@jini-ai/cms 0.3.8 → 0.3.10

package/dist/content-types/errors.d.ts

@@ -1,3 +1,4 @@
+import { ToolInputError } from "@jini-ai/core";
 /**
  * @file Typed error surface for the `content-types` package.
  *
@@ -10,26 +11,41 @@
  * the constructor sets `this.name` explicitly (confirmed empirically in Session 2 of this
  * workstream) — every class below sets it.
  *
+ * Every class the five wired agent tools (`define`/`update_fields`/`deprecate`/`reactivate`/
+ * `tombstone`) can actually throw extends `ToolInputError` (`@jini-ai/core`), not plain `Error` —
+ * mirroring `core/entity-liveness.ts`'s `EntityNotLiveError` (see its file header for the full
+ * rationale). Without that, `write-service.ts`/`lifecycle.ts` return these via a `Result` that
+ * `tool-registrations.ts`'s `fromResult` re-throws unwrapped, `@jini-ai/daemon`'s `ToolExecutor`
+ * sees a plain `Error` it cannot distinguish from a genuine internal fault, and every HTTP-facing
+ * mapping of that failure (`@jini-ai/http-kit`'s `delegated-tools.ts`) redacts it to a 500
+ * `INTERNAL_ERROR` — so a model calling `collections_content_type_define` on a key that already
+ * exists never sees "use collections_content_type_update_fields", only an opaque failure it cannot
+ * act on. `CleanupNotEligibleError` is the one exception: `collections_plan_cleanup`/
+ * `collections_execute_cleanup` are declared but not yet wired to any handler
+ * (`tool-registrations.ts`'s `UNWIRED_CONTENT_TYPES_TOOL_IDS`), so nothing reaches a model through
+ * it today — left as plain `Error` until that wiring exists and it can be verified the same way.
+ *
  * Architectural role:
- * `features/content-types` domain logic. No dependencies.
+ * `features/content-types` domain logic. Depends on `@jini-ai/core` only for the `ToolInputError`
+ * marker above.
  */
-export declare class ForbiddenError extends Error {
+export declare class ForbiddenError extends ToolInputError {
     constructor(message: string);
 }
 /** CIC U-002-B1 guard 1 — `key`/field-name grammar gate `^[a-z][a-z0-9_]{0,63}$` (U-001-B2). */
-export declare class InvalidKeyGrammarError extends Error {
+export declare class InvalidKeyGrammarError extends ToolInputError {
     constructor(message: string);
 }
 /** CIC U-002-B1 guard 2 — `key` is one of the permanently reserved legacy `posts` keys. */
-export declare class ReservedContentTypeKeyError extends Error {
+export declare class ReservedContentTypeKeyError extends ToolInputError {
     constructor(message: string);
 }
 /** CIC U-002-B1 guard 3 — a field name fails the identifier grammar gate. */
-export declare class InvalidFieldNameGrammarError extends Error {
+export declare class InvalidFieldNameGrammarError extends ToolInputError {
     constructor(message: string);
 }
 /** CIC U-001-B1 / U-002-B1 guard 4 — a field `kind` is not one of the closed field-kind enum. */
-export declare class InvalidFieldKindError extends Error {
+export declare class InvalidFieldKindError extends ToolInputError {
     constructor(message: string);
 }
 /**
@@ -64,7 +80,7 @@ export declare class StorageOnlyFieldNotQueryableError extends InvalidFieldKindE
  * `violation.received` names the offending value's TYPE, never the value — a field payload can
  * carry operator content, and this message reaches both an HTTP client and a model.
  */
-export declare class InvalidFieldShapeError extends Error {
+export declare class InvalidFieldShapeError extends ToolInputError {
     readonly code: "VALIDATION_ERROR";
     readonly violation: {
         path: string;
@@ -78,18 +94,31 @@ export declare class InvalidFieldShapeError extends Error {
     });
 }
 /** CIC U-002-B1 guard 5 — more than the per-type cap of `queryable` fields were submitted. */
-export declare class QueryableFieldCapExceededError extends Error {
+export declare class QueryableFieldCapExceededError extends ToolInputError {
     constructor(message: string);
 }
 /** CIC U-004-B1 — `expectedVersion` did not match the current row's version (OCC conflict). */
-export declare class VersionConflictError extends Error {
+export declare class VersionConflictError extends ToolInputError {
     constructor(message: string);
 }
-export declare class ContentTypeNotFoundError extends Error {
+export declare class ContentTypeNotFoundError extends ToolInputError {
     constructor(message: string);
 }
+/**
+ * Row 7 (web-high fix plan, 2026-09-24) — `registerContentType` loaded no existing row before
+ * saving, so two concurrent first-widget creates (or a caller retrying an existing key) could
+ * silently overwrite the current fields, and registering a tombstoned key could resurrect it
+ * (INV-06 forbids any transition out of tombstone, including via a fresh register). Thrown when
+ * `deps.repo.findByKey` already returns a row for the key, whether that row is active/deprecated
+ * or tombstoned — `tombstoned` distinguishes the two so a caller/HTTP route can give the right
+ * guidance (retry with update-fields, vs. the key is permanently gone).
+ */
+export declare class ContentTypeAlreadyExistsError extends ToolInputError {
+    readonly tombstoned: boolean;
+    constructor(key: string, tombstoned: boolean);
+}
 /** A generic validation rejection carrying a stable machine-readable `details.reason`. */
-export declare class ValidationError extends Error {
+export declare class ValidationError extends ToolInputError {
     readonly code: "VALIDATION_ERROR";
     readonly details: {
         reason: string;
@@ -97,7 +126,7 @@ export declare class ValidationError extends Error {
     constructor(message: string, reason: string);
 }
 /** REQ-09..12 lifecycle state-machine guard rejection (INV-06 terminal-tombstone, EC-09 deprecate-first). */
-export declare class ContentTypeLifecycleError extends Error {
+export declare class ContentTypeLifecycleError extends ToolInputError {
     constructor(message: string);
 }
 /** REQ-20 `planCleanup` eligibility-gate rejection; `reason` is one of a closed, ordered set. */

