@jini-ai/cms 0.3.11 → 0.4.0

package/dist/taxonomy/agent-tools.d.ts

@@ -1,69 +1,4 @@
-/**
- * @file The Taxonomy agent-tool catalog — this domain's instance of the per-domain
- * `agent-tools.ts` convention `features/content-types/agent-tools.ts`,
- * `features/database/agent-tools.ts`, and every other domain catalog already use.
- *
- * Purpose:
- * A static, in-process catalog describing every agent-callable tool this domain exposes. Every
- * WRITE entry maps 1:1 onto a real exported function of `features/taxonomy/write-service.ts`
- * (`createTaxonomy`, `createTerm`, `renameTerm`, `assignTerms`); the one read maps onto
- * `features/taxonomy/list.ts`'s `listTaxonomiesWithTerms`.
- *
- * `mergeTerm` (`merge-term.ts`) — read carefully, treated with the same scrutiny Database's
- * `migrate-forward` and Recovery's `restore` ceremonies got:
- * Merge is destructive and can silently lose pre-merge `entry_terms` assignment history for content
- * already assigned to both terms (`merge-term.ts`'s own file header: "Destructive term
- * merge" failure mode). That is why it alone, of every taxonomy mutation, gets a plan/confirm/
- * execute ceremony through `core/gated-mutations` rather than an ordinary authorize-then-write.
- * Reading `core/gated-mutations/gateway.ts` directly settles what is and is not safe to hand an
- * agent:
- *   - `plan()` "Never invokes `hooks.executeMutation()` — a plan is read-only by construction
- *     (AC-10)" (`gateway.ts`'s own doc comment). It authorizes `admin.taxonomy.manage`, recomputes
- *     the live overlap-loss disclosure, and returns a plan. Persists nothing. Safe to wire as a
- *     READ, mirroring `features/database/agent-tools.ts`'s identical `database_plan_migrate_forward`
- *     precedent (same file's own comment: "the step that actually redeems a plan into a mutation
- *     (confirm()) can never be reached by an agent principal at all").
- *   - `confirm()` structurally refuses an agent: `gateway.ts`'s own body — "if (principalKind ===
- *     'agent') throw new ForbiddenError('agent principals may not confirm a gated mutation', ...)"
- *     — before any permission check even runs. No `taxonomy_confirm_merge_term`-equivalent tool
- *     exists in this catalog.
- *   - `taxonomy_execute_merge_term` (2026-09-24) asks the human in chat before it runs: the host
- *     wires it with the kit's `humanConfirmedHandler`, which shows a confirm dialog and only on the
- *     human's own click confirms as that human (`kind='user'`) and executes as the agent acting for
- *     them — the `confirmer-must-equal-own-delegatedBy` rule. The model never sees or supplies a
- *     token. A merge deletes the source term's assignments with no Trash or undo, so it is gated.
- *
- * Naming: `taxonomy_*`, matching this package's own name — distinct from `features/content-types`'
- * `collections_*` prefix (a different pairing) and from `features/entries`' own
- * `collections_entry_*` prefix.
- *
- * How it relates to the project:
- * `features/taxonomy/tool-registrations.ts` maps these entries into `@jini-ai/core`
- * `ToolRegistration`s.
- *
- * Architectural role:
- * `features/taxonomy` domain declaration. As of A2 (taxonomy plan) it imports nothing from its own
- * `write-service.ts` — `contentType` is published as an open string (see `CONTENT_TYPE_SCHEMA`
- * below), since Collections entries widened the set of legal values past the fixed `post`/`page`
- * allow-list this file used to mirror as an `enum`.
- */
-export type AgentToolSideEffect = "none" | "mutates-durable-state" | "mints-token";
-export type AgentToolActorClassRule = "confirmer-must-equal-own-delegatedBy" | "user-only" | "none";
-export interface AgentToolDefinition {
-    name: string;
-    description: string;
-    sideEffects: AgentToolSideEffect;
-    authorization: {
-        permission: string;
-    };
-    actorClassRule?: AgentToolActorClassRule;
-    /**
-     * JSON Schema for this tool's `input`, published to the model via `ToolDescriptor.inputSchema`
-     * (`assistant/tool-registration-kit.ts`'s `buildDomainRegistrations`, which refuses to wire any
-     * tool lacking one).
-     */
-    inputSchema?: Readonly<Record<string, unknown>>;
-}
+import type { AgentToolDefinition } from "@jini-ai/core";
 /** The Taxonomy domain's fixed agent-tool catalog: 7 wired (1 read, 5 ordinary writes, 1 gated-plan
  * read) + 1 declared-but-never-wired destructive tool — see this file's header for the full
  * `mergeTerm` safety analysis. */

