@jini-ai/cms 0.1.0

package/dist/content-types/index-provisioning.js

@@ -0,0 +1,133 @@
+import { createHash } from "node:crypto";
+import { InvalidFieldKindError, InvalidFieldNameGrammarError, InvalidKeyGrammarError } from "./errors.js";
+import { CONTENT_TYPE_FIELD_KINDS, isContentTypeFieldKind } from "./types.js";
+/**
+ * @file CIC U-001 — the `kind`->`CAST` fixed lookup table, the identifier grammar
+ * gate, the workspace-scoped queryable-index naming scheme, and the before/after index-transition
+ * resolver (grammar-and-workspace-scoping folds).
+ *
+ * Purpose:
+ * THIS IS THE HIGHEST-SECURITY-SEVERITY MODULE IN THE 5-PACKAGE PIPELINE — every value that ends
+ * up inside a `CREATE INDEX ... CAST(json_extract(fields,'$.ext.{ns}.{field}') AS {type})`
+ * statement is produced here, and only here:
+ *   - `mapFieldKindToCast` never interpolates an operator-supplied string — it is a fixed,
+ *     hardcoded 5-entry table (U-001-B1).
+ *   - `validateIdentifierGrammar`/`buildQueryableFieldIndexName` gate every `key`/field name
+ *     through `^[a-z][a-z0-9_]{0,63}$` before it can reach an index-name segment or JSON-path
+ *     literal (U-001-B2), and join grammar-gated segments with `/` — a delimiter outside the
+ *     grammar's own alphabet `[a-z0-9_]`, closing the namespace-injectivity collision class
+ *     (U-001-B3) — and fold in a workspace-derived segment so two workspaces defining the same
+ *     `(key, field)` pair never collide on index identity.
+ *
+ * How it relates to the project:
+ * `write-service.ts`'s `registerContentType`/`updateContentTypeFields` call
+ * `resolveFieldIndexTransition` once per field (never two independent kind/queryable branches —
+ * CIC U-003-B1) and hand the result to the injected `indexProvisioner` port, which is the only
+ * thing that ever issues the real `CREATE INDEX`/`DROP INDEX` DDL (this module only decides what
+ * to build, never executes DDL itself).
+ *
+ * Architectural role:
+ * `features/content-types` domain logic. No dependencies beyond `node:crypto` (workspace-segment
+ * hashing) and this package's own `errors.ts`/`types.ts`.
+ */
+/**
+ * U-001-B2 — the closed identifier grammar every `content_types.key` and field name must satisfy,
+ * as a pattern string so the agent-facing JSON Schemas in `agent-tools.ts` can publish the very
+ * same grammar instead of restating it. A cross-cutting single-source-of-truth governance rule makes this grammar load-bearing for DDL
+ * safety, so it must have exactly one definition; {@link IDENTIFIER_GRAMMAR} is compiled from this
+ * string rather than written twice.
+ */
+export const IDENTIFIER_GRAMMAR_PATTERN = "^[a-z][a-z0-9_]{0,63}$";
+/** U-001-B2 — the closed identifier grammar every `content_types.key` and field name must satisfy. */
+const IDENTIFIER_GRAMMAR = new RegExp(IDENTIFIER_GRAMMAR_PATTERN);
+/**
+ * Structural grammar gate for a `content_types.key` or field name (U-001-B2).
+ *
+ * @complexity O(n) in the string's length (regex match), bounded at 64 chars.
+ * @overallScore 100
+ */
+export function validateIdentifierGrammar(value) {
+    return IDENTIFIER_GRAMMAR.test(value);
+}
+/**
+ * U-001-B1 — the fixed, hardcoded `kind` -> SQL `CAST` type-token table. Every value here is a
+ * plain uppercase SQL type token with no quotes/parens/whitespace; never built by concatenation.
+ */
+const KIND_TO_CAST_LITERAL = {
+    text: "TEXT",
+    integer: "INTEGER",
+    real: "REAL",
+    boolean: "BOOLEAN",
+    datetime: "TEXT",
+};
+/**
+ * Maps a closed-enum field `kind` to its fixed `CAST(... AS {type})` type token. Throws
+ * {@link InvalidFieldKindError} for anything not exactly one of the 5 enum values — this is a
+ * lookup, never a template, so an adversarial payload can never reach the returned string
+ * (U-001-B1).
+ *
+ * @complexity O(1) — a fixed-size object lookup.
+ * @overallScore 100
+ */
+export function mapFieldKindToCast(kind) {
+    if (!isContentTypeFieldKind(kind)) {
+        throw new InvalidFieldKindError(`'${String(kind)}' is not one of the closed field-kind enum (${CONTENT_TYPE_FIELD_KINDS.join("|")}) — U-001-B1`);
+    }
+    return KIND_TO_CAST_LITERAL[kind];
+}
+/**
+ * Derives a grammar-safe, workspace-scoped index-name segment from an arbitrary `workspaceId`
+ * (which itself is not grammar-constrained — e.g. `"ws-1"` contains a hyphen). Hashing collapses
+ * it to a fixed `[0-9a-f]` alphabet (a strict subset of the identifier grammar's `[a-z0-9_]`)
+ * prefixed with a letter so the segment independently satisfies {@link validateIdentifierGrammar}.
+ *
+ * @complexity O(1) — a fixed-length SHA-256 digest.
+ * @overallScore 100
+ */
+function workspaceIndexSegment(workspaceId) {
+    const digest = createHash("sha256").update(workspaceId).digest("hex").slice(0, 16);
+    return `w${digest}`;
+}
+/**
+ * Builds the workspace-scoped queryable-field index identity for `(workspaceId, contentTypeKey,
+ * fieldName)`. Both `contentTypeKey` and `fieldName` are grammar-gated first — a failure throws
+ * before any index name is produced (U-001-B2). Segments are joined with `/`, a delimiter outside
+ * the grammar's own alphabet `[a-z0-9_]`, so distinct `(key, name)` pairs can never collide by
+ * boundary-shifting (U-001-B3, e.g. `("a_b","c")` vs `("a","b_c")`).
+ *
+ * @complexity O(1) plus two grammar checks and one SHA-256 hash.
+ * @overallScore 100
+ */
+export function buildQueryableFieldIndexName(params) {
+    if (!validateIdentifierGrammar(params.contentTypeKey)) {
+        throw new InvalidKeyGrammarError(`content-type key '${params.contentTypeKey}' fails the identifier grammar gate ^[a-z][a-z0-9_]{0,63}$ (U-001-B2)`);
+    }
+    if (!validateIdentifierGrammar(params.fieldName)) {
+        throw new InvalidFieldNameGrammarError(`field name '${params.fieldName}' fails the identifier grammar gate ^[a-z][a-z0-9_]{0,63}$ (U-001-B2)`);
+    }
+    return `q/${workspaceIndexSegment(params.workspaceId)}/${params.contentTypeKey}/${params.fieldName}`;
+}
+/**
+ * CIC U-003-B1 — resolves a single field's index transition from ONE before/after comparison of
+ * its `(kind, queryable)` pair, never from two independent branches that each assume the other
+ * property is unchanged (the bug class this closes: a field whose `kind` AND `queryable` both
+ * change in the same call must still resolve correctly — REQ-30(b)).
+ *
+ * @complexity O(1) — four comparisons, one of four fixed outcomes.
+ * @overallScore 100
+ */
+export function resolveFieldIndexTransition(params) {
+    const beforeQueryable = params.before?.queryable ?? false;
+    const afterQueryable = params.after?.queryable ?? false;
+    if (!beforeQueryable && !afterQueryable)
+        return { action: "none" };
+    if (beforeQueryable && !afterQueryable)
+        return { action: "teardown" };
+    if (!beforeQueryable && afterQueryable)
+        return { action: "provision", newKind: params.after.kind };
+    if (params.before.kind !== params.after.kind) {
+        return { action: "reprovision", newKind: params.after.kind };
+    }
+    return { action: "none" };
+}
+//# sourceMappingURL=index-provisioning.js.map

