id`, so a root has `NULL`). Both are set once at
+ * create and immutable in v1 (carried on no update path). `moderation`
+ * (nullable text — `pending` / `approved` / `rejected`; `NULL` = unmoderated)
+ * is the approval-lifecycle marker, peer to `visibility` (a control field with
+ * a non-author writer — see `auth/cell_actions.ts`), never inside `data`.
  */
-export declare const CELL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS cell (\n\tid UUID PRIMARY KEY DEFAULT gen_random_uuid(),\n\tdata JSONB NOT NULL,\n\tvisibility cell_visibility NOT NULL DEFAULT 'private',\n\tpath TEXT,\n\trefs TEXT[],\n\tcreated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n\tupdated_at TIMESTAMPTZ,\n\tdeleted_at TIMESTAMPTZ,\n\tcreated_by UUID REFERENCES actor(id) ON DELETE SET NULL,\n\tupdated_by UUID REFERENCES actor(id) ON DELETE SET NULL\n)";
+export declare const CELL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS cell (\n\tid UUID PRIMARY KEY DEFAULT gen_random_uuid(),\n\tdata JSONB NOT NULL,\n\tkind TEXT,\n\tvisibility cell_visibility NOT NULL DEFAULT 'private',\n\tpath TEXT,\n\trefs TEXT[],\n\tparent_id UUID REFERENCES cell(id) ON DELETE SET NULL,\n\troot_id UUID REFERENCES cell(id) ON DELETE SET NULL,\n\tmoderation TEXT,\n\tcreated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n\tupdated_at TIMESTAMPTZ,\n\tdeleted_at TIMESTAMPTZ,\n\tcreated_by UUID REFERENCES actor(id) ON DELETE SET NULL,\n\tupdated_by UUID REFERENCES actor(id) ON DELETE SET NULL\n)";
 /**
  * Cell indexes — all active-only, partial on `deleted_at IS NULL`.
  *
@@ -71,9 +87,15 @@ export declare const CELL_SCHEMA = "\nCREATE TABLE IF NOT EXISTS cell (\n\tid UU
  * - `idx_cell_path_unique`: global `path` uniqueness + read-side path
  *   lookup. Partial on path + active so reused paths after soft delete are
  *   allowed.
- * - `idx_cell_data`: shape-driven queries (`data ? 'kind'`, `data @> ...`).
+ * - `idx_cell_kind`: the `cell_list` kind filter (`cell.kind = ?`) and
+ *   kind-scoped scans. Active-only.
+ * - `idx_cell_data`: shape-driven queries (`data @> ...`).
  * - `idx_cell_refs`: cells-by-fact discovery (cross-cell reference graph).
  * - `idx_cell_created_by`: "cells this actor created" queries.
+ * - `idx_cell_root`: flat-subtree feed/scope queries by governing root
+ *   (`cell.root_id = ?`). Active-only.
+ * - `idx_cell_moderation_pending`: the moderation queue — pending
+ *   contributions per governing root. Partial on `moderation = 'pending'`.
  *
  * Parent↔child membership and named relations live in sibling tables;
  * see `CELL_ITEM_INDEXES` / `CELL_FIELD_INDEXES` below.

package/dist/db/cell_ddl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_ddl.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_ddl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAGH,OAAO,KAAK,EAAC,SAAS,EAAE,kBAAkB,EAAC,MAAM,cAAc,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,oIAI1B,CAAC;AAER;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,WAAW,4aAYtB,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,MAAM,CAYtC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,0iBAc5B,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAW5C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,+RAO5B,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAE5C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,qSAO3B,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAG3C,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,4DAA6D,CAAC;AAE3F,uBAAuB;AACvB,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CAuB5C,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}
+{"version":3,"file":"cell_ddl.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_ddl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAGH,OAAO,KAAK,EAAC,SAAS,EAAE,kBAAkB,EAAC,MAAM,cAAc,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,oIAI1B,CAAC;AAER;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,WAAW,gkBAgBtB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,YAAY,EAAE,KAAK,CAAC,MAAM,CAkBtC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,0iBAc5B,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAW5C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,+RAO5B,CAAC;AAEH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAE5C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,qSAO3B,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAG3C,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,4DAA6D,CAAC;AAE3F,uBAAuB;AACvB,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,SAAS,CAuB5C,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,wBAAwB,aAAa,CAAC;AAEnD,wDAAwD;AACxD,eAAO,MAAM,iBAAiB,EAAE,kBAG/B,CAAC"}

package/dist/db/cell_ddl.js

@@ -65,14 +65,34 @@ END $$`;
  *
  * `path` is the global namespace axis (no tenant/hub scoping) — globally
  * unique on active rows via `idx_cell_path_unique`.