package/dist/taxonomy/agent-tools.js

@@ -17,21 +17,21 @@
  * execute ceremony through `core/gated-mutations` rather than an ordinary authorize-then-write.
  * Reading `core/gated-mutations/gateway.ts` directly settles what is and is not safe to hand an
  * agent:
- *   - `plan()` "Never invokes `hooks.executeMutation()` — a plan is read-only by construction
- *     (AC-10)" (`gateway.ts`'s own doc comment). It authorizes `admin.taxonomy.manage`, recomputes
- *     the live overlap-loss disclosure, and returns a plan. Persists nothing. Safe to wire as a
- *     READ, mirroring `features/database/agent-tools.ts`'s identical `database_plan_migrate_forward`
- *     precedent (same file's own comment: "the step that actually redeems a plan into a mutation
- *     (confirm()) can never be reached by an agent principal at all").
- *   - `confirm()` structurally refuses an agent: `gateway.ts`'s own body — "if (principalKind ===
- *     'agent') throw new ForbiddenError('agent principals may not confirm a gated mutation', ...)"
- *     — before any permission check even runs. No `taxonomy_confirm_merge_term`-equivalent tool
- *     exists in this catalog.
- *   - `taxonomy_execute_merge_term` (2026-09-24) asks the human in chat before it runs: the host
- *     wires it with the kit's `humanConfirmedHandler`, which shows a confirm dialog and only on the
- *     human's own click confirms as that human (`kind='user'`) and executes as the agent acting for
- *     them — the `confirmer-must-equal-own-delegatedBy` rule. The model never sees or supplies a
- *     token. A merge deletes the source term's assignments with no Trash or undo, so it is gated.
+ * - `plan` "Never invokes `hooks.executeMutation` — a plan is read-only by construction
+ * " (`gateway.ts`'s own doc comment). It authorizes `admin.taxonomy.manage`, recomputes
+ * the live overlap-loss disclosure, and returns a plan. Persists nothing. Safe to wire as a
+ * READ, mirroring `features/database/agent-tools.ts`'s identical `database_plan_migrate_forward`
+ * precedent (same file's own comment: "the step that actually redeems a plan into a mutation
+ * (confirm) can never be reached by an agent principal at all").
+ * - `confirm` structurally refuses an agent: `gateway.ts`'s own body — "if (principalKind ===
+ * 'agent') throw new ForbiddenError('agent principals may not confirm a gated mutation',...)"
+ * — before any permission check even runs. No `taxonomy_confirm_merge_term`-equivalent tool
+ * exists in this catalog.
+ * - `taxonomy_execute_merge_term` (2026-09-24) asks the human in chat before it runs: the host
+ * wires it with the kit's `humanConfirmedHandler`, which shows a confirm dialog and only on the
+ * human's own click confirms as that human (`kind='user'`) and executes as the agent acting for
+ * them — the `confirmer-must-equal-own-delegatedBy` rule. The model never sees or supplies a
+ * token. A merge deletes the source term's assignments with no Trash or undo, so it is gated.
  *
  * Naming: `taxonomy_*`, matching this package's own name — distinct from `features/content-types`'
  * `collections_*` prefix (a different pairing) and from `features/entries`' own
@@ -46,7 +46,17 @@
  * `write-service.ts` — `contentType` is published as an open string (see `CONTENT_TYPE_SCHEMA`
  * below), since Collections entries widened the set of legal values past the fixed `post`/`page`
  * allow-list this file used to mirror as an `enum`.
+ * See docs/decisions/DR-005-ordered-taxonomy-validation.md.
  */
+// A2 (taxonomy plan) — no longer imported: `CONTENT_TYPE_SCHEMA` used to build its `enum` from
+// this set, which would reject a Collection key (any `contentType` other than `post`/`page`) at
+// the agent's own input-schema validation, before the write-service's `contentTypeTaxonomyPolicy`
+// ever gets a chance to decide eligibility. See `CONTENT_TYPE_SCHEMA`'s doc comment below.
+/**
+   * JSON Schema for this tool's `input`, published to the model via `ToolDescriptor.inputSchema`
+   * (`@jini-ai/core`'s `registration-kit.ts`'s `buildDomainRegistrations`, which refuses to wire any
+   * tool lacking one).
+   */
 const TAXONOMY_ID_SCHEMA = {
     type: "string",
     minLength: 1,