package/dist/content-types/index-provisioning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-provisioning.js","sourceRoot":"","sources":["../../src/content-types/index-provisioning.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC1G,OAAO,EAAE,wBAAwB,EAA6B,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzG;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,wBAAwB,CAAC;AAEnE,sGAAsG;AACtG,MAAM,kBAAkB,GAAG,IAAI,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAElE;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAa;IACrD,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,oBAAoB,GAAyC;IACjE,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,MAAM;CACjB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAA0B;IAC3D,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,qBAAqB,CAC7B,IAAI,MAAM,CAAC,IAAI,CAAC,+CAA+C,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAChH,CAAC;IACJ,CAAC;IACD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAAC,WAAmB;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnF,OAAO,IAAI,MAAM,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,MAI5C;IACC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,sBAAsB,CAC9B,qBAAqB,MAAM,CAAC,cAAc,uEAAuE,CAClH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,4BAA4B,CACpC,eAAe,MAAM,CAAC,SAAS,uEAAuE,CACvG,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,qBAAqB,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;AACvG,CAAC;AAWD;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAG3C;IACC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,IAAI,KAAK,CAAC;IAC1D,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,IAAI,KAAK,CAAC;IAExD,IAAI,CAAC,eAAe,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACnE,IAAI,eAAe,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACtE,IAAI,CAAC,eAAe,IAAI,cAAc;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,KAAM,CAAC,IAAI,EAAE,CAAC;IACpG,IAAI,MAAM,CAAC,MAAO,CAAC,IAAI,KAAK,MAAM,CAAC,KAAM,CAAC,IAAI,EAAE,CAAC;QAC/C,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,KAAM,CAAC,IAAI,EAAE,CAAC;IAChE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC"}