+ *
+ * `kind` is the capability / identity axis — a nullable top-level column
+ * (peer to `visibility` / `path`), **not** a field inside `data`. It is the
+ * discriminator a creation authorizer gates on (see `auth/cell_actions.ts`
+ * `CellCreateAuthorize`) and is **write-once**: set at INSERT and carried on
+ * no update path, so a cell's kind is fixed at birth. Content stays
+ * duck-typed in `data`; `kind` is a capability tag, not a content-type.
+ *
+ * `parent_id` / `root_id` are the **directory tree** (containment): `parent_id`
+ * is the immediate container (nullable self-FK; `NULL` = a root), `root_id` is
+ * the governing root denormalized for flat-subtree queries (`root_id =
+ * parent.root_id ?? parent.id`, so a root has `NULL`). Both are set once at
+ * create and immutable in v1 (carried on no update path). `moderation`
+ * (nullable text — `pending` / `approved` / `rejected`; `NULL` = unmoderated)
+ * is the approval-lifecycle marker, peer to `visibility` (a control field with
+ * a non-author writer — see `auth/cell_actions.ts`), never inside `data`.
  */
 export const CELL_SCHEMA = `
 CREATE TABLE IF NOT EXISTS cell (
 	id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
 	data JSONB NOT NULL,
+	kind TEXT,
 	visibility cell_visibility NOT NULL DEFAULT 'private',
 	path TEXT,
 	refs TEXT[],
+	parent_id UUID REFERENCES cell(id) ON DELETE SET NULL,
+	root_id UUID REFERENCES cell(id) ON DELETE SET NULL,
+	moderation TEXT,
 	created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
 	updated_at TIMESTAMPTZ,
 	deleted_at TIMESTAMPTZ,
@@ -86,9 +106,15 @@ CREATE TABLE IF NOT EXISTS cell (
  * - `idx_cell_path_unique`: global `path` uniqueness + read-side path
  *   lookup. Partial on path + active so reused paths after soft delete are
  *   allowed.
- * - `idx_cell_data`: shape-driven queries (`data ? 'kind'`, `data @> ...`).
+ * - `idx_cell_kind`: the `cell_list` kind filter (`cell.kind = ?`) and
+ *   kind-scoped scans. Active-only.
+ * - `idx_cell_data`: shape-driven queries (`data @> ...`).
  * - `idx_cell_refs`: cells-by-fact discovery (cross-cell reference graph).
  * - `idx_cell_created_by`: "cells this actor created" queries.
+ * - `idx_cell_root`: flat-subtree feed/scope queries by governing root
+ *   (`cell.root_id = ?`). Active-only.
+ * - `idx_cell_moderation_pending`: the moderation queue — pending
+ *   contributions per governing root. Partial on `moderation = 'pending'`.
  *
  * Parent↔child membership and named relations live in sibling tables;
  * see `CELL_ITEM_INDEXES` / `CELL_FIELD_INDEXES` below.