package/dist/taxonomy/content-lookup.js

@@ -40,7 +40,7 @@ export function createContentLookup(deps) {
     const entryLookup = createEntryBackedContentLookup({ entryRepo: deps.entryRepo, workspaceId: deps.workspaceId });
     return {
         async resolve(params) {
-            return isContentTypeOnAllowList(params.contentType) ? postLookup.resolve(params) : entryLookup.resolve(params);
+            return isContentTypeOnAllowList({ contentType: params.contentType }) ? postLookup.resolve(params) : entryLookup.resolve(params);
         },
     };
 }

package/dist/taxonomy/index.d.ts

@@ -19,7 +19,7 @@
  * has no imports at all: the ceremony is a parameter, not a dependency.
  */
 export { TaxonomyNotApplicableError, WorkspaceMismatchError, ContentTypeMismatchError, TaxonomyNotHierarchicalError, ParentCrossTaxonomyError, TermNotFoundError, HierarchyCycleDetectedError, wouldCreateCycle, validateContentJoin, validateHierarchyAssignment, type TermTreeLookup, } from "./validation-chain.js";
-export { TAXONOMY_ALLOWED_CONTENT_TYPES, isContentTypeOnAllowList, TaxonomyRecordNotFoundError, TermRecordNotFoundError, ContentRecordNotFoundError, TermHasAssignedContentError, TermHasChildTermsError, TaxonomyHasAssignedContentError, TaxonomyVersionConflictError, createTaxonomy, createTerm, renameTerm, assignTerms, unassignTerms, deleteTerm, deleteTaxonomy, onContentDeleted, importTaxonomy, importTerm, type AuthorizeFn, type Taxonomy, type Term, type TaxonomyRepoPort, type TermRepoPort, type EntryTermRepoPort, type ContentLookupPort, type ContentTypeTaxonomyPolicyPort, type UnassignableEntryTermRepoPort, type TaxonomyRevisionRow, type TaxonomyRevisionRepoPort, type ClockPort, type IdGeneratorPort, type WriteServiceDeps, type CreateTaxonomyRequired, type CreateTermRequired, type RenameTermRequired, type AssignTermsRequired, type UnassignTermsRequired, type DeleteTermRequired, type DeleteTaxonomyRequired, type DeletableTaxonomyRepoPort, type DeletableTermRepoPort, type AssignmentCountEntryTermRepoPort, type TransactionalRepoPort, type EntryTermsCleanupPort, type OnContentDeletedRequired, type ImportableTaxonomyRepoPort, type ImportableTermRepoPort, type ImportTaxonomyRequired, type ImportTermRequired, } from "./write-service.js";
+export { TAXONOMY_ALLOWED_CONTENT_TYPES, isContentTypeOnAllowList, TaxonomyRecordNotFoundError, TermRecordNotFoundError, ContentRecordNotFoundError, TermHasAssignedContentError, TermHasChildTermsError, TaxonomyHasAssignedContentError, TaxonomyVersionConflictError, createTaxonomy, createTerm, renameTerm, assignTerms, unassignTerms, deleteTerm, deleteTaxonomy, onContentDeleted, importTaxonomy, importTerm, type AuthorizeFn, type Taxonomy, type Term, type TaxonomyRepoPort, type TermRepoPort, type EntryTermRepoPort, type ContentLookupPort, type ContentTypeTaxonomyPolicyPort, type UnassignableEntryTermRepoPort, type TaxonomyRevisionRow, type TaxonomyRevisionRepoPort, type WriteServiceDeps, type CreateTaxonomyRequired, type CreateTermRequired, type CreateTermOptional, type RenameTermRequired, type AssignTermsRequired, type UnassignTermsRequired, type DeleteTermRequired, type DeleteTaxonomyRequired, type DeletableTaxonomyRepoPort, type DeletableTermRepoPort, type AssignmentCountEntryTermRepoPort, type TransactionalRepoPort, type EntryTermsCleanupPort, type OnContentDeletedRequired, type ImportableTaxonomyRepoPort, type ImportableTermRepoPort, type ImportTaxonomyRequired, type ImportTermRequired, type ImportTermOptional, } from "./write-service.js";
 export { listTaxonomiesWithTerms, type TaxonomyListPort, type TermListPort, type TaxonomyWithTerms, } from "./list.js";
 /**
  * The domain half of the `mergeTerm` ceremony — see this file's header for why the gateway itself
@@ -34,5 +34,5 @@ export { InMemoryTaxonomyRepo, InMemoryTermRepo, InMemoryEntryTermRepo, InMemory
  */
 export { createPostBackedContentLookup, createEntryBackedContentLookup, createContentLookup, type ContentRecordLookupPort, type EntryRecordLookupPort, } from "./content-lookup.js";
 /** The agent-tool surface for this domain (see `agent-tools.ts` for what is deliberately omitted). */
-export { taxonomyAgentToolCatalog, type AgentToolDefinition as TaxonomyAgentToolDefinition, type AgentToolSideEffect as TaxonomyAgentToolSideEffect, type AgentToolActorClassRule as TaxonomyAgentToolActorClassRule, } from "./agent-tools.js";
+export { taxonomyAgentToolCatalog, } from "./agent-tools.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/taxonomy/merge-term.d.ts

