@jini-ai/cms 0.3.11 → 0.4.0

package/dist/entries/write-service.d.ts

@@ -1,5 +1,6 @@
-import type { ClockPort } from "../core/ports.js";
-import type { ActorIdentityInput, EntryRecord, EntryStatus, OwningContentType, Result } from "./types.js";
+import type { Clock } from "@jini-ai/core/primitives";
+import type { Result } from "@jini-ai/core/primitives";
+import type { ActorIdentityInput, EntryRecord, EntryStatus, OwningContentType } from "./types.js";
 /**
  * @file The `entries` write chokepoint: `createEntry`,
  * `updateEntry`, `publishEntry`, `unpublishEntry`.
@@ -38,16 +39,8 @@ import type { ActorIdentityInput, EntryRecord, EntryStatus, OwningContentType, R
  * tools call these functions directly, never through an HTTP route), so it must be at least as
  * expressive as the route, not merely consistent with it.
  */
-export type AuthorizeFn = (params: {
-    principalId: string;
-    permission: string;
-    workspaceId: string;
-    entityType?: string | undefined;
-    entityId?: string | undefined;
-}) => Promise<{
-    allowed: boolean;
-    reason: string;
-}>;
+export type { AuthorizationPort as AuthorizeFn } from '../core/authorization.js';
+import type { AuthorizationPort as AuthorizeFn } from '../core/authorization.js';
 export interface EntryRevisionInput {
     entryId: string;
     workspaceId: string;
@@ -70,7 +63,9 @@ export interface EntryRepoPort {
     }): Promise<EntryRecord | null>;
     save(row: EntryRecord): Promise<void>;
     appendRevision(revision: EntryRevisionInput): Promise<void>;
-    transaction<T>(fn: () => Promise<T>): Promise<T>;
+    transaction<T>(required: {
+        fn: () => Promise<T>;
+    }): Promise<T>;
 }
 export interface ContentTypeLookupPort {
     findByKey(params: {
@@ -94,7 +89,7 @@ export interface CreateEntryRequired {
     deps: {
         entryRepo: EntryRepoPort;
         contentTypeRepo: ContentTypeLookupPort;
-        clock: ClockPort;
+        clock: Clock;
         ids: {
             newId: () => string;
         };
@@ -121,15 +116,16 @@ export interface CreateEntryRequired {
     };
 }
 /**
- * REQ-13/14/19 — creates a new entry. Order: authorize -> owning-type exists AND is owned by this
- * workspace (INV-01) -> owning-type is `active` (REQ-10) -> `fieldsJson` validates against the
- * type's current schema -> `(workspaceId, type, slug)` uniqueness (AC-21) -> same-tx write +
+ * — creates a new entry. Order: authorize -> owning-type exists AND is owned by this
+ * workspace -> owning-type is `active` -> `fieldsJson` validates against the
+ * type's current schema -> `(workspaceId, type, slug)` uniqueness -> same-tx write +
  * revision + watermark + optional `deps.onWritten` side effect -> `entry.created` outbox event
- * (AC-27).
+ *
  *
  * @complexity O(1) plus one content-type read, one field-validation pass, one slug lookup, and one
  * same-tx write pair.
  * @overallScore 100
+ * See docs/decisions/DR-002-content-lifecycle-and-cleanup.md.
  */
 export declare function createEntry(required: CreateEntryRequired): Promise<Result<{
     entry: EntryRecord;
@@ -137,7 +133,7 @@ export declare function createEntry(required: CreateEntryRequired): Promise<Resu
 interface ExistingEntryTransitionDeps {
     entryRepo: EntryRepoPort;
     contentTypeRepo: ContentTypeLookupPort;
-    clock: ClockPort;
+    clock: Clock;
     authorize: AuthorizeFn;
     outbox: OutboxPort;
     watermark?: WatermarkPort;
@@ -173,13 +169,14 @@ export interface UpdateEntryRequired {
     };
 }
 /**
- * REQ-28 — updates an existing entry's `title`/`fieldsJson`/`bodyJson` (only the fields supplied
+ * — updates an existing entry's `title`/`fieldsJson`/`bodyJson` (only the fields supplied
  * are changed). Rejected `ContentTypeNotActiveError` only if the owning type is `tombstone`
- * (AC-44/EC-13); a `deprecated` owning type is fine (AC-46).