@@ -99,12 +125,18 @@ export const CELL_INDEXES = [
     `CREATE UNIQUE INDEX IF NOT EXISTS idx_cell_path_unique
 		ON cell(path)
 		WHERE path IS NOT NULL AND deleted_at IS NULL`,
+    `CREATE INDEX IF NOT EXISTS idx_cell_kind ON cell(kind)
+		WHERE deleted_at IS NULL`,
     `CREATE INDEX IF NOT EXISTS idx_cell_data ON cell USING gin(data)
 		WHERE deleted_at IS NULL`,
     `CREATE INDEX IF NOT EXISTS idx_cell_refs ON cell USING gin(refs)
 		WHERE refs IS NOT NULL AND deleted_at IS NULL`,
     `CREATE INDEX IF NOT EXISTS idx_cell_created_by ON cell(created_by)
 		WHERE deleted_at IS NULL`,
+    `CREATE INDEX IF NOT EXISTS idx_cell_root ON cell(root_id)
+		WHERE deleted_at IS NULL`,
+    `CREATE INDEX IF NOT EXISTS idx_cell_moderation_pending ON cell(root_id)
+		WHERE moderation = 'pending'`,
 ];
 /**
  * `cell_grant` table — resource-side ACL for cells. Each row admits a

package/dist/db/cell_queries.d.ts

@@ -42,9 +42,13 @@ import type { CellVisibility } from '../auth/cell_action_specs.js';
 export interface CellRow {
     id: Uuid;
     data: CellData;
+    kind: string | null;
     visibility: CellVisibility;
     path: string | null;
     refs: Array<FactHash> | null;
+    parent_id: Uuid | null;
+    root_id: Uuid | null;
+    moderation: string | null;
     created_at: Date;
     updated_at: Date | null;
     deleted_at: Date | null;
@@ -52,11 +56,23 @@ export interface CellRow {
     updated_by: Uuid | null;
     grant_count: number;
 }
-/** Input for `query_cell_create`. `refs` is derived from `data`. */
+/**
+ * Input for `query_cell_create`. `refs` is derived from `data`. `kind` is
+ * the write-once capability axis (`cell.kind` column) — set here at INSERT
+ * and absent from `CellUpdatePatch`, so it can never change post-create.
+ * `parent_id` / `root_id` / `moderation` are the directory-tree + lifecycle
+ * columns the handler derives (parent containment, governing root, the
+ * create-authorizer verdict) — likewise write-once / control-gated, never on
+ * `CellUpdatePatch`.
+ */
 export interface CellCreateQueryInput {
     data: Json;
+    kind?: string | null;
     visibility?: CellVisibility;
     path?: string | null;
+    parent_id?: Uuid | null;
+    root_id?: Uuid | null;
+    moderation?: string | null;
     created_by?: Uuid | null;
 }
 /**
@@ -153,15 +169,37 @@ export declare const query_cell_delete: (deps: QueryDeps, id: Uuid, options?: {
     deleted_by?: Uuid | null;
 }) => Promise<boolean>;
 /**
- * List cells whose `data.kind` matches the given value, newest first.
- * Uses the `idx_cell_data` GIN index (`data @> ...`).
+ * Transition a contribution's `moderation` marker (the `cell_moderate` verb's
+ * write). On `set_visibility_public` (an approval) it also flips `visibility`
+ * to `'public'` so the approved contribution goes live; a rejection leaves
+ * visibility untouched (stays private). `updated_at` / `updated_by` are stamped.
+ *
+ * `moderation` is deliberately **not** writable through `query_cell_update`
+ * (it's absent from `CellUpdatePatch`) — gating the transition on a dedicated
+ * query (with the manage-tier authority check in the handler) is what stops an
+ * author self-approving their own pending cell.
+ *
+ * @param deps - query deps
+ * @param id - cell id
+ * @param moderation - the terminal marker to write (`'approved'` | `'rejected'`)
+ * @param options - `set_visibility_public` flips visibility on approval; `updated_by` records the moderator
+ * @returns the updated row, or `null` when no active row matched (raced delete)
+ * @mutates `cell` - sets `moderation` (+ maybe `visibility`) on one row
+ */
+export declare const query_cell_set_moderation: (deps: QueryDeps, id: Uuid, moderation: string, options: {
+    set_visibility_public: boolean;
+    updated_by?: Uuid | null;
+}) => Promise<CellRow | null>;
+/**
+ * List active cells with the given `kind`, newest first. Uses the
+ * `idx_cell_kind` index (`cell.kind = ?`).