@@ -17,7 +17,9 @@
  * enforced by `merge-term.unit.test.ts`'s own export-surface inspection.
  */
 export declare class SameTermMergeError extends Error {
-    constructor(message: string);
+    constructor(requiredArgs: {
+        message: string;
+    }, optionalArgs?: Record<string, never>);
 }
 export interface MergeTermPlanDetails {
     fromTermId: string;
@@ -43,13 +45,14 @@ export interface PlanMergeTermRequired {
     }>;
 }
 /**
- * AC-22a/REQ-15a/INV-08 — rejects `fromTermId === intoTermId` structurally BEFORE
- * `computeOverlap()` ever runs (no plan, therefore no token, can ever exist for a self-merge).
- * AC-23/AC-24/REQ-16 — the returned plan discloses whether the merge would lose any pre-existing
+ * — rejects `fromTermId === intoTermId` structurally BEFORE
+ * `computeOverlap` ever runs (no plan, therefore no token, can ever exist for a self-merge).
+ * — the returned plan discloses whether the merge would lose any pre-existing
  * overlapping assignment (never a false "no loss" when `overlappingContentCount > 0`).
  *
  * @complexity O(1) plus the caller-supplied `computeOverlap`/`gatewayPlan` costs.
  * @overallScore 100
+ * See docs/decisions/DR-005-ordered-taxonomy-validation.md.
  */
 export declare function planMergeTerm(required: PlanMergeTermRequired, _optional?: Record<string, never>): Promise<{
     planId: string;

package/dist/taxonomy/merge-term.js

@@ -17,24 +17,26 @@
  * enforced by `merge-term.unit.test.ts`'s own export-surface inspection.
  */
 export class SameTermMergeError extends Error {
-    constructor(message) {
+    constructor(requiredArgs, optionalArgs = {}) {
+        const { message } = requiredArgs;
         super(message);
         this.name = "SameTermMergeError";
     }
 }
 /**
- * AC-22a/REQ-15a/INV-08 — rejects `fromTermId === intoTermId` structurally BEFORE
- * `computeOverlap()` ever runs (no plan, therefore no token, can ever exist for a self-merge).
- * AC-23/AC-24/REQ-16 — the returned plan discloses whether the merge would lose any pre-existing
+ * — rejects `fromTermId === intoTermId` structurally BEFORE
+ * `computeOverlap` ever runs (no plan, therefore no token, can ever exist for a self-merge).
+ * — the returned plan discloses whether the merge would lose any pre-existing
  * overlapping assignment (never a false "no loss" when `overlappingContentCount > 0`).
  *
  * @complexity O(1) plus the caller-supplied `computeOverlap`/`gatewayPlan` costs.
  * @overallScore 100
+ * See docs/decisions/DR-005-ordered-taxonomy-validation.md.
  */
 export async function planMergeTerm(required, _optional = {}) {
     const { fromTermId, intoTermId, computeOverlap, gatewayPlan } = required;
     if (fromTermId === intoTermId) {
-        throw new SameTermMergeError(`cannot merge term '${fromTermId}' into itself`);
+        throw new SameTermMergeError({ message: `cannot merge term '${fromTermId}' into itself` });
     }
     const { overlappingContentCount } = await computeOverlap();
     const details = {