package/dist/content-types/index.d.ts

@@ -0,0 +1,63 @@
+/**
+ * @file Public surface (barrel) for the `content-types` library.
+ *
+ * A module's public contract is its `index.ts` — deep imports from outside this
+ * directory should go through here.
+ *
+ * See `../entries/index.js`'s header for why these two ship as separate subpaths rather than one.
+ */
+export type { ContentTypeFieldKind, ContentTypeFieldDef, ContentTypeStatus, ContentTypeRecord, ActorPrincipalKind, ActorIdentityInput, Result, } from "./types.js";
+export { CONTENT_TYPE_FIELD_KINDS, isContentTypeFieldKind } from "./types.js";
+export type { ContentTypeListPort } from "./list.js";
+export { listContentTypes } from "./list.js";
+export { parseContentTypeFieldDefs } from "./field-defs.js";
+/**
+ * These are exported as **values**, not types: callers catch them with `instanceof`. Because this
+ * barrel re-exports rather than redeclares, there is exactly one class object per error across
+ * every consumer. `ForbiddenError`/`VersionConflictError`/`ContentTypeNotFoundError` are this
+ * module's own and are deliberately distinct from the same-named classes on `../entries/index.js`
+ * and `../core/commands/command.js` — a consumer must catch the one it actually called into.
+ */
+export { ForbiddenError, InvalidKeyGrammarError, ReservedContentTypeKeyError, InvalidFieldNameGrammarError, InvalidFieldKindError, InvalidFieldShapeError, QueryableFieldCapExceededError, VersionConflictError, ContentTypeNotFoundError, ValidationError, ContentTypeLifecycleError, CleanupNotEligibleError, } from "./errors.js";
+/**
+ * The queryable-field index machinery. `IDENTIFIER_GRAMMAR_PATTERN` is exported because it is the
+ * single definition of the identifier grammar — the published agent-tool schemas reference it
+ * rather than restating it, and a consumer validating input ahead of a call must reach the same
+ * one. `mapFieldKindToCast`/`buildQueryableFieldIndexName` are what a host's own DDL provisioner
+ * needs in order to generate the same index names this module expects to find.
+ */
+export type { FieldIndexState, FieldIndexTransition } from "./index-provisioning.js";
+export { IDENTIFIER_GRAMMAR_PATTERN, validateIdentifierGrammar, mapFieldKindToCast, buildQueryableFieldIndexName, resolveFieldIndexTransition, } from "./index-provisioning.js";
+export type { AuthorizeFn, ContentTypeRevisionInput, ContentTypeRepoPort, IndexProvisionerPort, OutboxPort, WatermarkPort, ContentTypeWriteServiceDeps, RegisterContentTypeRequired, UpdateContentTypeFieldsRequired, } from "./write-service.js";
+export { registerContentType, updateContentTypeFields } from "./write-service.js";
+export type { LifecycleTransitionInput, DeprecateContentTypeRequired, ReactivateContentTypeRequired, TeardownIndexProvisionerPort, TombstoneContentTypeRequired, } from "./lifecycle.js";
+export { deprecateContentType, reactivateContentType, tombstoneContentType, } from "./lifecycle.js";
+export type { ContentTypeLifecycleOp, ContentTypeLifecycleHandler, LifecycleDispatchDeps, LifecycleDispatchInput, } from "./lifecycle-dispatch.js";
+export { CONTENT_TYPE_LIFECYCLE_OP_NAMES, CONTENT_TYPE_LIFECYCLE_OPS, parseContentTypeLifecycleOp, } from "./lifecycle-dispatch.js";
+/**
+ * Cleanup is the permanent-removal path for a tombstoned type. Both halves are gateway-mediated:
+ * this module never performs the destructive removal on its own authority, it plans and then
+ * forwards a redeemed confirmation token.
+ */
+export type { CleanupEligibilityCheckRepoPort, PlanCleanupGatewayPort, PlanCleanupRequired, ExecuteCleanupGatewayPort, CleanupRemovalRepoPort, ExecuteCleanupRequired, } from "./cleanup.js";
+export { planCleanup, executeCleanup } from "./cleanup.js";
+/**
+ * The in-memory repository and the no-op index provisioner. The latter is the correct
+ * `IndexProvisionerPort` for any store with no DDL to run (an in-memory or document backend), not
+ * merely a test double.
+ */
+export { InMemoryContentTypeRepo, NoopContentTypeIndexProvisioner, toContentTypeOutbox, } from "./repo.memory.js";
+/** The agent-tool surface for this domain (see `agent-tools.ts` for what is deliberately omitted). */
+export { contentTypesAgentToolCatalog, type AgentToolDefinition as ContentTypesAgentToolDefinition, type AgentToolSideEffect as ContentTypesAgentToolSideEffect, type AgentToolActorClassRule as ContentTypesAgentToolActorClassRule, } from "./agent-tools.js";
+/**
+ * The agent-tool wiring for this domain.
+ *
+ * `ContentTypesToolDeps` is declared structurally rather than derived from any host's
+ * request-scoped dependency bag, which is what lets a host satisfy it by passing whatever object it
+ * already has — the shape is the contract, so no host type needs to be named here.
+ */
+export { buildContentTypesRegistrations, contentTypesDerivedRisk, type ContentTypesToolDeps, } from "./tool-registrations.js";
+/**
+ * There is no SQLite adapter export here, deliberately — same reason as `../entries/index.js`.
+ */
+//# sourceMappingURL=index.d.ts.map

package/dist/content-types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/content-types/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,MAAM,GACP,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAE9E,YAAY,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAE5D;;;;;;GAMG;AACH,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,2BAA2B,EAC3B,4BAA4B,EAC5B,qBAAqB,EACrB,sBAAsB,EACtB,8BAA8B,EAC9B,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAErB;;;;;;GAMG;AACH,YAAY,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,kBAAkB,EAClB,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,yBAAyB,CAAC;AAEjC,YAAY,EACV,WAAW,EACX,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,UAAU,EACV,aAAa,EACb,2BAA2B,EAC3B,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAElF,YAAY,EACV,wBAAwB,EACxB,4BAA4B,EAC5B,6BAA6B,EAC7B,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,sBAAsB,EACtB,2BAA2B,EAC3B,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,YAAY,EACV,+BAA+B,EAC/B,sBAAsB,EACtB,mBAAmB,EACnB,yBAAyB,EACzB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE3D;;;;GAIG;AACH,OAAO,EACL,uBAAuB,EACvB,+BAA+B,EAC/B,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,sGAAsG;AACtG,OAAO,EACL,4BAA4B,EAC5B,KAAK,mBAAmB,IAAI,+BAA+B,EAC3D,KAAK,mBAAmB,IAAI,+BAA+B,EAC3D,KAAK,uBAAuB,IAAI,mCAAmC,GACpE,MAAM,kBAAkB,CAAC;AAE1B;;;;;;GAMG;AACH,OAAO,EACL,8BAA8B,EAC9B,uBAAuB,EACvB,KAAK,oBAAoB,GAC1B,MAAM,yBAAyB,CAAC;AAEjC;;GAEG"}