package/dist/content-types/errors.js

@@ -1,3 +1,4 @@
+import { ToolInputError } from "@jini-ai/core";
 /**
  * @file Typed error surface for the `content-types` package.
  *
@@ -10,38 +11,53 @@
  * the constructor sets `this.name` explicitly (confirmed empirically in Session 2 of this
  * workstream) — every class below sets it.
  *
+ * Every class the five wired agent tools (`define`/`update_fields`/`deprecate`/`reactivate`/
+ * `tombstone`) can actually throw extends `ToolInputError` (`@jini-ai/core`), not plain `Error` —
+ * mirroring `core/entity-liveness.ts`'s `EntityNotLiveError` (see its file header for the full
+ * rationale). Without that, `write-service.ts`/`lifecycle.ts` return these via a `Result` that
+ * `tool-registrations.ts`'s `fromResult` re-throws unwrapped, `@jini-ai/daemon`'s `ToolExecutor`
+ * sees a plain `Error` it cannot distinguish from a genuine internal fault, and every HTTP-facing
+ * mapping of that failure (`@jini-ai/http-kit`'s `delegated-tools.ts`) redacts it to a 500
+ * `INTERNAL_ERROR` — so a model calling `collections_content_type_define` on a key that already
+ * exists never sees "use collections_content_type_update_fields", only an opaque failure it cannot
+ * act on. `CleanupNotEligibleError` is the one exception: `collections_plan_cleanup`/
+ * `collections_execute_cleanup` are declared but not yet wired to any handler
+ * (`tool-registrations.ts`'s `UNWIRED_CONTENT_TYPES_TOOL_IDS`), so nothing reaches a model through
+ * it today — left as plain `Error` until that wiring exists and it can be verified the same way.
+ *
  * Architectural role:
- * `features/content-types` domain logic. No dependencies.
+ * `features/content-types` domain logic. Depends on `@jini-ai/core` only for the `ToolInputError`
+ * marker above.
  */
-export class ForbiddenError extends Error {
+export class ForbiddenError extends ToolInputError {
     constructor(message) {
         super(message);
         this.name = "ForbiddenError";
     }
 }
 /** CIC U-002-B1 guard 1 — `key`/field-name grammar gate `^[a-z][a-z0-9_]{0,63}$` (U-001-B2). */
-export class InvalidKeyGrammarError extends Error {
+export class InvalidKeyGrammarError extends ToolInputError {
     constructor(message) {
         super(message);
         this.name = "InvalidKeyGrammarError";
     }
 }
 /** CIC U-002-B1 guard 2 — `key` is one of the permanently reserved legacy `posts` keys. */
-export class ReservedContentTypeKeyError extends Error {
+export class ReservedContentTypeKeyError extends ToolInputError {
     constructor(message) {
         super(message);
         this.name = "ReservedContentTypeKeyError";
     }
 }
 /** CIC U-002-B1 guard 3 — a field name fails the identifier grammar gate. */
-export class InvalidFieldNameGrammarError extends Error {
+export class InvalidFieldNameGrammarError extends ToolInputError {
     constructor(message) {
         super(message);
         this.name = "InvalidFieldNameGrammarError";
     }
 }
 /** CIC U-001-B1 / U-002-B1 guard 4 — a field `kind` is not one of the closed field-kind enum. */
-export class InvalidFieldKindError extends Error {
+export class InvalidFieldKindError extends ToolInputError {
     constructor(message) {
         super(message);
         this.name = "InvalidFieldKindError";