package/dist/taxonomy/repo.memory.d.ts

@@ -1,3 +1,4 @@
+import type { Clock } from "@jini-ai/core/primitives";
 import type { ContentLookupPort, EntryTermRepoPort, TaxonomyRepoPort, TaxonomyRevisionRepoPort, TaxonomyRevisionRow, Term, TermRepoPort, UnassignableEntryTermRepoPort } from "./write-service.js";
 import type { Taxonomy } from "./write-service.js";
 import type { TaxonomyListPort, TermListPort } from "./list.js";
@@ -8,20 +9,26 @@ import type { TaxonomyListPort, TermListPort } from "./list.js";
 export declare class InMemoryTaxonomyRepo implements TaxonomyRepoPort, TaxonomyListPort {
     private readonly rows;
     insert(row: Taxonomy): Promise<unknown>;
-    findById(id: string): Promise<{
+    findById({ id }: {
+        id: string;
+    }): Promise<{
         id: string;
         hierarchical: boolean;
         allowList?: string[] | undefined;
     } | null>;
     /** `ImportableTaxonomyRepoPort` — additive capability for `importTaxonomy`'s CAS check and
      * update-in-place, see `write-service.ts`'s doc comment on that interface. */
-    findByIdFull(id: string): Promise<Taxonomy | null>;
+    findByIdFull({ id }: {
+        id: string;
+    }): Promise<Taxonomy | null>;
     /** `ImportableTaxonomyRepoPort` — writes an existing row back in place, preserving its id. */
     update(row: Taxonomy): Promise<unknown>;
     list(): Promise<Taxonomy[]>;
     /** `DeletableTaxonomyRepoPort` — additive capability for `deleteTaxonomy`, see
      * `write-service.ts`'s doc comment on that interface. */
-    delete(id: string): Promise<void>;
+    delete({ id }: {
+        id: string;
+    }): Promise<void>;
     /**
      * `TransactionalRepoPort` — disclosed narrowing, not a silently-wrong implementation of a real
      * capability (same disclosure style as `noopStampWatermark` below): a plain in-process `Map` has
@@ -38,30 +45,40 @@ export declare class InMemoryTaxonomyRepo implements TaxonomyRepoPort, TaxonomyL
      * app.ts`'s hermetic composition), never the host of a real workspace's real content, which is
      * why this gap is accepted here rather than closed.
      */
-    transaction<T>(fn: () => Promise<T>): Promise<T>;
+    transaction<T>({ fn }: {
+        fn: () => Promise<T>;
+    }): Promise<T>;
 }
 export declare class InMemoryTermRepo implements TermRepoPort, TermListPort {
     private readonly rows;
     insert(row: Term): Promise<unknown>;
     update(row: Term): Promise<unknown>;
-    findById(id: string): Promise<{
+    findById({ id }: {
+        id: string;
+    }): Promise<{
         id: string;
         taxonomyId: string;
         name?: string | undefined;
     } | null>;
     /** `ImportableTermRepoPort` — additive capability for `importTerm`'s CAS check, see
      * `write-service.ts`'s doc comment on that interface. */
-    findByIdFull(id: string): Promise<Term | null>;
+    findByIdFull({ id }: {
+        id: string;
+    }): Promise<Term | null>;
     listByTaxonomy(params: {
         taxonomyId: string;
     }): Promise<Term[]>;
     /** Ancestor-chain lookup for `validation-chain.ts`'s `wouldCreateCycle` — not required by any
      * currently-wired route (reparent has no route this pass, design-spec.md §2.8), kept here so a
      * future reparent route has a ready-made `TermTreeLookup` to inject. */
-    getParentId(termId: string): string | null;
+    getParentId({ termId }: {
+        termId: string;
+    }): string | null;
     /** `DeletableTermRepoPort` — additive capability for `deleteTerm`/`deleteTaxonomy`, see
      * `write-service.ts`'s doc comment on that interface. */
-    delete(id: string): Promise<void>;
+    delete({ id }: {
+        id: string;
+    }): Promise<void>;
     /** `DeletableTermRepoPort.countChildren` — direct children only (one level), matching
      * `deleteTerm`'s guard (it does not recurse past the first level; a grandchild whose direct
      * parent is itself already blocked from deletion is caught when that intermediate term's own
@@ -124,15 +141,21 @@ export declare class InMemoryTaxonomyRevisionRepo implements TaxonomyRevisionRep
  */
 export declare class InMemoryContentLookup implements ContentLookupPort {
     private readonly rows;
-    constructor(seed?: Array<{
+    constructor(requiredArgs: Record<string, never>, optionalArgs?: {
+        seed?: Array<{
+            contentType: string;
+            contentId: string;
+            workspaceId: string;
+            kind: string;
+        }>;
+    });
+    set({ contentType, contentId, value }: {
         contentType: string;
         contentId: string;
-        workspaceId: string;
-        kind: string;
-    }>);
-    set(contentType: string, contentId: string, value: {
-        workspaceId: string;
-        kind: string;
+        value: {
+            workspaceId: string;
+            kind: string;
+        };
     }): void;
     resolve(params: {
         contentType: string;
@@ -161,9 +184,7 @@ export declare function toTaxonomyOutbox(deps: {
             payload: Record<string, unknown>;
         }): Promise<void>;
     };
-    clock: {
-        nowIso(): string;
-    };
+    clock: Clock;
     idGen: {
         newId(): string;
     };
@@ -172,6 +193,8 @@ export declare function toTaxonomyOutbox(deps: {
      * (`{name, taxonomyId, actorId, occurredAt}`) carry no `workspaceId` at all. */
     workspaceId: string;
 }): {
-    enqueue: (event: unknown) => Promise<void>;
+    enqueue: ({ event }: {
+        event: unknown;
+    }) => Promise<void>;
 };
 //# sourceMappingURL=repo.memory.d.ts.map