+ * a `deprecated` owning type is fine.
  *
  * @complexity O(1) plus the shared resolve step and, when `fieldsJson` is supplied, one
  * field-validation pass.
  * @overallScore 100
+ * See docs/decisions/DR-002-content-lifecycle-and-cleanup.md.
  */
 export declare function updateEntry(required: UpdateEntryRequired): Promise<Result<{
     entry: EntryRecord;
@@ -188,7 +185,7 @@ export interface ImportEntryRequired {
     deps: {
         entryRepo: EntryRepoPort;
         contentTypeRepo: ContentTypeLookupPort;
-        clock: ClockPort;
+        clock: Clock;
         authorize: AuthorizeFn;
         outbox: OutboxPort;
         watermark?: WatermarkPort;
@@ -229,14 +226,15 @@ export interface ImportEntryRequired {
  * cannot produce, and the reason this is a new function rather than a wider `createEntry`.
  *
  * A tombstoned owning type refuses the import (mirrors `resolveExistingEntryForTransition`'s
- * REQ-28 rule); unlike `createEntry`'s REQ-10, a `deprecated` owning type does NOT block an
- * import — REQ-10 exists to stop new manual authoring against a type an operator is winding down,
+ * rule); unlike `createEntry`'s, a `deprecated` owning type does NOT block an
+ * import — exists to stop new manual authoring against a type an operator is winding down,
  * not to stop a publish run from keeping an already-existing entry's already-existing type in
  * sync. Slug uniqueness is deliberately not checked here: the publish factory's own `address`
  * precheck (config.address, F1) owns that refusal before `importEntry` is ever called.
  *
  * @complexity O(1) plus one content-type read, one field-validation pass, one id lookup, and one
  * same-tx write pair.
+ * See docs/decisions/DR-002-content-lifecycle-and-cleanup.md.
  */
 export declare function importEntry(required: ImportEntryRequired): Promise<Result<{
     entry: EntryRecord;
@@ -250,24 +248,25 @@ export interface PublishUnpublishEntryRequired {
     };
 }
 /**
- * REQ-28 — flips an entry to `published`. Rejected `ContentTypeNotActiveError` only if the owning
- * type is `tombstone` (AC-45), with NO outbox event enqueued on rejection.
+ * — flips an entry to `published`. Rejected `ContentTypeNotActiveError` only if the owning
+ * type is `tombstone`, with NO outbox event enqueued on rejection.
  *
  * @complexity O(1) plus the shared resolve step and one same-tx write pair.
  * @overallScore 100
+ * See docs/decisions/DR-002-content-lifecycle-and-cleanup.md.
  */
 export declare function publishEntry(required: PublishUnpublishEntryRequired): Promise<Result<{
     entry: EntryRecord;
 }, Error>>;
 /**
- * REQ-28 — flips an entry to `unpublished`. Rejected `ContentTypeNotActiveError` only if the
- * owning type is `tombstone` (AC-45), with NO outbox event enqueued on rejection.
+ * — flips an entry to `unpublished`. Rejected `ContentTypeNotActiveError` only if the
+ * owning type is `tombstone`, with NO outbox event enqueued on rejection.
  *
  * @complexity O(1) plus the shared resolve step and one same-tx write pair.
  * @overallScore 100
+ * See docs/decisions/DR-002-content-lifecycle-and-cleanup.md.