  *
  * @param deps - query deps
- * @param kind - `data.kind` value to match (e.g. `'collection'`, `'entry'`)
+ * @param kind - `cell.kind` value to match (e.g. `'collection'`, `'entry'`)
  * @param options - pagination
  * @returns matching active rows
  */
-export declare const query_cell_list_by_data_kind: (deps: QueryDeps, kind: string, options?: Pick<CellListOptions, "limit" | "offset">) => Promise<Array<CellRow>>;
+export declare const query_cell_list_by_kind: (deps: QueryDeps, kind: string, options?: Pick<CellListOptions, "limit" | "offset">) => Promise<Array<CellRow>>;
 /**
  * List active cells created by an actor, newest first. Backed by the
  * `idx_cell_created_by` partial index.
@@ -221,8 +259,8 @@ export declare const query_cell_list_by_creator: (deps: QueryDeps, actor_id: Uui
 export declare const query_cell_list: (deps: QueryDeps, params: CellListParams) => Promise<Array<CellRow>>;
 /** Parameters for `query_cell_list`. All filter dimensions are optional. */
 export interface CellListParams {
-    /** Match `data.kind = ?` via `data @> {"kind": ?}` (uses `idx_cell_data`). */
-    data_kind?: string;
+    /** Match `cell.kind = ?` (uses `idx_cell_kind`). */
+    kind?: string;
     /**
      * Match `cell.visibility = ?` directly on the top-level column.
      * Additional narrowing on top of the SQL-side auth visibility
@@ -240,6 +278,19 @@ export interface CellListParams {
      * literal matching.
      */
     path_prefix?: string;
+    /** Scope to a directory subtree by governing root (`cell.root_id = ?`, uses `idx_cell_root`). */
+    root_id?: Uuid;
+    /**
+     * Filter by moderation lifecycle marker (`'pending'` drives the mod queue via
+     * `idx_cell_moderation_pending`).
+     *
+     * Note: the visibility predicate still applies, so a `'pending'` (private)
+     * queue surfaces only to viewers it admits — admin / owner / grant. A
+     * non-admin container manager won't see pending children here until a
+     * manager-scoped visibility branch is added, so for now the queue is an admin
+     * surface (`cell_moderate` of a known id still works regardless).
+     */
+    moderation?: string;
     /**
      * Batch-fetch by id. The visibility predicate still runs, so callers
      * passing ids they can't view simply get fewer rows back. Order of
@@ -286,7 +337,7 @@ export interface CellListParams {
     /**
      * When `true`, narrow to cells admitting the caller via a
      * `cell_grant` row AND that the caller does not own. Authenticated
-     * only (`viewer_actor_id` must be set). Combine with `data_kind` /
+     * only (`viewer_actor_id` must be set). Combine with `kind` /
      * `path_prefix` etc. to scope further.
      */
     shared_with_caller_only?: boolean;

package/dist/db/cell_queries.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cell_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,0BAA0B,CAAC;AACnD,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAyB,KAAK,QAAQ,EAAC,MAAM,+BAA+B,CAAC;AAGpF,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,6BAA6B,CAAC;AAC1D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAEjE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,QAAQ,CAAC;IACf,UAAU,EAAE,cAAc,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACpB;AAgBD,oEAAoE;AACpE,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,OAAO,oBAAoB,KACzB,OAAO,CAAC,OAAO,CAgBjB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAC,KACnC,OAAO,CAAC,OAAO,GAAG,IAAI,CAUxB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,MAAM,MAAM,KACV,OAAO,CAAC,OAAO,GAAG,IAAI,CAQxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,KAAK,aAAa,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQxB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,OAAO,eAAe,KACpB,OAAO,CAAC,OAAO,GAAG,IAAI,CA4BxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAC,KAClC,OAAO,CAAC,OAAO,CAWjB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GACxC,MAAM,SAAS,EACf,MAAM,MAAM,EACZ,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CASvB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,SAAS,EACf,UAAU,IAAI,EACd,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQvB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,eAAe,GAC3B,MAAM,SAAS,EACf,QAAQ,cAAc,KACpB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CA0DxB,CAAC;AAiGF,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC9B,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,4EAA4E;IAC5E,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,0EAA0E;IAC1E,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB;;;;OAIG;IACH,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,aAAa,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACzD;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,yCAAyC;IACzC,QAAQ,CAAC,EAAE,YAAY,GAAG,YAAY,CAAC;IACvC,sCAAsC;IACtC,eAAe,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,iBAAiB;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B"}