package/dist/taxonomy/repo.memory.js

@@ -1,3 +1,4 @@
+import { nowIso as kernelNowIso } from "@jini-ai/core/primitives";
 /**
  * @file In-memory adapters for the `taxonomy` package's write/list ports — same disclosed
  * rule-of-two-until-a-real-adapter-exists precedent as `features/content-types/repo.memory.ts`.
@@ -8,13 +9,13 @@ export class InMemoryTaxonomyRepo {
         this.rows.set(row.id, { ...row });
         return row;
     }
-    async findById(id) {
+    async findById({ id }) {
         const row = this.rows.get(id);
         return row ? { id: row.id, hierarchical: row.hierarchical } : null;
     }
     /** `ImportableTaxonomyRepoPort` — additive capability for `importTaxonomy`'s CAS check and
      * update-in-place, see `write-service.ts`'s doc comment on that interface. */
-    async findByIdFull(id) {
+    async findByIdFull({ id }) {
         const row = this.rows.get(id);
         return row ? { ...row } : null;
     }
@@ -28,7 +29,7 @@ export class InMemoryTaxonomyRepo {
     }
     /** `DeletableTaxonomyRepoPort` — additive capability for `deleteTaxonomy`, see
      * `write-service.ts`'s doc comment on that interface. */
-    async delete(id) {
+    async delete({ id }) {
         this.rows.delete(id);
     }
     /**
@@ -47,7 +48,7 @@ export class InMemoryTaxonomyRepo {
      * app.ts`'s hermetic composition), never the host of a real workspace's real content, which is
      * why this gap is accepted here rather than closed.
      */
-    async transaction(fn) {
+    async transaction({ fn }) {
         return fn();
     }
 }
@@ -61,13 +62,13 @@ export class InMemoryTermRepo {
         this.rows.set(row.id, { ...row });
         return row;
     }
-    async findById(id) {
+    async findById({ id }) {
         const row = this.rows.get(id);
         return row ? { id: row.id, taxonomyId: row.taxonomyId, name: row.name } : null;
     }
     /** `ImportableTermRepoPort` — additive capability for `importTerm`'s CAS check, see
      * `write-service.ts`'s doc comment on that interface. */
-    async findByIdFull(id) {
+    async findByIdFull({ id }) {
         const row = this.rows.get(id);
         return row ? { ...row } : null;
     }
@@ -77,12 +78,12 @@ export class InMemoryTermRepo {
     /** Ancestor-chain lookup for `validation-chain.ts`'s `wouldCreateCycle` — not required by any
      * currently-wired route (reparent has no route this pass, design-spec.md §2.8), kept here so a
      * future reparent route has a ready-made `TermTreeLookup` to inject. */
-    getParentId(termId) {
+    getParentId({ termId }) {
         return this.rows.get(termId)?.parentId ?? null;
     }
     /** `DeletableTermRepoPort` — additive capability for `deleteTerm`/`deleteTaxonomy`, see
      * `write-service.ts`'s doc comment on that interface. */
-    async delete(id) {
+    async delete({ id }) {
         this.rows.delete(id);
     }
     /** `DeletableTermRepoPort.countChildren` — direct children only (one level), matching
@@ -167,10 +168,11 @@ export class InMemoryTaxonomyRevisionRepo {
  */
 export class InMemoryContentLookup {
     rows;
-    constructor(seed = []) {
+    constructor(requiredArgs, optionalArgs = {}) {
+        const { seed = [] } = optionalArgs;
         this.rows = new Map(seed.map((s) => [`${s.contentType}::${s.contentId}`, { workspaceId: s.workspaceId, kind: s.kind }]));
     }
-    set(contentType, contentId, value) {
+    set({ contentType, contentId, value }) {
         this.rows.set(`${contentType}::${contentId}`, value);
     }
     async resolve(params) {
@@ -188,10 +190,10 @@ export function noopStampWatermark() { }
  * shape), so this wrapper forwards them as the full event payload rather than re-nesting. */
 export function toTaxonomyOutbox(deps) {
     return {
-        enqueue: async (event) => {
+        enqueue: async ({ event }) => {
             const record = event;
             const name = typeof record.name === "string" ? record.name : "taxonomy.event";
-            const occurredAt = typeof record.occurredAt === "string" ? record.occurredAt : deps.clock.nowIso();
+            const occurredAt = typeof record.occurredAt === "string" ? record.occurredAt : kernelNowIso({ clock: deps.clock });
             await deps.outbox.enqueue({ id: deps.idGen.newId(), workspaceId: deps.workspaceId, name, occurredAt, payload: record });
         },
     };