  */
 export declare function unpublishEntry(required: PublishUnpublishEntryRequired): Promise<Result<{
     entry: EntryRecord;
 }, Error>>;
-export {};
 //# sourceMappingURL=write-service.d.ts.map

package/dist/entries/write-service.js

@@ -1,3 +1,4 @@
+import { nowIso as kernelNowIso } from "@jini-ai/core/primitives";
 import { ContentTypeNotActiveError, ContentTypeNotFoundError, EntryFieldValidationError, EntryNotFoundError, EntrySlugConflictError, ForbiddenError, VersionConflictError, } from "./errors.js";
 import { validateFieldsAgainstSchema } from "./field-validation.js";
 function delegationFields(input) {
@@ -7,38 +8,40 @@ function delegationFields(input) {
     };
 }
 /**
- * REQ-13/14/19 — creates a new entry. Order: authorize -> owning-type exists AND is owned by this
- * workspace (INV-01) -> owning-type is `active` (REQ-10) -> `fieldsJson` validates against the
- * type's current schema -> `(workspaceId, type, slug)` uniqueness (AC-21) -> same-tx write +
+ * — creates a new entry. Order: authorize -> owning-type exists AND is owned by this
+ * workspace -> owning-type is `active` -> `fieldsJson` validates against the
+ * type's current schema -> `(workspaceId, type, slug)` uniqueness -> same-tx write +
  * revision + watermark + optional `deps.onWritten` side effect -> `entry.created` outbox event
- * (AC-27).
+ *
  *
  * @complexity O(1) plus one content-type read, one field-validation pass, one slug lookup, and one
  * same-tx write pair.
  * @overallScore 100
+ * See docs/decisions/DR-002-content-lifecycle-and-cleanup.md.
  */
 export async function createEntry(required) {
     const { deps, input } = required;
-    const authResult = await deps.authorize({ principalId: input.actorId, permission: "admin.collections.manage", workspaceId: input.workspaceId, entityType: "entry" });
+    const authResult = await deps.authorize({ principalId: input.actorId, permission: "admin.collections.manage", workspaceId: input.workspaceId }, { entityType: "entry" });
     if (!authResult.allowed) {
-        return { ok: false, error: new ForbiddenError(`principal '${input.actorId}' cannot create an entry (${authResult.reason})`) };
+        return { ok: false, error: new ForbiddenError({ message: `principal '${input.actorId}' cannot create an entry (${authResult.reason})` }) };
     }
     const contentType = await deps.contentTypeRepo.findByKey({ workspaceId: input.workspaceId, key: input.type });
     if (!contentType || contentType.workspaceId !== input.workspaceId) {
-        return { ok: false, error: new ContentTypeNotFoundError(`content type '${input.type}' was not found in workspace '${input.workspaceId}'`) };
+        return { ok: false, error: new ContentTypeNotFoundError({ message: `content type '${input.type}' was not found in workspace '${input.workspaceId}'` }) };
     }
     if (contentType.status !== "active") {
-        return { ok: false, error: new ContentTypeNotActiveError(`content type '${input.type}' is not active; new entries cannot be created (REQ-10)`) };
+        // See docs/decisions/DR-002-content-lifecycle-and-cleanup.md for the invariant behind this refusal; keep external identifiers out of caller-facing messages.