package/dist/content-types/index.js

@@ -0,0 +1,36 @@
+export { CONTENT_TYPE_FIELD_KINDS, isContentTypeFieldKind } from "./types.js";
+export { listContentTypes } from "./list.js";
+export { parseContentTypeFieldDefs } from "./field-defs.js";
+/**
+ * These are exported as **values**, not types: callers catch them with `instanceof`. Because this
+ * barrel re-exports rather than redeclares, there is exactly one class object per error across
+ * every consumer. `ForbiddenError`/`VersionConflictError`/`ContentTypeNotFoundError` are this
+ * module's own and are deliberately distinct from the same-named classes on `../entries/index.js`
+ * and `../core/commands/command.js` — a consumer must catch the one it actually called into.
+ */
+export { ForbiddenError, InvalidKeyGrammarError, ReservedContentTypeKeyError, InvalidFieldNameGrammarError, InvalidFieldKindError, InvalidFieldShapeError, QueryableFieldCapExceededError, VersionConflictError, ContentTypeNotFoundError, ValidationError, ContentTypeLifecycleError, CleanupNotEligibleError, } from "./errors.js";
+export { IDENTIFIER_GRAMMAR_PATTERN, validateIdentifierGrammar, mapFieldKindToCast, buildQueryableFieldIndexName, resolveFieldIndexTransition, } from "./index-provisioning.js";
+export { registerContentType, updateContentTypeFields } from "./write-service.js";
+export { deprecateContentType, reactivateContentType, tombstoneContentType, } from "./lifecycle.js";
+export { CONTENT_TYPE_LIFECYCLE_OP_NAMES, CONTENT_TYPE_LIFECYCLE_OPS, parseContentTypeLifecycleOp, } from "./lifecycle-dispatch.js";
+export { planCleanup, executeCleanup } from "./cleanup.js";
+/**
+ * The in-memory repository and the no-op index provisioner. The latter is the correct
+ * `IndexProvisionerPort` for any store with no DDL to run (an in-memory or document backend), not
+ * merely a test double.
+ */
+export { InMemoryContentTypeRepo, NoopContentTypeIndexProvisioner, toContentTypeOutbox, } from "./repo.memory.js";
+/** The agent-tool surface for this domain (see `agent-tools.ts` for what is deliberately omitted). */
+export { contentTypesAgentToolCatalog, } from "./agent-tools.js";
+/**
+ * The agent-tool wiring for this domain.
+ *
+ * `ContentTypesToolDeps` is declared structurally rather than derived from any host's
+ * request-scoped dependency bag, which is what lets a host satisfy it by passing whatever object it
+ * already has — the shape is the contract, so no host type needs to be named here.
+ */
+export { buildContentTypesRegistrations, contentTypesDerivedRisk, } from "./tool-registrations.js";
+/**
+ * There is no SQLite adapter export here, deliberately — same reason as `../entries/index.js`.
+ */
+//# sourceMappingURL=index.js.map

package/dist/content-types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/content-types/index.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAG9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAE5D;;;;;;GAMG;AACH,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,2BAA2B,EAC3B,4BAA4B,EAC5B,qBAAqB,EACrB,sBAAsB,EACtB,8BAA8B,EAC9B,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAUrB,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,kBAAkB,EAClB,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,yBAAyB,CAAC;AAajC,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AASlF,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAQxB,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,yBAAyB,CAAC;AAejC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE3D;;;;GAIG;AACH,OAAO,EACL,uBAAuB,EACvB,+BAA+B,EAC/B,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,sGAAsG;AACtG,OAAO,EACL,4BAA4B,GAI7B,MAAM,kBAAkB,CAAC;AAE1B;;;;;;GAMG;AACH,OAAO,EACL,8BAA8B,EAC9B,uBAAuB,GAExB,MAAM,yBAAyB,CAAC;AAEjC;;GAEG"}

package/dist/content-types/lifecycle-dispatch.d.ts

@@ -0,0 +1,38 @@
+import type { ClockPort } from "../core/ports.js";
+import type { AuthorizeFn, ContentTypeRepoPort, OutboxPort } from "./write-service.js";
+import type { TeardownIndexProvisionerPort } from "./lifecycle.js";
+import type { ActorPrincipalKind, ContentTypeRecord, Result } from "./types.js";
+/**
+ * @file Content-type lifecycle `op` dispatch (the closed-union-dispatch convention,
+ * `features/settings/definitions-dispatch.ts`'s pattern reused verbatim for this domain).
+ *
+ * Purpose:
+ * The admin lifecycle route (`routes/admin/content-types/lifecycle.ts`) accepts an untrusted `op`
+ * string in the request body. Per the binding rule that any such string is narrowed to this
+ * closed 3-entry union at the parse boundary (`parseContentTypeLifecycleOp`) BEFORE any dispatch
+ * table lookup — never a raw `Record<string, Handler>` keyed by the unparsed value.
+ */
+export declare const CONTENT_TYPE_LIFECYCLE_OP_NAMES: readonly ["deprecate", "reactivate", "tombstone"];
+export type ContentTypeLifecycleOp = (typeof CONTENT_TYPE_LIFECYCLE_OP_NAMES)[number];
+/** Narrows an untrusted `op` string to {@link ContentTypeLifecycleOp}, or `null` if it isn't one. */
+export declare function parseContentTypeLifecycleOp(op: unknown): ContentTypeLifecycleOp | null;
+export interface LifecycleDispatchDeps {
+    repo: ContentTypeRepoPort;
+    clock: ClockPort;
+    authorize: AuthorizeFn;
+    outbox: OutboxPort;
+    indexProvisioner: TeardownIndexProvisionerPort;
+}
+export interface LifecycleDispatchInput {
+    workspaceId: string;
+    actorId: string;
+    key: string;
+    expectedVersion: number;
+    /** Threaded straight through to {@link LifecycleTransitionInput.principalKind} — the audit provenance stamped on the revision row. */
+    principalKind?: ActorPrincipalKind;
+}
+export type ContentTypeLifecycleHandler = (deps: LifecycleDispatchDeps, input: LifecycleDispatchInput) => Promise<Result<{
+    contentType: ContentTypeRecord;
+}, Error>>;
+export declare const CONTENT_TYPE_LIFECYCLE_OPS: Record<ContentTypeLifecycleOp, ContentTypeLifecycleHandler>;
+//# sourceMappingURL=lifecycle-dispatch.d.ts.map