package/dist/taxonomy/validation-chain.d.ts

@@ -25,35 +25,51 @@
  * their own repo lookups, so the ordering guarantee holds regardless of how a caller wires them.
  */
 export declare class TaxonomyNotApplicableError extends Error {
-    constructor(message: string);
+    constructor(requiredArgs: {
+        message: string;
+    }, optionalArgs?: Record<string, never>);
 }
 export declare class WorkspaceMismatchError extends Error {
-    constructor(message: string);
+    constructor(requiredArgs: {
+        message: string;
+    }, optionalArgs?: Record<string, never>);
 }
 export declare class ContentTypeMismatchError extends Error {
-    constructor(message: string);
+    constructor(requiredArgs: {
+        message: string;
+    }, optionalArgs?: Record<string, never>);
 }
 export declare class TaxonomyNotHierarchicalError extends Error {
-    constructor(message: string);
+    constructor(requiredArgs: {
+        message: string;
+    }, optionalArgs?: Record<string, never>);
 }
 export declare class ParentCrossTaxonomyError extends Error {
-    constructor(message: string);
+    constructor(requiredArgs: {
+        message: string;
+    }, optionalArgs?: Record<string, never>);
 }
 export declare class TermNotFoundError extends Error {
-    constructor(message: string);
+    constructor(requiredArgs: {
+        message: string;
+    }, optionalArgs?: Record<string, never>);
 }
 export declare class HierarchyCycleDetectedError extends Error {
-    constructor(message: string);
+    constructor(requiredArgs: {
+        message: string;
+    }, optionalArgs?: Record<string, never>);
 }
 /** Ancestor-chain lookup a cycle check walks. `null` marks a root (no parent). */
 export interface TermTreeLookup {
-    getParentId(termId: string): string | null;
+    getParentId({ termId }: {
+        termId: string;
+    }): string | null;
 }
 /**
- * CIC U-002 — true if assigning `candidateParentId` as `termId`'s parent would create a cycle:
+ * — true if assigning `candidateParentId` as `termId`'s parent would create a cycle:
  * either immediate self-parenting, or `termId` appearing anywhere in `candidateParentId`'s own
  * ancestor chain. A full recursive walk, not a fixed-depth or immediate-parent-only comparison
- * (U-002-B1) — the exact shape a naive implementation gets wrong (a 3+-hop cycle is the
+ * — the exact shape a naive implementation gets wrong (a 3+-hop cycle is the
  * regression case this exists to catch).
  *
  * A `visited` guard bounds the walk even against a pre-existing malformed tree (defensive; no
@@ -62,6 +78,7 @@ export interface TermTreeLookup {
  *
  * @complexity O(depth) — one `getParentId` call per ancestor hop, each hop visited at most once.
  * @overallScore 100
+ * See docs/decisions/DR-005-ordered-taxonomy-validation.md.
  */
 export declare function wouldCreateCycle(required: {
     termId: string;
@@ -69,13 +86,14 @@ export declare function wouldCreateCycle(required: {