+{"version":3,"file":"cell_queries.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/db/cell_queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,0BAA0B,CAAC;AACnD,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAyB,KAAK,QAAQ,EAAC,MAAM,+BAA+B,CAAC;AAGpF,OAAO,KAAK,EAAC,QAAQ,EAAC,MAAM,6BAA6B,CAAC;AAC1D,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,8BAA8B,CAAC;AAEjE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,IAAI,CAAC;IACT,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,cAAc,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;CACpB;AAgBD;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,IAAI,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC/B,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,OAAO,oBAAoB,KACzB,OAAO,CAAC,OAAO,CAoBjB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAAC,KACnC,OAAO,CAAC,OAAO,GAAG,IAAI,CAUxB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAClC,MAAM,SAAS,EACf,MAAM,MAAM,KACV,OAAO,CAAC,OAAO,GAAG,IAAI,CAQxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,GAChC,MAAM,SAAS,EACf,KAAK,aAAa,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQxB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,OAAO,eAAe,KACpB,OAAO,CAAC,OAAO,GAAG,IAAI,CA4BxB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,GAC7B,MAAM,SAAS,EACf,IAAI,IAAI,EACR,UAAU;IAAC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAC,KAClC,OAAO,CAAC,OAAO,CAWjB,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,yBAAyB,GACrC,MAAM,SAAS,EACf,IAAI,IAAI,EACR,YAAY,MAAM,EAClB,SAAS;IAAC,qBAAqB,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,IAAI,GAAG,IAAI,CAAA;CAAC,KACjE,OAAO,CAAC,OAAO,GAAG,IAAI,CAYxB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GACnC,MAAM,SAAS,EACf,MAAM,MAAM,EACZ,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CASvB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACtC,MAAM,SAAS,EACf,UAAU,IAAI,EACd,UAAU,IAAI,CAAC,eAAe,EAAE,OAAO,GAAG,QAAQ,CAAC,KACjD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAQvB,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,eAAO,MAAM,eAAe,GAC3B,MAAM,SAAS,EACf,QAAQ,cAAc,KACpB,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CA4DxB,CAAC;AAqGF,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC9B,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,4EAA4E;IAC5E,GAAG,CAAC,EAAE,QAAQ,CAAC;IACf,0EAA0E;IAC1E,UAAU,CAAC,EAAE,IAAI,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,OAAO,CAAC,EAAE,IAAI,CAAC;IACf;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;OAMG;IACH,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAClB;;;;OAIG;IACH,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD;;;;OAIG;IACH,2BAA2B,CAAC,EAAE,aAAa,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACzD;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,yCAAyC;IACzC,QAAQ,CAAC,EAAE,YAAY,GAAG,YAAY,CAAC;IACvC,sCAAsC;IACtC,eAAe,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,iBAAiB;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B"}

package/dist/db/cell_queries.js

@@ -51,13 +51,17 @@ const grant_count_projection = (cell_alias) => `(SELECT COUNT(*)::int FROM cell_
 export const query_cell_create = async (deps, input) => {
     const refs = derive_refs(input.data);
     const row = await deps.db.query_one(`INSERT INTO cell
-		   (data, visibility, path, refs, created_by)
-		 VALUES ($1::jsonb, COALESCE($2::cell_visibility, 'private'::cell_visibility), $3, $4::text[], $5)
+		   (data, kind, visibility, path, refs, parent_id, root_id, moderation, created_by)
+		 VALUES ($1::jsonb, $2, COALESCE($3::cell_visibility, 'private'::cell_visibility), $4, $5::text[], $6, $7, $8, $9)
 		 RETURNING *, ${grant_count_projection('cell')}`, [
         JSON.stringify(input.data),
+        input.kind ?? null,
         input.visibility ?? null,
         input.path ?? null,
         refs,
+        input.parent_id ?? null,
+        input.root_id ?? null,
+        input.moderation ?? null,
         input.created_by ?? null,
     ]);
     return assert_row(row, 'INSERT INTO cell');
@@ -171,20 +175,48 @@ export const query_cell_delete = async (deps, id, options) => {
     return row !== undefined;
 };
 /**
- * List cells whose `data.kind` matches the given value, newest first.