package/dist/content-types/lifecycle-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle-dispatch.d.ts","sourceRoot":"","sources":["../../src/content-types/lifecycle-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEhF;;;;;;;;;GASG;AAEH,eAAO,MAAM,+BAA+B,mDAAoD,CAAC;AACjG,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEtF,qGAAqG;AACrG,wBAAgB,2BAA2B,CAAC,EAAE,EAAE,OAAO,GAAG,sBAAsB,GAAG,IAAI,CAItF;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,KAAK,EAAE,SAAS,CAAC;IACjB,SAAS,EAAE,WAAW,CAAC;IACvB,MAAM,EAAE,UAAU,CAAC;IACnB,gBAAgB,EAAE,4BAA4B,CAAC;CAChD;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,eAAe,EAAE,MAAM,CAAC;IACxB,sIAAsI;IACtI,aAAa,CAAC,EAAE,kBAAkB,CAAC;CACpC;AAED,MAAM,MAAM,2BAA2B,GAAG,CACxC,IAAI,EAAE,qBAAqB,EAC3B,KAAK,EAAE,sBAAsB,KAC1B,OAAO,CAAC,MAAM,CAAC;IAAE,WAAW,EAAE,iBAAiB,CAAA;CAAE,EAAE,KAAK,CAAC,CAAC,CAAC;AAWhE,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,sBAAsB,EAAE,2BAA2B,CAGlG,CAAC"}

package/dist/content-types/lifecycle-dispatch.js

@@ -0,0 +1,28 @@
+import { deprecateContentType, reactivateContentType, tombstoneContentType } from "./lifecycle.js";
+/**
+ * @file Content-type lifecycle `op` dispatch (the closed-union-dispatch convention,
+ * `features/settings/definitions-dispatch.ts`'s pattern reused verbatim for this domain).
+ *
+ * Purpose:
+ * The admin lifecycle route (`routes/admin/content-types/lifecycle.ts`) accepts an untrusted `op`
+ * string in the request body. Per the binding rule that any such string is narrowed to this
+ * closed 3-entry union at the parse boundary (`parseContentTypeLifecycleOp`) BEFORE any dispatch
+ * table lookup — never a raw `Record<string, Handler>` keyed by the unparsed value.
+ */
+export const CONTENT_TYPE_LIFECYCLE_OP_NAMES = ["deprecate", "reactivate", "tombstone"];
+/** Narrows an untrusted `op` string to {@link ContentTypeLifecycleOp}, or `null` if it isn't one. */
+export function parseContentTypeLifecycleOp(op) {
+    return typeof op === "string" && CONTENT_TYPE_LIFECYCLE_OP_NAMES.includes(op)
+        ? op
+        : null;
+}
+/** Op name -> handler, keyed only by {@link ContentTypeLifecycleOp}, `Object.create(null)`-based
+ * (defense-in-depth against a prototype-chain key ever resolving, matching the settings
+ * dispatch table's own convention). */
+const contentTypeLifecycleOps = {
+    deprecate: (deps, input) => deprecateContentType({ deps, input }),
+    reactivate: (deps, input) => reactivateContentType({ deps: { repo: deps.repo, clock: deps.clock, authorize: deps.authorize }, input }),
+    tombstone: (deps, input) => tombstoneContentType({ deps, input }),
+};
+export const CONTENT_TYPE_LIFECYCLE_OPS = Object.assign(Object.create(null), contentTypeLifecycleOps);
+//# sourceMappingURL=lifecycle-dispatch.js.map

package/dist/content-types/lifecycle-dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle-dispatch.js","sourceRoot":"","sources":["../../src/content-types/lifecycle-dispatch.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAKnG;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;AAGjG,qGAAqG;AACrG,MAAM,UAAU,2BAA2B,CAAC,EAAW;IACrD,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAK,+BAAqD,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClG,CAAC,CAAE,EAA6B;QAChC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAwBD;;uCAEuC;AACvC,MAAM,uBAAuB,GAAG;IAC9B,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACjE,UAAU,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC;IACtI,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;CACI,CAAC;AAExE,MAAM,CAAC,MAAM,0BAA0B,GAAgE,MAAM,CAAC,MAAM,CAClH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAgE,EAClF,uBAAuB,CACxB,CAAC"}

