@jini-ai/cms 0.3.10 → 0.4.0

package/dist/content-types/index-provisioning.js

@@ -1,49 +1,48 @@
-import { createHash } from "node:crypto";
 import { InvalidFieldKindError, InvalidFieldNameGrammarError, InvalidKeyGrammarError } from "./errors.js";
 import { INDEXABLE_FIELD_KINDS, isIndexableFieldKind, } from "./types.js";
 /**
- * @file CIC U-001 — the `kind`->`CAST` fixed lookup table, the identifier grammar
+ * @file the `kind`->`CAST` fixed lookup table, the identifier grammar
  * gate, the workspace-scoped queryable-index naming scheme, and the before/after index-transition
  * resolver (grammar-and-workspace-scoping folds).
  *
  * Purpose:
  * THIS IS THE HIGHEST-SECURITY-SEVERITY MODULE IN THE 5-PACKAGE PIPELINE — every value that ends
- * up inside a `CREATE INDEX ... CAST(json_extract(fields,'$.ext.{ns}.{field}') AS {type})`
+ * up inside a `CREATE INDEX... CAST(json_extract(fields,'$.ext.{ns}.{field}') AS {type})`
  * statement is produced here, and only here:
- *   - `mapFieldKindToCast` (U-001-B1). STATE THE INVARIANT PRECISELY, because an earlier version
- *     of this comment did not and the imprecision was itself a hazard: it said "a fixed, hardcoded
- *     5-entry table", which reads as though the ENTRY COUNT were the defense. It is not. Neither
- *     the number of keys nor the number of distinct values is the security boundary.
- *
- *     THE DEFENSE IS: this function returns a VALUE FROM THE TABLE and never returns, echoes, or
- *     interpolates its own ARGUMENT. The function has exactly one `return`, and it is a table
- *     lookup. Therefore the set of strings that can reach a `CAST(... AS {type})` position is
- *     exactly the set of string literals written into `KIND_TO_CAST_LITERAL` in this source file —
- *     compile-time constants, every one — no matter what an operator, an agent, or an attacker
- *     supplies as `kind`. A 50-entry table of literals would be exactly as safe as a 5-entry one.
- *
- *     What follows from that, and what a maintainer actually needs to know:
- *       * Adding a KEY whose value is an existing literal cannot widen the DDL alphabet. It is not
- *         a security event and does not need to be feared as one. (`relation: "TEXT"` is exactly
- *         this: `"TEXT"` was already present twice.)
- *       * Adding a new VALUE does widen it, and must be reviewed as a DDL change.
- *       * Returning, concatenating, or template-interpolating `kind` itself — or reading the table
- *         with a fallback such as `?? kind` — BREAKS the invariant outright. That is the edit to
- *         refuse, and it is the one the old "5-entry" phrasing gave no way to recognise.
- *     The reachable-value set is pinned executably by `HISTORICAL_DDL_ALPHABET` in
- *     `__tests__/field-kind-widening.test.ts`, so this claim is a failing test and not only prose.
- *
- *     Degraded failure mode, stated so the blast radius is known: if every runtime guard below
- *     were deleted, a storage-only kind would reach the table and `KIND_TO_CAST_LITERAL["json"]`
- *     would evaluate to `undefined` — a SQL syntax error and a loud broken feature, never an
- *     operator-controlled string. Total guard removal degrades this module to unavailable, not to
- *     injectable. That is the property worth preserving through any future change.
- *   - `validateIdentifierGrammar`/`buildQueryableFieldIndexName` gate every `key`/field name
- *     through `^[a-z][a-z0-9_]{0,63}$` before it can reach an index-name segment or JSON-path
- *     literal (U-001-B2), and join grammar-gated segments with `/` — a delimiter outside the
- *     grammar's own alphabet `[a-z0-9_]`, closing the namespace-injectivity collision class
- *     (U-001-B3) — and fold in a workspace-derived segment so two workspaces defining the same
- *     `(key, field)` pair never collide on index identity.