- * Uses the `idx_cell_data` GIN index (`data @> ...`).
+ * Transition a contribution's `moderation` marker (the `cell_moderate` verb's
+ * write). On `set_visibility_public` (an approval) it also flips `visibility`
+ * to `'public'` so the approved contribution goes live; a rejection leaves
+ * visibility untouched (stays private). `updated_at` / `updated_by` are stamped.
+ *
+ * `moderation` is deliberately **not** writable through `query_cell_update`
+ * (it's absent from `CellUpdatePatch`) — gating the transition on a dedicated
+ * query (with the manage-tier authority check in the handler) is what stops an
+ * author self-approving their own pending cell.
+ *
+ * @param deps - query deps
+ * @param id - cell id
+ * @param moderation - the terminal marker to write (`'approved'` | `'rejected'`)
+ * @param options - `set_visibility_public` flips visibility on approval; `updated_by` records the moderator
+ * @returns the updated row, or `null` when no active row matched (raced delete)
+ * @mutates `cell` - sets `moderation` (+ maybe `visibility`) on one row
+ */
+export const query_cell_set_moderation = async (deps, id, moderation, options) => {
+    const row = await deps.db.query_one(`UPDATE cell SET
+		   moderation = $2,
+		   visibility = CASE WHEN $3::bool THEN 'public'::cell_visibility ELSE visibility END,
+		   updated_by = $4,
+		   updated_at = NOW()
+		 WHERE id = $1 AND deleted_at IS NULL
+		 RETURNING *, ${grant_count_projection('cell')}`, [id, moderation, options.set_visibility_public, options.updated_by ?? null]);
+    return row ?? null;
+};
+/**
+ * List active cells with the given `kind`, newest first. Uses the
+ * `idx_cell_kind` index (`cell.kind = ?`).
  *
  * @param deps - query deps
- * @param kind - `data.kind` value to match (e.g. `'collection'`, `'entry'`)
+ * @param kind - `cell.kind` value to match (e.g. `'collection'`, `'entry'`)
  * @param options - pagination
  * @returns matching active rows
  */
-export const query_cell_list_by_data_kind = async (deps, kind, options) => deps.db.query(`SELECT *, ${grant_count_projection('cell')}
+export const query_cell_list_by_kind = async (deps, kind, options) => deps.db.query(`SELECT *, ${grant_count_projection('cell')}
 		 FROM cell
-		 WHERE data @> $1::jsonb
+		 WHERE kind = $1
 		   AND deleted_at IS NULL
 		 ORDER BY created_at DESC
-		 LIMIT $2 OFFSET $3`, [JSON.stringify({ kind }), options?.limit ?? null, options?.offset ?? 0]);
+		 LIMIT $2 OFFSET $3`, [kind, options?.limit ?? null, options?.offset ?? 0]);
 /**
  * List active cells created by an actor, newest first. Backed by the
  * `idx_cell_created_by` partial index.
@@ -271,7 +303,7 @@ export const query_cell_list = async (deps, params) => {
     // supplied wildcards (`%`, `_`, `\`) match literally — Postgres 11+ has
     // the function and pglite/PG 16 supports it.
     //
-    // Two SQL shapes share the same 14-param positional layout:
+    // Two SQL shapes share the same 16-param positional layout:
     //
     // - `shared_with_caller_only: false` — cell-driven scan with the
     //   visibility predicate (admin / public / owner / grant-admits).