@@ -82,7 +98,7 @@ export class StorageOnlyFieldNotQueryableError extends InvalidFieldKindError {
  * `violation.received` names the offending value's TYPE, never the value — a field payload can
  * carry operator content, and this message reaches both an HTTP client and a model.
  */
-export class InvalidFieldShapeError extends Error {
+export class InvalidFieldShapeError extends ToolInputError {
     code = "VALIDATION_ERROR";
     violation;
     constructor(violation) {
@@ -92,27 +108,46 @@ export class InvalidFieldShapeError extends Error {
     }
 }
 /** CIC U-002-B1 guard 5 — more than the per-type cap of `queryable` fields were submitted. */
-export class QueryableFieldCapExceededError extends Error {
+export class QueryableFieldCapExceededError extends ToolInputError {
     constructor(message) {
         super(message);
         this.name = "QueryableFieldCapExceededError";
     }
 }
 /** CIC U-004-B1 — `expectedVersion` did not match the current row's version (OCC conflict). */
-export class VersionConflictError extends Error {
+export class VersionConflictError extends ToolInputError {
     constructor(message) {
         super(message);
         this.name = "VersionConflictError";
     }
 }
-export class ContentTypeNotFoundError extends Error {
+export class ContentTypeNotFoundError extends ToolInputError {
     constructor(message) {
         super(message);
         this.name = "CONTENT_TYPE_NOT_FOUND";
     }
 }
+/**
+ * Row 7 (web-high fix plan, 2026-09-24) — `registerContentType` loaded no existing row before
+ * saving, so two concurrent first-widget creates (or a caller retrying an existing key) could
+ * silently overwrite the current fields, and registering a tombstoned key could resurrect it
+ * (INV-06 forbids any transition out of tombstone, including via a fresh register). Thrown when
+ * `deps.repo.findByKey` already returns a row for the key, whether that row is active/deprecated
+ * or tombstoned — `tombstoned` distinguishes the two so a caller/HTTP route can give the right
+ * guidance (retry with update-fields, vs. the key is permanently gone).
+ */
+export class ContentTypeAlreadyExistsError extends ToolInputError {
+    tombstoned;
+    constructor(key, tombstoned) {
+        super(tombstoned
+            ? `content type '${key}' was permanently deleted; its key can't be reused (INV-06)`
+            : `content type '${key}' already exists; use collections_content_type_update_fields to change its fields`);
+        this.name = "ContentTypeAlreadyExistsError";
+        this.tombstoned = tombstoned;
+    }
+}
 /** A generic validation rejection carrying a stable machine-readable `details.reason`. */
-export class ValidationError extends Error {
+export class ValidationError extends ToolInputError {
     code = "VALIDATION_ERROR";
     details;
     constructor(message, reason) {
@@ -122,7 +157,7 @@ export class ValidationError extends Error {
     }
 }
 /** REQ-09..12 lifecycle state-machine guard rejection (INV-06 terminal-tombstone, EC-09 deprecate-first). */
-export class ContentTypeLifecycleError extends Error {
+export class ContentTypeLifecycleError extends ToolInputError {
     constructor(message) {
         super(message);
         this.name = "ContentTypeLifecycleError";