package/dist/content-types/lifecycle.d.ts

@@ -0,0 +1,104 @@
+import type { ClockPort } from "../core/ports.js";
+import type { AuthorizeFn, ContentTypeRepoPort, OutboxPort } from "./write-service.js";
+import type { ActorPrincipalKind, ContentTypeRecord, Result } from "./types.js";
+/**
+ * @file REQ-09..12 — the content-type lifecycle state machine `active ⇄ deprecated ->
+ * tombstone` (INV-06).
+ *
+ * Purpose:
+ * `deprecateContentType`/`reactivateContentType` are the reversible `active <-> deprecated` pair
+ * (deprecate blocks new-entry creation only, per REQ-10/REQ-28's asymmetry — existing entries stay
+ * fully readable/writable). `tombstoneContentType` is the one-way terminal transition: it MUST be
+ * entered from `deprecated` (EC-09, "must deprecate first") and never left (INV-06) — both
+ * `reactivateContentType` and `deprecateContentType` reject unconditionally against a tombstoned
+ * row (the property `operationTests INV-06` case). Tombstoning tears down every queryable-field
+ * index the type ever provisioned (AC-17) and enqueues the same-call outbox event
+ * required for `content_type.deprecated`/`content_type.tombstoned`.
+ *
+ * How it relates to the project:
+ * `reactivateContentType` deliberately does not accept `outbox`/`indexProvisioner` deps — no
+ * certified test requires a reactivation event or index reprovisioning on this transition, and
+ * REQ-09..12 name only deprecate/tombstone as outbox-obligated.
+ *
+ * Architectural role:
+ * `features/content-types` domain logic, composing `write-service.ts`'s repo/outbox/index-
+ * provisioner port shapes rather than redeclaring them.
+ */
+export interface LifecycleTransitionInput {
+    workspaceId: string;
+    actorId: string;
+    key: string;
+    expectedVersion: number;
+    /** Audit provenance stamped onto this transition's revision row — see `types.ts`'s `ActorIdentityInput.principalKind`. */
+    principalKind?: ActorPrincipalKind;
+}
+export interface DeprecateContentTypeRequired {
+    deps: {
+        repo: ContentTypeRepoPort;
+        clock: ClockPort;
+        authorize: AuthorizeFn;
+        outbox: OutboxPort;
+    };
+    input: LifecycleTransitionInput;
+}
+/**
+ * AC-13/AC-19 — flips an active type to `deprecated` (blocks only NEW entry creation, REQ-10) and
+ * enqueues `content_type.deprecated` in the same call. Rejected unconditionally (INV-06) if the
+ * type is already `tombstone` — deprecate can never be used to "step back" out of tombstone.
+ *
+ * @complexity O(1) plus one repo read, one same-tx write pair, and one outbox enqueue.
+ * @overallScore 100
+ */
+export declare function deprecateContentType(required: DeprecateContentTypeRequired): Promise<Result<{
+    contentType: ContentTypeRecord;
+}, Error>>;
+export interface ReactivateContentTypeRequired {
+    deps: {
+        repo: ContentTypeRepoPort;
+        clock: ClockPort;
+        authorize: AuthorizeFn;
+    };
+    input: LifecycleTransitionInput;
+}
+/**
+ * AC-13 — flips a `deprecated` (or already-`active`, a no-op-shaped success) type back to
+ * `active`. Rejected unconditionally (AC-14/INV-06) against a tombstoned row.
+ *
+ * @complexity O(1) plus one repo read and one same-tx write pair.
+ * @overallScore 100
+ */
+export declare function reactivateContentType(required: ReactivateContentTypeRequired): Promise<Result<{
+    contentType: ContentTypeRecord;
+}, Error>>;
+/** The one index-provisioner method the tombstone transition needs — a narrower port than `write-service.ts`'s registration-time `IndexProvisionerPort`. */
+export interface TeardownIndexProvisionerPort {
+    tearDownAllIndexesForContentType(input: {
+        workspaceId: string;
+        contentTypeKey: string;
+    }): Promise<void>;
+}
+export interface TombstoneContentTypeRequired {
+    deps: {
+        repo: ContentTypeRepoPort;
+        clock: ClockPort;
+        authorize: AuthorizeFn;
+        outbox: OutboxPort;
+        indexProvisioner: TeardownIndexProvisionerPort;
+    };
+    input: LifecycleTransitionInput;
+}
+/**
+ * AC-17/AC-20/EC-09 — the one-way terminal transition into `tombstone`. Must be entered from
+ * `deprecated` (any other status, including an already-tombstoned row, is rejected with the same
+ * "must deprecate first" guard — EC-09/INV-06 collapse to one check). Tears down every queryable-
+ * field index the type ever provisioned BEFORE persisting the status flip, and enqueues
+ * `content_type.tombstoned` in the same call.
+ *
+ * @complexity O(1) plus one repo read, one index-teardown call, one same-tx write pair, and one
+ * outbox enqueue.
+ * @overallScore 100
+ */
+export declare function tombstoneContentType(required: TombstoneContentTypeRequired): Promise<Result<{
+    contentType: ContentTypeRecord;
+}, Error>>;
+//# sourceMappingURL=lifecycle.d.ts.map

package/dist/content-types/lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../src/content-types/lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEhF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,eAAe,EAAE,MAAM,CAAC;IACxB,0HAA0H;IAC1H,aAAa,CAAC,EAAE,kBAAkB,CAAC;CACpC;AAcD,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,KAAK,EAAE,SAAS,CAAC;QAAC,SAAS,EAAE,WAAW,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC;IAClG,KAAK,EAAE,wBAAwB,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,4BAA4B,GACrC,OAAO,CAAC,MAAM,CAAC;IAAE,WAAW,EAAE,iBAAiB,CAAA;CAAE,EAAE,KAAK,CAAC,CAAC,CAwC5D;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,KAAK,EAAE,SAAS,CAAC;QAAC,SAAS,EAAE,WAAW,CAAA;KAAE,CAAC;IAC9E,KAAK,EAAE,wBAAwB,CAAC;CACjC;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,6BAA6B,GACtC,OAAO,CAAC,MAAM,CAAC;IAAE,WAAW,EAAE,iBAAiB,CAAA;CAAE,EAAE,KAAK,CAAC,CAAC,CAsC5D;AAED,4JAA4J;AAC5J,MAAM,WAAW,4BAA4B;IAC3C,gCAAgC,CAAC,KAAK,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzG;AAED,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,KAAK,EAAE,SAAS,CAAC;QAAC,SAAS,EAAE,WAAW,CAAC;QAAC,MAAM,EAAE,UAAU,CAAC;QAAC,gBAAgB,EAAE,4BAA4B,CAAA;KAAE,CAAC;IAClJ,KAAK,EAAE,wBAAwB,CAAC;CACjC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,4BAA4B,GACrC,OAAO,CAAC,MAAM,CAAC;IAAE,WAAW,EAAE,iBAAiB,CAAA;CAAE,EAAE,KAAK,CAAC,CAAC,CA+C5D"}