+        return { ok: false, error: new ContentTypeNotActiveError({ message: `content type '${input.type}' is not active; new entries cannot be created` }) };
     }
-    const validation = validateFieldsAgainstSchema({ schema: contentType.fields, fieldsJson: input.fieldsJson, owner: input.owner });
+    const validation = validateFieldsAgainstSchema({ schema: contentType.fields, fieldsJson: input.fieldsJson }, { owner: input.owner });
     if (!validation.valid) {
-        return { ok: false, error: new EntryFieldValidationError(validation.fieldErrors) };
+        return { ok: false, error: new EntryFieldValidationError({ fieldErrors: validation.fieldErrors }) };
     }
     const existing = await deps.entryRepo.findBySlug({ workspaceId: input.workspaceId, type: input.type, slug: input.slug });
     if (existing) {
-        return { ok: false, error: new EntrySlugConflictError(`an entry with slug '${input.slug}' already exists for type '${input.type}' in workspace '${input.workspaceId}'`) };
+        return { ok: false, error: new EntrySlugConflictError({ message: `an entry with slug '${input.slug}' already exists for type '${input.type}' in workspace '${input.workspaceId}'` }) };
     }
-    const now = deps.clock.nowIso();
+    const now = kernelNowIso({ clock: deps.clock });
     const entry = {
         id: deps.ids.newId(),
         workspaceId: input.workspaceId,
@@ -53,60 +56,63 @@ export async function createEntry(required) {
         updatedAt: now,
         version: 1,
     };
-    await deps.entryRepo.transaction(async () => {
-        await deps.entryRepo.save(entry);
-        await deps.entryRepo.appendRevision({
-            entryId: entry.id,
-            workspaceId: input.workspaceId,
-            op: "create",
-            stateJson: entry,
-            actorId: input.actorId,
-            ...delegationFields(input),
-            recordedAt: now,
-        });
-        if (deps.watermark)
-            await deps.watermark.stampWatermark({ workspaceId: input.workspaceId });
-        if (deps.onWritten)
-            await deps.onWritten(entry);
-    });
+    await deps.entryRepo.transaction({ fn: async () => {
+            await deps.entryRepo.save(entry);
+            await deps.entryRepo.appendRevision({
+                entryId: entry.id,
+                workspaceId: input.workspaceId,
+                op: "create",
+                stateJson: entry,
+                actorId: input.actorId,
+                ...delegationFields(input),
+                recordedAt: now,
+            });
+            if (deps.watermark)
+                await deps.watermark.stampWatermark({ workspaceId: input.workspaceId });
+            if (deps.onWritten)
+                await deps.onWritten(entry);
+        } });
     await deps.outbox.enqueue({ name: "entry.created", payload: { workspaceId: input.workspaceId, entryId: entry.id, type: input.type, slug: input.slug } });
     return { ok: true, value: { entry } };
 }
 /**
- * REQ-28's shared resolve step for `updateEntry`/`publishEntry`/`unpublishEntry`: authorize ->
+ * shared resolve step for `updateEntry`/`publishEntry`/`unpublishEntry`: authorize ->
  * find the entry -> find its owning type -> reject ONLY if that type is `tombstone`
- * (`deprecated` blocks nothing here, unlike `createEntry`'s REQ-10 rule) -> `expectedVersion`
+ * (`deprecated` blocks nothing here, unlike `createEntry`'s rule) -> `expectedVersion`
  * check.
  *
  * @complexity O(1) plus one entry read and one content-type read.
  * @overallScore 100
+ * See docs/decisions/DR-002-content-lifecycle-and-cleanup.md.
  */
 async function resolveExistingEntryForTransition(deps, input) {
-    const authResult = await deps.authorize({ principalId: input.actorId, permission: "admin.collections.manage", workspaceId: input.workspaceId, entityType: "entry" });
+    const authResult = await deps.authorize({ principalId: input.actorId, permission: "admin.collections.manage", workspaceId: input.workspaceId }, { entityType: "entry" });
     if (!authResult.allowed) {
-        return { ok: false, error: new ForbiddenError(`principal '${input.actorId}' cannot modify entry '${input.id}' (${authResult.reason})`) };
+        return { ok: false, error: new ForbiddenError({ message: `principal '${input.actorId}' cannot modify entry '${input.id}' (${authResult.reason})` }) };
     }
     const entry = await deps.entryRepo.findById({ workspaceId: input.workspaceId, id: input.id });
     if (!entry) {
-        return { ok: false, error: new EntryNotFoundError(`entry '${input.id}' was not found in workspace '${input.workspaceId}'`) };
+        return { ok: false, error: new EntryNotFoundError({ message: `entry '${input.id}' was not found in workspace '${input.workspaceId}'` }) };
     }
     const contentType = await deps.contentTypeRepo.findByKey({ workspaceId: input.workspaceId, key: entry.type });
     if (contentType && contentType.status === "tombstone") {
-        return { ok: false, error: new ContentTypeNotActiveError(`content type '${entry.type}' is tombstoned; existing entries cannot be updated/published/unpublished (REQ-28)`) };
+        // See docs/decisions/DR-002-content-lifecycle-and-cleanup.md for the invariant behind this refusal; keep external identifiers out of caller-facing messages.