package/dist/content-types/index.d.ts

@@ -30,7 +30,7 @@ export { ForbiddenError, InvalidKeyGrammarError, ReservedContentTypeKeyError, In
  * carries the parent maps this to the same `400 VALIDATION_ERROR` with no change. Catch it by
  * name only if the finer distinction matters.
  */
-StorageOnlyFieldNotQueryableError, InvalidFieldShapeError, QueryableFieldCapExceededError, VersionConflictError, ContentTypeNotFoundError, ValidationError, ContentTypeLifecycleError, CleanupNotEligibleError, } from "./errors.js";
+StorageOnlyFieldNotQueryableError, InvalidFieldShapeError, QueryableFieldCapExceededError, VersionConflictError, ContentTypeNotFoundError, ContentTypeAlreadyExistsError, ValidationError, ContentTypeLifecycleError, CleanupNotEligibleError, } from "./errors.js";
 /**
  * The queryable-field index machinery. `IDENTIFIER_GRAMMAR_PATTERN` is exported because it is the
  * single definition of the identifier grammar — the published agent-tool schemas reference it

package/dist/content-types/index.js

@@ -20,7 +20,7 @@ export { ForbiddenError, InvalidKeyGrammarError, ReservedContentTypeKeyError, In
  * carries the parent maps this to the same `400 VALIDATION_ERROR` with no change. Catch it by
  * name only if the finer distinction matters.
  */
-StorageOnlyFieldNotQueryableError, InvalidFieldShapeError, QueryableFieldCapExceededError, VersionConflictError, ContentTypeNotFoundError, ValidationError, ContentTypeLifecycleError, CleanupNotEligibleError, } from "./errors.js";
+StorageOnlyFieldNotQueryableError, InvalidFieldShapeError, QueryableFieldCapExceededError, VersionConflictError, ContentTypeNotFoundError, ContentTypeAlreadyExistsError, ValidationError, ContentTypeLifecycleError, CleanupNotEligibleError, } from "./errors.js";
 export { IDENTIFIER_GRAMMAR_PATTERN, validateIdentifierGrammar, mapFieldKindToCast, buildQueryableFieldIndexName, resolveFieldIndexTransition, } from "./index-provisioning.js";
 export { registerContentType, updateContentTypeFields } from "./write-service.js";
 export { deprecateContentType, reactivateContentType, tombstoneContentType, } from "./lifecycle.js";

package/dist/content-types/write-service.d.ts

@@ -140,6 +140,15 @@ export interface UpdateContentTypeFieldsRequired {
         key: string;
         fields: ContentTypeFieldDef[];
         expectedVersion: number;
+        /**
+         * J1 (plan-publish-all-types-2026-09-25.md §0.2) — optional and additive. Before this, no
+         * write path could ever change `label` after `registerContentType`, so a publish that carried
+         * an imported `label` change hashed it (the planned publish factory's `transferred` field) but
+         * had nothing to call that would apply it — a permanent false "still changed" on every
+         * subsequent plan. Omitted, the current label is kept unchanged, exactly as before this field
+         * existed.
+         */
+        label?: string | undefined;
     };
 }
 /**