package/dist/content-types/lifecycle.js

@@ -0,0 +1,143 @@
+import { ContentTypeLifecycleError, ContentTypeNotFoundError, ForbiddenError, VersionConflictError } from "./errors.js";
+async function resolveActiveOrDeprecated(repo, workspaceId, key) {
+    const current = await repo.findByKey({ workspaceId, key });
+    if (!current) {
+        return { ok: false, error: new ContentTypeNotFoundError(`content type '${key}' was not found in workspace '${workspaceId}'`) };
+    }
+    return { ok: true, value: current };
+}
+/**
+ * AC-13/AC-19 — flips an active type to `deprecated` (blocks only NEW entry creation, REQ-10) and
+ * enqueues `content_type.deprecated` in the same call. Rejected unconditionally (INV-06) if the
+ * type is already `tombstone` — deprecate can never be used to "step back" out of tombstone.
+ *
+ * @complexity O(1) plus one repo read, one same-tx write pair, and one outbox enqueue.
+ * @overallScore 100
+ */
+export async function deprecateContentType(required) {
+    const { deps, input } = required;
+    const authResult = await deps.authorize({ principalId: input.actorId, permission: "admin.collections.manage", workspaceId: input.workspaceId });
+    if (!authResult.allowed) {
+        return { ok: false, error: new ForbiddenError(`principal '${input.actorId}' cannot deprecate content type '${input.key}' (${authResult.reason})`) };
+    }
+    const resolved = await resolveActiveOrDeprecated(deps.repo, input.workspaceId, input.key);
+    if (!resolved.ok)
+        return resolved;
+    const current = resolved.value;
+    if (current.status === "tombstone") {
+        return { ok: false, error: new ContentTypeLifecycleError(`content type '${input.key}' is tombstoned; INV-06 forbids any transition out of tombstone`) };
+    }
+    if (input.expectedVersion !== current.version) {
+        return { ok: false, error: new VersionConflictError(`expected version ${input.expectedVersion} for content type '${input.key}', found ${current.version}`) };
+    }
+    const now = deps.clock.nowIso();
+    const updated = { ...current, status: "deprecated", version: current.version + 1 };
+    await deps.repo.transaction(async () => {
+        await deps.repo.save(updated);
+        await deps.repo.appendRevision({
+            contentTypeKey: input.key,
+            workspaceId: input.workspaceId,
+            op: "field-change",
+            stateJson: updated,
+            actorId: input.actorId,
+            principalKind: input.principalKind ?? null,
+            delegatedByWorkspaceId: null,
+            delegatedById: null,
+            recordedAt: now,
+        });
+    });
+    await deps.outbox.enqueue({ name: "content_type.deprecated", payload: { workspaceId: input.workspaceId, key: input.key } });
+    return { ok: true, value: { contentType: updated } };
+}
+/**
+ * AC-13 — flips a `deprecated` (or already-`active`, a no-op-shaped success) type back to
+ * `active`. Rejected unconditionally (AC-14/INV-06) against a tombstoned row.
+ *
+ * @complexity O(1) plus one repo read and one same-tx write pair.
+ * @overallScore 100
+ */
+export async function reactivateContentType(required) {
+    const { deps, input } = required;
+    const authResult = await deps.authorize({ principalId: input.actorId, permission: "admin.collections.manage", workspaceId: input.workspaceId });
+    if (!authResult.allowed) {
+        return { ok: false, error: new ForbiddenError(`principal '${input.actorId}' cannot reactivate content type '${input.key}' (${authResult.reason})`) };
+    }
+    const resolved = await resolveActiveOrDeprecated(deps.repo, input.workspaceId, input.key);
+    if (!resolved.ok)
+        return resolved;
+    const current = resolved.value;
+    if (current.status === "tombstone") {
+        return { ok: false, error: new ContentTypeLifecycleError(`content type '${input.key}' is tombstoned; INV-06 forbids any transition out of tombstone`) };
+    }
+    if (input.expectedVersion !== current.version) {
+        return { ok: false, error: new VersionConflictError(`expected version ${input.expectedVersion} for content type '${input.key}', found ${current.version}`) };
+    }
+    const now = deps.clock.nowIso();
+    const updated = { ...current, status: "active", version: current.version + 1 };
+    await deps.repo.transaction(async () => {
+        await deps.repo.save(updated);
+        await deps.repo.appendRevision({
+            contentTypeKey: input.key,
+            workspaceId: input.workspaceId,
+            op: "field-change",
+            stateJson: updated,
+            actorId: input.actorId,
+            principalKind: input.principalKind ?? null,
+            delegatedByWorkspaceId: null,
+            delegatedById: null,
+            recordedAt: now,
+        });
+    });
+    return { ok: true, value: { contentType: updated } };
+}
+/**
+ * AC-17/AC-20/EC-09 — the one-way terminal transition into `tombstone`. Must be entered from
+ * `deprecated` (any other status, including an already-tombstoned row, is rejected with the same
+ * "must deprecate first" guard — EC-09/INV-06 collapse to one check). Tears down every queryable-
+ * field index the type ever provisioned BEFORE persisting the status flip, and enqueues
+ * `content_type.tombstoned` in the same call.
+ *
+ * @complexity O(1) plus one repo read, one index-teardown call, one same-tx write pair, and one
+ * outbox enqueue.
+ * @overallScore 100
+ */
+export async function tombstoneContentType(required) {
+    const { deps, input } = required;
+    const authResult = await deps.authorize({ principalId: input.actorId, permission: "admin.collections.manage", workspaceId: input.workspaceId });
+    if (!authResult.allowed) {
+        return { ok: false, error: new ForbiddenError(`principal '${input.actorId}' cannot tombstone content type '${input.key}' (${authResult.reason})`) };
+    }
+    const resolved = await resolveActiveOrDeprecated(deps.repo, input.workspaceId, input.key);
+    if (!resolved.ok)
+        return resolved;
+    const current = resolved.value;
+    if (current.status !== "deprecated") {
+        return {
+            ok: false,
+            error: new ContentTypeLifecycleError(`content type '${input.key}' must be 'deprecated' before it can be tombstoned (EC-09); current status is '${current.status}'`),
+        };
+    }
+    if (input.expectedVersion !== current.version) {
+        return { ok: false, error: new VersionConflictError(`expected version ${input.expectedVersion} for content type '${input.key}', found ${current.version}`) };
+    }
+    const now = deps.clock.nowIso();
+    const updated = { ...current, status: "tombstone", tombstonedAt: now, version: current.version + 1 };
+    await deps.indexProvisioner.tearDownAllIndexesForContentType({ workspaceId: input.workspaceId, contentTypeKey: input.key });
+    await deps.repo.transaction(async () => {
+        await deps.repo.save(updated);
+        await deps.repo.appendRevision({
+            contentTypeKey: input.key,
+            workspaceId: input.workspaceId,
+            op: "field-change",
+            stateJson: updated,
+            actorId: input.actorId,
+            principalKind: input.principalKind ?? null,
+            delegatedByWorkspaceId: null,
+            delegatedById: null,
+            recordedAt: now,
+        });
+    });
+    await deps.outbox.enqueue({ name: "content_type.tombstoned", payload: { workspaceId: input.workspaceId, key: input.key } });
+    return { ok: true, value: { contentType: updated } };
+}
+//# sourceMappingURL=lifecycle.js.map