@@ -284,7 +316,7 @@ export const query_cell_list = async (deps, params) => {
         : build_general_sql(order_column, order_direction);
     return deps.db.query(sql, [
         params.include_deleted === true,
-        params.data_kind ?? null,
+        params.kind ?? null,
         params.ref ?? null,
         params.created_by ?? null,
         params.path_prefix ?? null,
@@ -297,6 +329,8 @@ export const query_cell_list = async (deps, params) => {
         role_grant_roles,
         role_grant_scope_ids,
         params.visibility ?? null,
+        params.root_id ?? null,
+        params.moderation ?? null,
     ]);
 };
 /**
@@ -333,12 +367,14 @@ const CALLER_ROLE_GRANTS_CTE = `WITH caller_role_grants AS (
 const build_general_sql = (order_column, order_direction) => `${CALLER_ROLE_GRANTS_CTE}
 	 SELECT c.*, ${grant_count_projection('c')} FROM cell c
 	 WHERE ($1::bool OR c.deleted_at IS NULL)
-	   AND ($2::text IS NULL OR c.data @> jsonb_build_object('kind', $2::text))
+	   AND ($2::text IS NULL OR c.kind = $2::text)
 	   AND ($14::cell_visibility IS NULL OR c.visibility = $14::cell_visibility)
 	   AND ($3::text IS NULL OR c.refs @> ARRAY[$3]::text[])
 	   AND ($4::uuid IS NULL OR c.created_by = $4)
 	   AND ($5::text IS NULL OR starts_with(c.path, $5))
 	   AND ($10::uuid[] IS NULL OR c.id = ANY($10))
+	   AND ($15::uuid IS NULL OR c.root_id = $15)
+	   AND ($16::text IS NULL OR c.moderation = $16::text)
 	   AND (
 	     $6::bool
 	     OR c.visibility = 'public'
@@ -369,12 +405,14 @@ const build_general_sql = (order_column, order_direction) => `${CALLER_ROLE_GRAN
 const build_shared_with_sql = (order_column, order_direction) => `${CALLER_ROLE_GRANTS_CTE}
 	 SELECT c.*, ${grant_count_projection('c')} FROM cell c
 	 WHERE ($1::bool OR c.deleted_at IS NULL)
-	   AND ($2::text IS NULL OR c.data @> jsonb_build_object('kind', $2::text))
+	   AND ($2::text IS NULL OR c.kind = $2::text)
 	   AND ($14::cell_visibility IS NULL OR c.visibility = $14::cell_visibility)
 	   AND ($3::text IS NULL OR c.refs @> ARRAY[$3]::text[])
 	   AND ($4::uuid IS NULL OR c.created_by = $4)
 	   AND ($5::text IS NULL OR starts_with(c.path, $5))
 	   AND ($10::uuid[] IS NULL OR c.id = ANY($10))
+	   AND ($15::uuid IS NULL OR c.root_id = $15)
+	   AND ($16::text IS NULL OR c.moderation = $16::text)
 	   AND $7::uuid IS NOT NULL
 	   AND c.created_by IS DISTINCT FROM $7
 	   AND c.id IN (

package/dist/testing/CLAUDE.md

@@ -897,8 +897,9 @@ source of truth for wire-shape conformance.
 
 - `testing/cross_backend/capabilities.ts` — `BackendCapabilities` vocabulary
   (the **gating** flags `ws` / `sse` / `cell_crud` / `cell_relations` /
-  `account_lifecycle` / `fact_serving` / `ready` / `account_status` /
-  `oversized_reject_closes_connection` / `peer_request` — each has a `test_if`
+  `cell_gated_create` / `account_lifecycle` / `fact_serving` / `ready` /
+  `account_status` / `oversized_reject_closes_connection` / `peer_request` —
+  each has a `test_if`
   reader; `peer_request` (server-initiated requests — the ActionPeer
   `peer/ping` round-trip) is `true` for both the Rust spine and the TS spine
   (`BackendWebsocketTransport.request_connection`); `ts_default_capabilities`
@@ -914,6 +915,15 @@ source of truth for wire-shape conformance.
   parity suite — both `true` on every backend that live-mounts the full cell
   surface (TS spine binary, in-process app, Rust stub). A backend mounting only
   plain CRUD would declare `cell_crud: true, cell_relations: false`.