+ * - `mapFieldKindToCast`. STATE THE INVARIANT PRECISELY, because an earlier version
+ * of this comment did not and the imprecision was itself a hazard: it said "a fixed, hardcoded
+ * 5-entry table", which reads as though the ENTRY COUNT were the defense. It is not. Neither
+ * the number of keys nor the number of distinct values is the security boundary.
+ *
+ * THE DEFENSE IS: this function returns a VALUE FROM THE TABLE and never returns, echoes, or
+ * interpolates its own ARGUMENT. The function has exactly one `return`, and it is a table
+ * lookup. Therefore the set of strings that can reach a `CAST(... AS {type})` position is
+ * exactly the set of string literals written into `KIND_TO_CAST_LITERAL` in this source file —
+ * compile-time constants, every one — no matter what an operator, an agent, or an attacker
+ * supplies as `kind`. A 50-entry table of literals would be exactly as safe as a 5-entry one.
+ *
+ * What follows from that, and what a maintainer actually needs to know:
+ * * Adding a KEY whose value is an existing literal cannot widen the DDL alphabet. It is not
+ * a security event and does not need to be feared as one. (`relation: "TEXT"` is exactly
+ * this: `"TEXT"` was already present twice.)
+ * * Adding a new VALUE does widen it, and must be reviewed as a DDL change.
+ * * Returning, concatenating, or template-interpolating `kind` itself — or reading the table
+ * with a fallback such as `?? kind` — BREAKS the invariant outright. That is the edit to
+ * refuse, and it is the one the old "5-entry" phrasing gave no way to recognise.
+ * The reachable-value set is pinned executably by `HISTORICAL_DDL_ALPHABET` in
+ * `__tests__/field-kind-widening.test.ts`, so this claim is a failing test and not only prose.
+ *
+ * Degraded failure mode, stated so the blast radius is known: if every runtime guard below
+ * were deleted, a storage-only kind would reach the table and `KIND_TO_CAST_LITERAL["json"]`
+ * would evaluate to `undefined` — a SQL syntax error and a loud broken feature, never an
+ * operator-controlled string. Total guard removal degrades this module to unavailable, not to
+ * injectable. That is the property worth preserving through any future change.
+ * - `validateIdentifierGrammar`/`buildQueryableFieldIndexName` gate every `key`/field name
+ * through `^[a-z][a-z0-9_]{0,63}$` before it can reach an index-name segment or JSON-path
+ * literal, and join grammar-gated segments with `/` — a delimiter outside the
+ * grammar's own alphabet `[a-z0-9_]`, closing the namespace-injectivity collision class
+ * — and fold in a workspace-derived segment so two workspaces defining the same
+ * `(key, field)` pair never collide on index identity.
  *
  * How it relates to the project:
  * `resolveFieldIndexTransition` deliberately still ACCEPTS a storage-only kind on its `none` and
@@ -53,35 +52,39 @@ import { INDEXABLE_FIELD_KINDS, isIndexableFieldKind, } from "./types.js";
  *
  * `write-service.ts`'s `registerContentType`/`updateContentTypeFields` call
  * `resolveFieldIndexTransition` once per field (never two independent kind/queryable branches —
- * CIC U-003-B1) and hand the result to the injected `indexProvisioner` port, which is the only
+ * ) and hand the result to the injected `indexProvisioner` port, which is the only
  * thing that ever issues the real `CREATE INDEX`/`DROP INDEX` DDL (this module only decides what
  * to build, never executes DDL itself).
  *
  * Architectural role:
- * `features/content-types` domain logic. No dependencies beyond `node:crypto` (workspace-segment
- * hashing) and this package's own `errors.ts`/`types.ts`.
+ * `features/content-types` domain logic. Workspace-segment hashing uses Web Crypto so this
+ * universal entry needs only standard runtime APIs and this package's own `errors.ts`/`types.ts`.
+ * See docs/decisions/DR-001-safe-schema-and-index-transitions.md.