package/dist/content-types/lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../../src/content-types/lifecycle.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAqCxH,KAAK,UAAU,yBAAyB,CACtC,IAAyB,EACzB,WAAmB,EACnB,GAAW;IAEX,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,wBAAwB,CAAC,iBAAiB,GAAG,iCAAiC,WAAW,GAAG,CAAC,EAAE,CAAC;IACjI,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAAsC;IAEtC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAEjC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,0BAA0B,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAChJ,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,cAAc,CAAC,cAAc,KAAK,CAAC,OAAO,oCAAoC,KAAK,CAAC,GAAG,MAAM,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACtJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1F,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC;IAE/B,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,yBAAyB,CAAC,iBAAiB,KAAK,CAAC,GAAG,iEAAiE,CAAC,EAAE,CAAC;IAC1J,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,oBAAoB,CAAC,oBAAoB,KAAK,CAAC,eAAe,sBAAsB,KAAK,CAAC,GAAG,YAAY,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IAC/J,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,OAAO,GAAsB,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;IAEtG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;YAC7B,cAAc,EAAE,KAAK,CAAC,GAAG;YACzB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,EAAE,EAAE,cAAc;YAClB,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;YAC1C,sBAAsB,EAAE,IAAI;YAC5B,aAAa,EAAE,IAAI;YACnB,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAE5H,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;AACvD,CAAC;AAOD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAuC;IAEvC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAEjC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,0BAA0B,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAChJ,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,cAAc,CAAC,cAAc,KAAK,CAAC,OAAO,qCAAqC,KAAK,CAAC,GAAG,MAAM,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACvJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1F,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC;IAE/B,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,yBAAyB,CAAC,iBAAiB,KAAK,CAAC,GAAG,iEAAiE,CAAC,EAAE,CAAC;IAC1J,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,oBAAoB,CAAC,oBAAoB,KAAK,CAAC,eAAe,sBAAsB,KAAK,CAAC,GAAG,YAAY,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IAC/J,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,OAAO,GAAsB,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;IAElG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;YAC7B,cAAc,EAAE,KAAK,CAAC,GAAG;YACzB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,EAAE,EAAE,cAAc;YAClB,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;YAC1C,sBAAsB,EAAE,IAAI;YAC5B,aAAa,EAAE,IAAI;YACnB,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;AACvD,CAAC;AAYD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAAsC;IAEtC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAEjC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,0BAA0B,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAChJ,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,cAAc,CAAC,cAAc,KAAK,CAAC,OAAO,oCAAoC,KAAK,CAAC,GAAG,MAAM,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACtJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1F,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC;IAE/B,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,IAAI,yBAAyB,CAClC,iBAAiB,KAAK,CAAC,GAAG,kFAAkF,OAAO,CAAC,MAAM,GAAG,CAC9H;SACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,oBAAoB,CAAC,oBAAoB,KAAK,CAAC,eAAe,sBAAsB,KAAK,CAAC,GAAG,YAAY,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IAC/J,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,OAAO,GAAsB,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;IAExH,MAAM,IAAI,CAAC,gBAAgB,CAAC,gCAAgC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,cAAc,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAE5H,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE;QACrC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;YAC7B,cAAc,EAAE,KAAK,CAAC,GAAG;YACzB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,EAAE,EAAE,cAAc;YAClB,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;YAC1C,sBAAsB,EAAE,IAAI;YAC5B,aAAa,EAAE,IAAI;YACnB,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAE5H,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;AACvD,CAAC"}