+        return { ok: false, error: new ContentTypeNotActiveError({ message: `content type '${entry.type}' is tombstoned; existing entries cannot be updated/published/unpublished` }) };
     }
     if (input.expectedVersion !== entry.version) {
-        return { ok: false, error: new VersionConflictError(`expected version ${input.expectedVersion} for entry '${input.id}', found ${entry.version}`) };
+        return { ok: false, error: new VersionConflictError({ message: `expected version ${input.expectedVersion} for entry '${input.id}', found ${entry.version}` }) };
     }
     return { ok: true, value: { entry, contentType } };
 }
 /**
- * REQ-28 — updates an existing entry's `title`/`fieldsJson`/`bodyJson` (only the fields supplied
+ * — updates an existing entry's `title`/`fieldsJson`/`bodyJson` (only the fields supplied
  * are changed). Rejected `ContentTypeNotActiveError` only if the owning type is `tombstone`
- * (AC-44/EC-13); a `deprecated` owning type is fine (AC-46).
+ * a `deprecated` owning type is fine.
  *
  * @complexity O(1) plus the shared resolve step and, when `fieldsJson` is supplied, one
  * field-validation pass.
  * @overallScore 100
+ * See docs/decisions/DR-002-content-lifecycle-and-cleanup.md.
  */
 export async function updateEntry(required) {
     const { deps, input } = required;
@@ -116,13 +122,13 @@ export async function updateEntry(required) {
     const { entry: current, contentType } = resolved.value;
     let fieldsJson = current.fieldsJson;
     if (input.fieldsJson !== undefined) {
-        const validation = validateFieldsAgainstSchema({ schema: contentType?.fields ?? [], fieldsJson: input.fieldsJson, owner: input.owner });
+        const validation = validateFieldsAgainstSchema({ schema: contentType?.fields ?? [], fieldsJson: input.fieldsJson }, { owner: input.owner });
         if (!validation.valid) {
-            return { ok: false, error: new EntryFieldValidationError(validation.fieldErrors) };
+            return { ok: false, error: new EntryFieldValidationError({ fieldErrors: validation.fieldErrors }) };
         }
         fieldsJson = input.fieldsJson;
     }
-    const now = deps.clock.nowIso();
+    const now = kernelNowIso({ clock: deps.clock });
     const updated = {
         ...current,
         title: input.title ?? current.title,
@@ -131,22 +137,22 @@ export async function updateEntry(required) {
         updatedAt: now,
         version: current.version + 1,
     };
-    await deps.entryRepo.transaction(async () => {
-        await deps.entryRepo.save(updated);
-        await deps.entryRepo.appendRevision({
-            entryId: current.id,
-            workspaceId: input.workspaceId,
-            op: "update",
-            stateJson: updated,
-            actorId: input.actorId,
-            ...delegationFields(input),
-            recordedAt: now,
-        });
-        if (deps.watermark)
-            await deps.watermark.stampWatermark({ workspaceId: input.workspaceId });
-        if (deps.onWritten)
-            await deps.onWritten(updated);
-    });
+    await deps.entryRepo.transaction({ fn: async () => {
+            await deps.entryRepo.save(updated);
+            await deps.entryRepo.appendRevision({
+                entryId: current.id,
+                workspaceId: input.workspaceId,
+                op: "update",
+                stateJson: updated,
+                actorId: input.actorId,
+                ...delegationFields(input),
+                recordedAt: now,
+            });
+            if (deps.watermark)
+                await deps.watermark.stampWatermark({ workspaceId: input.workspaceId });
+            if (deps.onWritten)
+                await deps.onWritten(updated);
+        } });
     await deps.outbox.enqueue({ name: "entry.updated", payload: { workspaceId: input.workspaceId, entryId: current.id } });
     return { ok: true, value: { entry: updated } };
 }
@@ -158,52 +164,53 @@ export async function updateEntry(required) {
  * cannot produce, and the reason this is a new function rather than a wider `createEntry`.