  */
 /**
- * U-001-B2 — the closed identifier grammar every `content_types.key` and field name must satisfy,
+ * — the closed identifier grammar every `content_types.key` and field name must satisfy,
  * as a pattern string so the agent-facing JSON Schemas in `agent-tools.ts` can publish the very
  * same grammar instead of restating it. A cross-cutting single-source-of-truth governance rule makes this grammar load-bearing for DDL
  * safety, so it must have exactly one definition; {@link IDENTIFIER_GRAMMAR} is compiled from this
  * string rather than written twice.
+ * See docs/decisions/DR-001-safe-schema-and-index-transitions.md.
  */
 export const IDENTIFIER_GRAMMAR_PATTERN = "^[a-z][a-z0-9_]{0,63}$";
-/** U-001-B2 — the closed identifier grammar every `content_types.key` and field name must satisfy. */
+/** — the closed identifier grammar every `content_types.key` and field name must satisfy. See docs/decisions/DR-001-safe-schema-and-index-transitions.md. */
 const IDENTIFIER_GRAMMAR = new RegExp(IDENTIFIER_GRAMMAR_PATTERN);
 /**
- * Structural grammar gate for a `content_types.key` or field name (U-001-B2).
+ * Structural grammar gate for a `content_types.key` or field name.
  *
  * @complexity O(n) in the string's length (regex match), bounded at 64 chars.
  * @overallScore 100
+ * See docs/decisions/DR-001-safe-schema-and-index-transitions.md.
  */
-export function validateIdentifierGrammar(value) {
+export function validateIdentifierGrammar(requiredArgs, optionalArgs = {}) {
+    const { value } = requiredArgs;
     return IDENTIFIER_GRAMMAR.test(value);
 }
 /**
- * U-001-B1 — the fixed, hardcoded `kind` -> SQL `CAST` type-token table. Every value here is a
+ * — the fixed, hardcoded `kind` -> SQL `CAST` type-token table. Every value here is a
  * plain uppercase SQL type token with no quotes/parens/whitespace; never built by concatenation.
  *
  * Keyed by `IndexableFieldKind`, NOT `ContentTypeFieldKind`: a storage-only kind has no CAST
@@ -90,6 +93,7 @@ export function validateIdentifierGrammar(value) {
  * compiler-enforced: adding a member to `INDEXABLE_FIELD_KINDS` fails the build until an entry
  * appears here. Do not replace it with a `Partial`, an index signature, or a lookup with a
  * fallback — each of those converts a build failure into a runtime surprise on the DDL path.
+ * See docs/decisions/DR-001-safe-schema-and-index-transitions.md.
  */
 const KIND_TO_CAST_LITERAL = {
     text: "TEXT",
@@ -109,7 +113,7 @@ const KIND_TO_CAST_LITERAL = {
  * {@link InvalidFieldKindError} for anything that is not exactly one of `INDEXABLE_FIELD_KINDS` —
  * including a storage-only kind such as `json`, which is a legal kind to declare but has no CAST
  * target. This is a lookup, never a template, so an adversarial payload can never reach the
- * returned string (U-001-B1).
+ * returned string.
  *
  * The PARAMETER type is deliberately the wider `ContentTypeFieldKind`. Narrowing it would be a
  * breaking change for `@jini-ai/cms`'s public consumers (`content-types/index.ts` documents this
@@ -123,12 +127,16 @@ const KIND_TO_CAST_LITERAL = {
  *
  * @complexity O(1) — a fixed-size object lookup behind a fixed-size membership test.
  * @overallScore 100
+ * See docs/decisions/DR-001-safe-schema-and-index-transitions.md.
  */
-export function mapFieldKindToCast(kind) {
-    if (!isIndexableFieldKind(kind)) {
-        throw new InvalidFieldKindError(`'${String(kind)}' is not an indexable field kind (${INDEXABLE_FIELD_KINDS.join("|")}) — U-001-B1`);
+export function mapFieldKindToCast(requiredArgs, optionalArgs = {}) {
+    const { kind } = requiredArgs;
+    const candidate = { value: kind };
+    if (!isIndexableFieldKind(candidate)) {
+        // See docs/decisions/DR-001-safe-schema-and-index-transitions.md for the invariant behind this refusal; keep external identifiers out of caller-facing messages.