     tree: TermTreeLookup;
 }, _optional?: Record<string, never>): boolean;
 /**
- * U-001-B1/ORD1/ORD2 — the content-join chain: allow-list, THEN workspace, THEN lens, in that
- * fixed order. A combined-failure case always reports the first-in-order failure (U-001-ORD1:
- * not-on-allow-list always wins over a simultaneous workspace mismatch; U-001-ORD2: a workspace
+ * /ORD1/ORD2 — the content-join chain: allow-list, THEN workspace, THEN lens, in that
+ * fixed order. A combined-failure case always reports the first-in-order failure (:
+ * not-on-allow-list always wins over a simultaneous workspace mismatch; : a workspace
  * mismatch always wins over a simultaneous lens mismatch).
  *
  * @complexity O(1) — three independent comparisons, no loop.
  * @overallScore 100
+ * See docs/decisions/DR-005-ordered-taxonomy-validation.md.
  */
 export declare function validateContentJoin(required: {
     taxonomyId: string;
@@ -87,18 +105,19 @@ export declare function validateContentJoin(required: {
     resolvedContentKind: string;
 }, _optional?: Record<string, never>): void;
 /**
- * U-001-B2/B3/ORD3 — the hierarchy chain: hierarchical-mode, THEN same-taxonomy (distinguishing
+ * /B3/ORD3 — the hierarchy chain: hierarchical-mode, THEN same-taxonomy (distinguishing
  * not-found from wrong-taxonomy), THEN cycle, in that fixed order. `null` `candidateParentId`
- * (no parent assignment attempted) always short-circuits to a pass regardless of mode (RT-012's
+ * (no parent assignment attempted) always short-circuits to a pass regardless of mode (
  * regression: a no-op parent write must never be rejected).
  *
- * The compound RT-001 regression this chain exists to prevent: a flat taxonomy's candidate parent
+ * The compound regression this chain exists to prevent: a flat taxonomy's candidate parent
  * that ALSO happens to exist in a different taxonomy must report `TAXONOMY_NOT_HIERARCHICAL`,
  * never `PARENT_CROSS_TAXONOMY` — hierarchical-mode is checked first and is decisive on its own.
  *
- * @complexity O(1) plus the injected `wouldCreateCycle` closure's own cost (U-002, only reached
+ * @complexity O(1) plus the injected `wouldCreateCycle` closure's own cost (only reached
  * once hierarchical-mode and same-taxonomy both pass).
  * @overallScore 100
+ * See docs/decisions/DR-005-ordered-taxonomy-validation.md.
  */
 export declare function validateHierarchyAssignment(required: {
     childTaxonomyId: string;
@@ -108,7 +127,9 @@ export declare function validateHierarchyAssignment(required: {
         id: string;
         taxonomyId: string;
     } | null | "not-applicable";
-    wouldCreateCycle: (candidateParentId: string) => boolean;
+    wouldCreateCycle: (required: {
+        candidateParentId: string;
+    }) => boolean;
     termId: string;
 }, _optional?: Record<string, never>): void;
 //# sourceMappingURL=validation-chain.d.ts.map