  *
  * A tombstoned owning type refuses the import (mirrors `resolveExistingEntryForTransition`'s
- * REQ-28 rule); unlike `createEntry`'s REQ-10, a `deprecated` owning type does NOT block an
- * import — REQ-10 exists to stop new manual authoring against a type an operator is winding down,
+ * rule); unlike `createEntry`'s, a `deprecated` owning type does NOT block an
+ * import — exists to stop new manual authoring against a type an operator is winding down,
  * not to stop a publish run from keeping an already-existing entry's already-existing type in
  * sync. Slug uniqueness is deliberately not checked here: the publish factory's own `address`
  * precheck (config.address, F1) owns that refusal before `importEntry` is ever called.
  *
  * @complexity O(1) plus one content-type read, one field-validation pass, one id lookup, and one
  * same-tx write pair.
+ * See docs/decisions/DR-002-content-lifecycle-and-cleanup.md.
  */
 export async function importEntry(required) {
     const { deps, input } = required;
-    const authResult = await deps.authorize({ principalId: input.actorId, permission: "admin.collections.manage", workspaceId: input.workspaceId, entityType: "entry" });
+    const authResult = await deps.authorize({ principalId: input.actorId, permission: "admin.collections.manage", workspaceId: input.workspaceId }, { entityType: "entry" });
     if (!authResult.allowed) {
-        return { ok: false, error: new ForbiddenError(`principal '${input.actorId}' cannot import entry '${input.id}' (${authResult.reason})`) };
+        return { ok: false, error: new ForbiddenError({ message: `principal '${input.actorId}' cannot import entry '${input.id}' (${authResult.reason})` }) };
     }
     const contentType = await deps.contentTypeRepo.findByKey({ workspaceId: input.workspaceId, key: input.type });
     if (!contentType || contentType.workspaceId !== input.workspaceId) {
-        return { ok: false, error: new ContentTypeNotFoundError(`content type '${input.type}' was not found in workspace '${input.workspaceId}'`) };
+        return { ok: false, error: new ContentTypeNotFoundError({ message: `content type '${input.type}' was not found in workspace '${input.workspaceId}'` }) };
     }
     if (contentType.status === "tombstone") {
-        return { ok: false, error: new ContentTypeNotActiveError(`content type '${input.type}' is tombstoned; entries cannot be imported into it`) };
+        return { ok: false, error: new ContentTypeNotActiveError({ message: `content type '${input.type}' is tombstoned; entries cannot be imported into it` }) };
     }
-    const validation = validateFieldsAgainstSchema({ schema: contentType.fields, fieldsJson: input.fieldsJson, owner: input.owner });
+    const validation = validateFieldsAgainstSchema({ schema: contentType.fields, fieldsJson: input.fieldsJson }, { owner: input.owner });
     if (!validation.valid) {
-        return { ok: false, error: new EntryFieldValidationError(validation.fieldErrors) };
+        return { ok: false, error: new EntryFieldValidationError({ fieldErrors: validation.fieldErrors }) };
     }
     const existing = await deps.entryRepo.findById({ workspaceId: input.workspaceId, id: input.id });
     if (input.expectedVersion === undefined) {
         if (existing) {
-            return { ok: false, error: new VersionConflictError(`entry '${input.id}' already exists in workspace '${input.workspaceId}', but no expectedVersion was supplied for import`) };
+            return { ok: false, error: new VersionConflictError({ message: `entry '${input.id}' already exists in workspace '${input.workspaceId}', but no expectedVersion was supplied for import` }) };
         }
     }
     else {
         if (!existing) {
-            return { ok: false, error: new VersionConflictError(`expected version ${input.expectedVersion} for entry '${input.id}', but no such entry exists`) };
+            return { ok: false, error: new VersionConflictError({ message: `expected version ${input.expectedVersion} for entry '${input.id}', but no such entry exists` }) };
         }
         if (existing.version !== input.expectedVersion) {
-            return { ok: false, error: new VersionConflictError(`expected version ${input.expectedVersion} for entry '${input.id}', found ${existing.version}`) };
+            return { ok: false, error: new VersionConflictError({ message: `expected version ${input.expectedVersion} for entry '${input.id}', found ${existing.version}` }) };
         }
         // Same id, different type means this is not the row the caller's plan was made against; a
-        // silent type move would also dodge the REQ-28 tombstone check on the entry's REAL type.