+        throw new InvalidFieldKindError({ message: `'${String(kind)}' is not an indexable field kind (${INDEXABLE_FIELD_KINDS.join("|")})` });
     }
-    return KIND_TO_CAST_LITERAL[kind];
+    return KIND_TO_CAST_LITERAL[candidate.value];
 }
 /**
  * Derives a grammar-safe, workspace-scoped index-name segment from an arbitrary `workspaceId`
@@ -136,31 +144,44 @@ export function mapFieldKindToCast(kind) {
  * it to a fixed `[0-9a-f]` alphabet (a strict subset of the identifier grammar's `[a-z0-9_]`)
  * prefixed with a letter so the segment independently satisfies {@link validateIdentifierGrammar}.
  *
- * @complexity O(1) — a fixed-length SHA-256 digest.
+ * UTF-8 encoding, SHA-256, lowercase hex, and the first 16 hex characters preserve the
+ * historical Node hash byte-for-byte, including replacement of unpaired UTF-16 surrogates.
+ * Requires Web Crypto; digest failures reject the returned promise.
+ *
+ * @complexity O(n) time and space in the UTF-8 workspace ID length.
  * @overallScore 100
  */
-function workspaceIndexSegment(workspaceId) {
-    const digest = createHash("sha256").update(workspaceId).digest("hex").slice(0, 16);
+async function workspaceIndexSegment(workspaceId) {
+    const hash = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(workspaceId));
+    const digest = Array.from(new Uint8Array(hash).subarray(0, 8), (byte) => byte.toString(16).padStart(2, "0")).join("");
     return `w${digest}`;
 }
 /**
  * Builds the workspace-scoped queryable-field index identity for `(workspaceId, contentTypeKey,
  * fieldName)`. Both `contentTypeKey` and `fieldName` are grammar-gated first — a failure throws
- * before any index name is produced (U-001-B2). Segments are joined with `/`, a delimiter outside
+ * before any index name is produced. Segments are joined with `/`, a delimiter outside
  * the grammar's own alphabet `[a-z0-9_]`, so distinct `(key, name)` pairs can never collide by
- * boundary-shifting (U-001-B3, e.g. `("a_b","c")` vs `("a","b_c")`).
+ * boundary-shifting (e.g. `("a_b","c")` vs `("a","b_c")`).
+ *
+ * Returns a promise for the unchanged index identity. Grammar failures still throw
+ * synchronously before hashing; Web Crypto failures reject the promise. Callers must await
+ * the name before using it in DDL.
  *
- * @complexity O(1) plus two grammar checks and one SHA-256 hash.
+ * @complexity O(n) time and space in the UTF-8 workspace ID length, plus two grammar checks.
  * @overallScore 100
+ * See docs/decisions/DR-001-safe-schema-and-index-transitions.md.
  */
 export function buildQueryableFieldIndexName(params) {
-    if (!validateIdentifierGrammar(params.contentTypeKey)) {
-        throw new InvalidKeyGrammarError(`content-type key '${params.contentTypeKey}' fails the identifier grammar gate ^[a-z][a-z0-9_]{0,63}$ (U-001-B2)`);
+    if (!validateIdentifierGrammar({ value: params.contentTypeKey })) {
+        // See docs/decisions/DR-001-safe-schema-and-index-transitions.md for the invariant behind this refusal; keep external identifiers out of caller-facing messages.
+        throw new InvalidKeyGrammarError({ message: `content-type key '${params.contentTypeKey}' fails the identifier grammar gate ^[a-z][a-z0-9_]{0,63}$` });
     }
-    if (!validateIdentifierGrammar(params.fieldName)) {
-        throw new InvalidFieldNameGrammarError(`field name '${params.fieldName}' fails the identifier grammar gate ^[a-z][a-z0-9_]{0,63}$ (U-001-B2)`);
+    if (!validateIdentifierGrammar({ value: params.fieldName })) {
+        // See docs/decisions/DR-001-safe-schema-and-index-transitions.md for the invariant behind this refusal; keep external identifiers out of caller-facing messages.