+  `cell_gated_create` gates `describe_cell_gated_create_cross_tests` +
+  `describe_cell_moderate_cross_tests` (the parent-aware-creation-authorizer +
+  `cell_moderate` parity proofs); unlike `cell_crud`/`cell_relations`
+  it is **cross-only** (`false` in-process) — `true` only on the reference
+  spine binaries that live-mount the `test_cell_gated_create_authorize` policy
+  (the TS spine `full_spine_mount` + the Rust `testing_spine_stub`), since the
+  authorizer _behavior_ adds no method/wire shape and so the schema + manifest
+  parity gates are blind to an authorizer divergence (the `cell_moderate`
+  _verb_ it pairs with is on the manifest, separately gated).
   `account_lifecycle` gates `describe_account_lifecycle_cross_tests` (the
   `account_delete` / `account_undelete` / `account_purge` parity suite); unlike
   cells those verbs **are** on the declared surface (in `create_admin_actions`,
@@ -1154,7 +1164,7 @@ the stream \_can't* open on a spine without SSE — a self-cleaning tripwire for
 the spine that should grow it, distinct from the consumer-legit capability
 skip the shared suite emits.
 
-### `cross_backend/cell_crud.ts` + `cell_relations.ts` — cell parity suites
+### `cross_backend/cell_crud.ts` + `cell_relations.ts` + `cell_gated_create.ts` — cell parity suites
 
 The cell-layer parity coverage is split across two sibling suites. Cells
 can't ride the generic `describe_rpc_round_trip_tests` (stateful verbs need a
@@ -1189,10 +1199,30 @@ backdoor, cell).
   holder who can `cell_get` still gets the IDOR 404). Only **actor-shaped**
   grants are exercised — role-shaped principals need a closed role registry the
   Rust spine deliberately lacks.
-
-Both gate `true` on TS + Rust (cells run on both, no `.skip`). Cross-process
-wiring is `src/test/cross_backend/cell.cross.test.ts` (both suites); the
-in-process legs (plain `gro test`) are `src/test/auth/cell_crud_parity.db.test.ts`
+- **`describe_cell_gated_create_cross_tests`** + **`describe_cell_moderate_cross_tests`**
+  (gate on `capabilities.cell_gated_create`, **cross-only**) — the parent-aware
+  cell-creation authorizer (`CellCreateAuthorize`, **directory model**) +
+  the `cell_moderate` verb parity proofs. Both spines mount the same
+  `test_cell_gated_create_authorize` policy: a `kind: 'space'` **root** is
+  admin-only (a non-admin → **403** `cell_create_forbidden`); a **contribution**
+  under a space is gated by the root's `data.policy[kind] = {min_role,
+moderation_required}`, with `moderation` set per the verdict (`pending`+private
+  vs `approved`+author-visibility); a **hidden** parent **404**-masks vs a
+  **visible** one **403**s; plain parentless creates stay open. The moderate
+  suite then proves the `pending → approved | rejected` transition: an admin
+  (root manager) approves → public, the **author** self-approve → 403
+  (anti-self-approval), a non-viewer → 404, reject → stays private. The
+  authorizer _behavior_ adds no method/wire shape, so schema + manifest parity
+  are **blind** to a divergence — these are the only gates that catch one (the
+  `cell_moderate` verb itself is manifest-covered). In-process hook coverage is
+  the standalone `auth/cell_create_authorize.db.test.ts` (these cross suites skip
+  in-process, where the default app mounts no authorizer).
+
+`cell_crud` / `cell_relations` gate `true` on TS + Rust (cells run on both, no
+`.skip`); `cell_gated_create` is cross-only (the policy is a spine-binary
+fixture). Cross-process wiring is `src/test/cross_backend/cell.cross.test.ts`
+(all the cell suites); the in-process legs (plain `gro test`) for crud/relations
+are `src/test/auth/cell_crud_parity.db.test.ts`
 
 - `cell_relations_parity.db.test.ts`, sharing the full-surface
   `create_cell_parity_setup` (`cell_parity_helpers.ts`) which mounts every cell