+        // silent type move would also dodge the tombstone check on the entry's REAL type. See docs/decisions/DR-002-content-lifecycle-and-cleanup.md.
         if (existing.type !== input.type) {
-            return { ok: false, error: new VersionConflictError(`entry '${input.id}' is of type '${existing.type}', not '${input.type}'; an import cannot change an entry's type`) };
+            return { ok: false, error: new VersionConflictError({ message: `entry '${input.id}' is of type '${existing.type}', not '${input.type}'; an import cannot change an entry's type` }) };
         }
     }
-    const now = deps.clock.nowIso();
+    const now = kernelNowIso({ clock: deps.clock });
     const entry = {
         id: input.id,
         workspaceId: input.workspaceId,
@@ -218,22 +225,22 @@ export async function importEntry(required) {
         updatedAt: now,
         version: existing ? existing.version + 1 : 1,
     };
-    await deps.entryRepo.transaction(async () => {
-        await deps.entryRepo.save(entry);
-        await deps.entryRepo.appendRevision({
-            entryId: entry.id,
-            workspaceId: input.workspaceId,
-            op: existing ? "update" : "create",
-            stateJson: entry,
-            actorId: input.actorId,
-            ...delegationFields(input),
-            recordedAt: now,
-        });
-        if (deps.watermark)
-            await deps.watermark.stampWatermark({ workspaceId: input.workspaceId });
-        if (deps.onWritten)
-            await deps.onWritten(entry);
-    });
+    await deps.entryRepo.transaction({ fn: async () => {
+            await deps.entryRepo.save(entry);
+            await deps.entryRepo.appendRevision({
+                entryId: entry.id,
+                workspaceId: input.workspaceId,
+                op: existing ? "update" : "create",
+                stateJson: entry,
+                actorId: input.actorId,
+                ...delegationFields(input),
+                recordedAt: now,
+            });
+            if (deps.watermark)
+                await deps.watermark.stampWatermark({ workspaceId: input.workspaceId });
+            if (deps.onWritten)
+                await deps.onWritten(entry);
+        } });
     await deps.outbox.enqueue({ name: "entry.imported", payload: { workspaceId: input.workspaceId, entryId: entry.id, type: input.type, slug: input.slug } });
     return { ok: true, value: { entry } };
 }
@@ -243,7 +250,7 @@ async function transitionEntryStatus(required, target) {
     if (!resolved.ok)
         return resolved;
     const { entry: current } = resolved.value;
-    const now = deps.clock.nowIso();
+    const now = kernelNowIso({ clock: deps.clock });
     const updated = {
         ...current,
         status: target.status,
@@ -251,39 +258,41 @@ async function transitionEntryStatus(required, target) {
         updatedAt: now,
         version: current.version + 1,
     };
-    await deps.entryRepo.transaction(async () => {
-        await deps.entryRepo.save(updated);
-        await deps.entryRepo.appendRevision({
-            entryId: current.id,
-            workspaceId: input.workspaceId,
-            op: target.op,
-            stateJson: updated,
-            actorId: input.actorId,
-            ...delegationFields(input),
-            recordedAt: now,
-        });
-        if (deps.watermark)
-            await deps.watermark.stampWatermark({ workspaceId: input.workspaceId });
-    });