+        throw new InvalidFieldNameGrammarError({ message: `field name '${params.fieldName}' fails the identifier grammar gate ^[a-z][a-z0-9_]{0,63}$` });
     }
-    return `q/${workspaceIndexSegment(params.workspaceId)}/${params.contentTypeKey}/${params.fieldName}`;
+    const { workspaceId, contentTypeKey, fieldName } = params;
+    return workspaceIndexSegment(workspaceId).then((segment) => `q/${segment}/${contentTypeKey}/${fieldName}`);
 }
 /**
  * Narrows a post-call field kind for the two arms that hand a kind to the index provisioner.
@@ -174,19 +195,22 @@ export function buildQueryableFieldIndexName(params) {
  * @overallScore 100
  */
 function assertIndexableForProvisioning(kind) {
-    if (!isIndexableFieldKind(kind)) {
-        throw new InvalidFieldKindError(`storage-only kind '${String(kind)}' reached index provisioning; only (${INDEXABLE_FIELD_KINDS.join("|")}) may be queryable — U-001-B1`);
+    const candidate = { value: kind };
+    if (!isIndexableFieldKind(candidate)) {
+        // See docs/decisions/DR-001-safe-schema-and-index-transitions.md for the invariant behind this refusal; keep external identifiers out of caller-facing messages.
+        throw new InvalidFieldKindError({ message: `storage-only kind '${String(kind)}' reached index provisioning; only (${INDEXABLE_FIELD_KINDS.join("|")}) may be queryable` });
     }
-    return kind;
+    return candidate.value;
 }
 /**
- * CIC U-003-B1 — resolves a single field's index transition from ONE before/after comparison of
+ * — resolves a single field's index transition from ONE before/after comparison of
  * its `(kind, queryable)` pair, never from two independent branches that each assume the other
  * property is unchanged (the bug class this closes: a field whose `kind` AND `queryable` both
- * change in the same call must still resolve correctly — REQ-30(b)).
+ * change in the same call must still resolve correctly — (b)).
  *
  * @complexity O(1) — four comparisons, one of four fixed outcomes.
  * @overallScore 100
+ * See docs/decisions/DR-001-safe-schema-and-index-transitions.md.
  */
 export function resolveFieldIndexTransition(params) {
     const beforeQueryable = params.before?.queryable ?? false;

package/dist/content-types/index.d.ts

@@ -6,7 +6,7 @@
  *
  * See `../entries/index.js`'s header for why these two ship as separate subpaths rather than one.
  */
-export type { ContentTypeFieldKind, IndexableFieldKind, StorageOnlyFieldKind, ContentTypeFieldDef, ContentTypeStatus, ContentTypeRecord, ActorPrincipalKind, ActorIdentityInput, Result, } from "./types.js";
+export type { ContentTypeFieldKind, IndexableFieldKind, StorageOnlyFieldKind, ContentTypeFieldDef, ContentTypeStatus, ContentTypeRecord, ActorPrincipalKind, ActorIdentityInput, } from "./types.js";
 /**
  * `CONTENT_TYPE_FIELD_KINDS`/`isContentTypeFieldKind` answer "may this kind be DECLARED and
  * STORED". `INDEXABLE_FIELD_KINDS`/`isIndexableFieldKind` answer the narrower "may this kind be
@@ -36,7 +36,8 @@ StorageOnlyFieldNotQueryableError, InvalidFieldShapeError, QueryableFieldCapExce
  * single definition of the identifier grammar — the published agent-tool schemas reference it
  * rather than restating it, and a consumer validating input ahead of a call must reach the same
  * one. `mapFieldKindToCast`/`buildQueryableFieldIndexName` are what a host's own DDL provisioner
- * needs in order to generate the same index names this module expects to find.
+ * needs in order to generate the same index names this module expects to find. The index-name
+ * builder returns a promise: await its Web Crypto hash before passing the name to DDL.
  */
 export type { FieldIndexState, FieldIndexTransition } from "./index-provisioning.js";
 export { IDENTIFIER_GRAMMAR_PATTERN, validateIdentifierGrammar, mapFieldKindToCast, buildQueryableFieldIndexName, resolveFieldIndexTransition, } from "./index-provisioning.js";
@@ -60,7 +61,7 @@ export { planCleanup, executeCleanup } from "./cleanup.js";
  */
 export { InMemoryContentTypeRepo, NoopContentTypeIndexProvisioner, toContentTypeOutbox, } from "./repo.memory.js";
 /** The agent-tool surface for this domain (see `agent-tools.ts` for what is deliberately omitted). */
-export { contentTypesAgentToolCatalog, type AgentToolDefinition as ContentTypesAgentToolDefinition, type AgentToolSideEffect as ContentTypesAgentToolSideEffect, type AgentToolActorClassRule as ContentTypesAgentToolActorClassRule, } from "./agent-tools.js";
+export { contentTypesAgentToolCatalog, } from "./agent-tools.js";
 /**
  * The agent-tool wiring for this domain.
  *

package/dist/content-types/lifecycle-dispatch.d.ts

@@ -1,7 +1,8 @@
-import type { ClockPort } from "../core/ports.js";
+import type { Clock } from "@jini-ai/core/primitives";
 import type { AuthorizeFn, ContentTypeRepoPort, OutboxPort } from "./write-service.js";
 import type { TeardownIndexProvisionerPort } from "./lifecycle.js";
-import type { ActorPrincipalKind, ContentTypeRecord, Result } from "./types.js";
+import type { Result } from "@jini-ai/core/primitives";
+import type { ActorPrincipalKind, ContentTypeRecord } from "./types.js";
 /**
  * @file Content-type lifecycle `op` dispatch (the closed-union-dispatch convention,
  * `features/settings/definitions-dispatch.ts`'s pattern reused verbatim for this domain).
@@ -15,10 +16,12 @@ import type { ActorPrincipalKind, ContentTypeRecord, Result } from "./types.js";
 export declare const CONTENT_TYPE_LIFECYCLE_OP_NAMES: readonly ["deprecate", "reactivate", "tombstone"];
 export type ContentTypeLifecycleOp = (typeof CONTENT_TYPE_LIFECYCLE_OP_NAMES)[number];
 /** Narrows an untrusted `op` string to {@link ContentTypeLifecycleOp}, or `null` if it isn't one. */
-export declare function parseContentTypeLifecycleOp(op: unknown): ContentTypeLifecycleOp | null;
+export declare function parseContentTypeLifecycleOp(requiredArgs: {
+    op: unknown;
+}, optionalArgs?: Record<string, never>): ContentTypeLifecycleOp | null;
 export interface LifecycleDispatchDeps {
     repo: ContentTypeRepoPort;
-    clock: ClockPort;
+    clock: Clock;
     authorize: AuthorizeFn;
     outbox: OutboxPort;
     indexProvisioner: TeardownIndexProvisionerPort;
@@ -31,7 +34,10 @@ export interface LifecycleDispatchInput {
     /** Threaded straight through to {@link LifecycleTransitionInput.principalKind} — the audit provenance stamped on the revision row. */
     principalKind?: ActorPrincipalKind;
 }
-export type ContentTypeLifecycleHandler = (deps: LifecycleDispatchDeps, input: LifecycleDispatchInput) => Promise<Result<{
+export type ContentTypeLifecycleHandler = (required: {
+    deps: LifecycleDispatchDeps;
+    input: LifecycleDispatchInput;
+}, optional?: Record<string, never>) => Promise<Result<{
     contentType: ContentTypeRecord;
 }, Error>>;
 export declare const CONTENT_TYPE_LIFECYCLE_OPS: Record<ContentTypeLifecycleOp, ContentTypeLifecycleHandler>;

package/dist/content-types/lifecycle-dispatch.js

@@ -11,7 +11,8 @@ import { deprecateContentType, reactivateContentType, tombstoneContentType } fro
  */
 export const CONTENT_TYPE_LIFECYCLE_OP_NAMES = ["deprecate", "reactivate", "tombstone"];