+    await deps.entryRepo.transaction({ fn: async () => {
+            await deps.entryRepo.save(updated);
+            await deps.entryRepo.appendRevision({
+                entryId: current.id,
+                workspaceId: input.workspaceId,
+                op: target.op,
+                stateJson: updated,
+                actorId: input.actorId,
+                ...delegationFields(input),
+                recordedAt: now,
+            });
+            if (deps.watermark)
+                await deps.watermark.stampWatermark({ workspaceId: input.workspaceId });
+        } });
     await deps.outbox.enqueue({ name: target.eventName, payload: { workspaceId: input.workspaceId, entryId: current.id } });
     return { ok: true, value: { entry: updated } };
 }
 /**
- * REQ-28 — flips an entry to `published`. Rejected `ContentTypeNotActiveError` only if the owning
- * type is `tombstone` (AC-45), with NO outbox event enqueued on rejection.
+ * — flips an entry to `published`. Rejected `ContentTypeNotActiveError` only if the owning
+ * type is `tombstone`, with NO outbox event enqueued on rejection.
  *
  * @complexity O(1) plus the shared resolve step and one same-tx write pair.
  * @overallScore 100
+ * See docs/decisions/DR-002-content-lifecycle-and-cleanup.md.
  */
 export async function publishEntry(required) {
     return transitionEntryStatus(required, { status: "published", op: "publish", eventName: "entry.published" });
 }
 /**
- * REQ-28 — flips an entry to `unpublished`. Rejected `ContentTypeNotActiveError` only if the
- * owning type is `tombstone` (AC-45), with NO outbox event enqueued on rejection.
+ * — flips an entry to `unpublished`. Rejected `ContentTypeNotActiveError` only if the
+ * owning type is `tombstone`, with NO outbox event enqueued on rejection.
  *
  * @complexity O(1) plus the shared resolve step and one same-tx write pair.
  * @overallScore 100
+ * See docs/decisions/DR-002-content-lifecycle-and-cleanup.md.
  */
 export async function unpublishEntry(required) {
     return transitionEntryStatus(required, { status: "unpublished", op: "unpublish", eventName: "entry.unpublished" });

package/dist/http/settings/cms-adapter.d.ts

@@ -0,0 +1,20 @@
+import { type SettingsWriteServiceDeps, type SettingsRepoPort } from "../../settings/index.js";
+import type { SettingsService, SettingsPermissions, SettingsChangeFeed } from "./contracts.js";
+/** Keep the CMS write chokepoint while translating its permission vocabulary to host policy. */
+/** Bind the CMS ledger and write chokepoint without copying their domain logic.
+ * Effective reads scan definitions and resolve each namespace key; mutations inherit CMS transactions/errors.
+ * @complexity O(1) setup. Per operation: O(definitions + keys) reads, or O(batch size) writes.
+ * @example createCmsSettingsService({ deps: cmsPorts, permissions });
+ */
+export declare function createCmsSettingsService(required: {
+    deps: SettingsWriteServiceDeps;
+    permissions: SettingsPermissions;
+}): SettingsService;
+/** Adapt the ledger through CMS tenant/principal disclosure rules, returning names and cursors only.
+ * @complexity O(1) setup; collect is O(page size), with namespace lookup per visible revision.
+ * @example createCmsSettingsChangeFeed({ repo });
+ */
+export declare function createCmsSettingsChangeFeed(required: {
+    repo: SettingsRepoPort;
+}): SettingsChangeFeed;
+//# sourceMappingURL=cms-adapter.d.ts.map