 /** Narrows an untrusted `op` string to {@link ContentTypeLifecycleOp}, or `null` if it isn't one. */
-export function parseContentTypeLifecycleOp(op) {
+export function parseContentTypeLifecycleOp(requiredArgs, optionalArgs = {}) {
+    const { op } = requiredArgs;
     return typeof op === "string" && CONTENT_TYPE_LIFECYCLE_OP_NAMES.includes(op)
         ? op
         : null;
@@ -20,9 +21,9 @@ export function parseContentTypeLifecycleOp(op) {
  * (defense-in-depth against a prototype-chain key ever resolving, matching the settings
  * dispatch table's own convention). */
 const contentTypeLifecycleOps = {
-    deprecate: (deps, input) => deprecateContentType({ deps, input }),
-    reactivate: (deps, input) => reactivateContentType({ deps: { repo: deps.repo, clock: deps.clock, authorize: deps.authorize }, input }),
-    tombstone: (deps, input) => tombstoneContentType({ deps, input }),
+    deprecate: ({ deps, input }) => deprecateContentType({ deps, input }),
+    reactivate: ({ deps, input }) => reactivateContentType({ deps: { repo: deps.repo, clock: deps.clock, authorize: deps.authorize }, input }),
+    tombstone: ({ deps, input }) => tombstoneContentType({ deps, input }),
 };
 export const CONTENT_TYPE_LIFECYCLE_OPS = Object.assign(Object.create(null), contentTypeLifecycleOps);
 //# sourceMappingURL=lifecycle-dispatch.js.map

package/dist/content-types/lifecycle.d.ts

@@ -1,28 +1,30 @@
-import type { ClockPort } from "../core/ports.js";
+import type { Clock } from "@jini-ai/core/primitives";
 import type { AuthorizeFn, ContentTypeRepoPort, OutboxPort } from "./write-service.js";
-import type { ActorPrincipalKind, ContentTypeRecord, Result } from "./types.js";
+import type { Result } from "@jini-ai/core/primitives";
+import type { ActorPrincipalKind, ContentTypeRecord } from "./types.js";
 /**
- * @file REQ-09..12 — the content-type lifecycle state machine `active ⇄ deprecated ->
- * tombstone` (INV-06).
+ * @file..12 — the content-type lifecycle state machine `active ⇄ deprecated ->
+ * tombstone`.
  *
  * Purpose:
  * `deprecateContentType`/`reactivateContentType` are the reversible `active <-> deprecated` pair
- * (deprecate blocks new-entry creation only, per REQ-10/REQ-28's asymmetry — existing entries stay
+ * (deprecate blocks new-entry creation only, per asymmetry — existing entries stay
  * fully readable/writable). `tombstoneContentType` is the one-way terminal transition: it MUST be
- * entered from `deprecated` (EC-09, "must deprecate first") and never left (INV-06) — both
+ * entered from `deprecated` ("must deprecate first") and never left — both
  * `reactivateContentType` and `deprecateContentType` reject unconditionally against a tombstoned
- * row (the property `operationTests INV-06` case). Tombstoning tears down every queryable-field
- * index the type ever provisioned (AC-17) and enqueues the same-call outbox event
+ * row (the property `operationTests ` case). Tombstoning tears down every queryable-field
+ * index the type ever provisioned and enqueues the same-call outbox event
  * required for `content_type.deprecated`/`content_type.tombstoned`.
  *
  * How it relates to the project:
  * `reactivateContentType` deliberately does not accept `outbox`/`indexProvisioner` deps — no
  * certified test requires a reactivation event or index reprovisioning on this transition, and
- * REQ-09..12 name only deprecate/tombstone as outbox-obligated.
+ * 12 name only deprecate/tombstone as outbox-obligated.
  *
  * Architectural role:
  * `features/content-types` domain logic, composing `write-service.ts`'s repo/outbox/index-
  * provisioner port shapes rather than redeclaring them.
+ * See docs/decisions/DR-002-content-lifecycle-and-cleanup.md.
  */
 export interface LifecycleTransitionInput {
     workspaceId: string;
@@ -35,19 +37,20 @@ export interface LifecycleTransitionInput {
 export interface DeprecateContentTypeRequired {
     deps: {
         repo: ContentTypeRepoPort;
-        clock: ClockPort;
+        clock: Clock;
         authorize: AuthorizeFn;
         outbox: OutboxPort;
     };
     input: LifecycleTransitionInput;
 }
 /**
- * AC-13/AC-19 — flips an active type to `deprecated` (blocks only NEW entry creation, REQ-10) and
- * enqueues `content_type.deprecated` in the same call. Rejected unconditionally (INV-06) if the
+ * — flips an active type to `deprecated` (blocks only NEW entry creation) and
+ * enqueues `content_type.deprecated` in the same call. Rejected unconditionally if the
  * type is already `tombstone` — deprecate can never be used to "step back" out of tombstone.
  *
  * @complexity O(1) plus one repo read, one same-tx write pair, and one outbox enqueue.
  * @overallScore 100
+ * See docs/decisions/DR-002-content-lifecycle-and-cleanup.md.
  */
 export declare function deprecateContentType(required: DeprecateContentTypeRequired): Promise<Result<{
     contentType: ContentTypeRecord;
@@ -55,17 +58,18 @@ export declare function deprecateContentType(required: DeprecateContentTypeRequi
 export interface ReactivateContentTypeRequired {
     deps: {
         repo: ContentTypeRepoPort;
-        clock: ClockPort;
+        clock: Clock;
         authorize: AuthorizeFn;
     };
     input: LifecycleTransitionInput;
 }
 /**
- * AC-13 — flips a `deprecated` (or already-`active`, a no-op-shaped success) type back to
- * `active`. Rejected unconditionally (AC-14/INV-06) against a tombstoned row.
+ * — flips a `deprecated` (or already-`active`, a no-op-shaped success) type back to
+ * `active`. Rejected unconditionally against a tombstoned row.
  *
  * @complexity O(1) plus one repo read and one same-tx write pair.
  * @overallScore 100
+ * See docs/decisions/DR-002-content-lifecycle-and-cleanup.md.
  */
 export declare function reactivateContentType(required: ReactivateContentTypeRequired): Promise<Result<{
     contentType: ContentTypeRecord;
@@ -80,7 +84,7 @@ export interface TeardownIndexProvisionerPort {
 export interface TombstoneContentTypeRequired {
     deps: {
         repo: ContentTypeRepoPort;
-        clock: ClockPort;
+        clock: Clock;
         authorize: AuthorizeFn;
         outbox: OutboxPort;
         indexProvisioner: TeardownIndexProvisionerPort;
@@ -88,15 +92,16 @@ export interface TombstoneContentTypeRequired {
     input: LifecycleTransitionInput;
 }
 /**
- * AC-17/AC-20/EC-09 — the one-way terminal transition into `tombstone`. Must be entered from
+ * — the one-way terminal transition into `tombstone`. Must be entered from
  * `deprecated` (any other status, including an already-tombstoned row, is rejected with the same
- * "must deprecate first" guard — EC-09/INV-06 collapse to one check). Tears down every queryable-
+ * "must deprecate first" guard — collapse to one check). Tears down every queryable-
  * field index the type ever provisioned BEFORE persisting the status flip, and enqueues
  * `content_type.tombstoned` in the same call.
  *
  * @complexity O(1) plus one repo read, one index-teardown call, one same-tx write pair, and one
  * outbox enqueue.
  * @overallScore 100
+ * See docs/decisions/DR-002-content-lifecycle-and-cleanup.md.
  */
 export declare function tombstoneContentType(required: TombstoneContentTypeRequired): Promise<Result<{
     contentType: ContentTypeRecord;