package/dist/content-types/write-service.js

@@ -1,4 +1,5 @@
-import { ContentTypeNotFoundError, ForbiddenError, InvalidFieldKindError, InvalidFieldNameGrammarError, InvalidKeyGrammarError, QueryableFieldCapExceededError, ReservedContentTypeKeyError, StorageOnlyFieldNotQueryableError, ValidationError, VersionConflictError, } from "./errors.js";
+import { EntityNotLiveError } from "../core/entity-liveness.js";
+import { ContentTypeAlreadyExistsError, ContentTypeNotFoundError, ForbiddenError, InvalidFieldKindError, InvalidFieldNameGrammarError, InvalidKeyGrammarError, QueryableFieldCapExceededError, ReservedContentTypeKeyError, StorageOnlyFieldNotQueryableError, ValidationError, VersionConflictError, } from "./errors.js";
 import { resolveFieldIndexTransition, validateIdentifierGrammar } from "./index-provisioning.js";
 import { isContentTypeFieldKind, isIndexableFieldKind, } from "./types.js";
 /** Reserved forever for the legacy `posts` table — an operator Collection can never take these keys. */
@@ -84,6 +85,12 @@ export async function registerContentType(required) {
     if (countQueryableFields(input.fields) > QUERYABLE_FIELD_CAP) {
         return { ok: false, error: new QueryableFieldCapExceededError(`content type '${input.key}' submits more than ${QUERYABLE_FIELD_CAP} queryable fields`) };
     }
+    // Row 7 — a pre-check outside the transaction. Not race-safe by itself (that's the in-tx check
+    // below), but it avoids opening a transaction for the overwhelmingly common not-found case.
+    const existingBeforeTx = await deps.repo.findByKey({ workspaceId: input.workspaceId, key: input.key });
+    if (existingBeforeTx) {
+        return { ok: false, error: new ContentTypeAlreadyExistsError(input.key, existingBeforeTx.status === "tombstone") };
+    }
     const now = deps.clock.nowIso();
     const contentType = {
         workspaceId: input.workspaceId,
@@ -94,22 +101,37 @@ export async function registerContentType(required) {
         version: 1,
         tombstonedAt: null,
     };
-    await deps.repo.transaction(async () => {
-        await deps.repo.save(contentType);
-        await deps.repo.appendRevision({
-            contentTypeKey: input.key,
-            workspaceId: input.workspaceId,
-            op: "register",
-            stateJson: contentType,
-            actorId: input.actorId,
-            principalKind: input.principalKind ?? null,
-            delegatedByWorkspaceId: input.delegatedByWorkspaceId ?? null,
-            delegatedById: input.delegatedById ?? null,
-            recordedAt: now,
+    try {
+        await deps.repo.transaction(async () => {
+            // The check that actually closes the race: two concurrent first-widget creates both see the
+            // pre-check above return null, but only one of them can win this in-tx re-check before save.
+            const existingInTx = await deps.repo.findByKey({ workspaceId: input.workspaceId, key: input.key });
+            if (existingInTx) {
+                throw new ContentTypeAlreadyExistsError(input.key, existingInTx.status === "tombstone");
+            }
+            await deps.repo.save(contentType);
+            await deps.repo.appendRevision({
+                contentTypeKey: input.key,
+                workspaceId: input.workspaceId,
+                op: "register",
+                stateJson: contentType,
+                actorId: input.actorId,
+                principalKind: input.principalKind ?? null,
+                delegatedByWorkspaceId: input.delegatedByWorkspaceId ?? null,
+                delegatedById: input.delegatedById ?? null,
+                recordedAt: now,
+            });
+            if (deps.watermark)
+                await deps.watermark.stampWatermark({ workspaceId: input.workspaceId });
         });
-        if (deps.watermark)
-            await deps.watermark.stampWatermark({ workspaceId: input.workspaceId });
-    });
+    }
+    catch (err) {
+        if (err instanceof ContentTypeAlreadyExistsError)
+            return { ok: false, error: err };
+        throw err;
+    }
+    // Index provisioning runs only once the transaction has committed a new row — never on the
+    // already-exists path above.
     await deps.indexProvisioner.provisionIndexesForNewContentType({
         workspaceId: input.workspaceId,
         contentTypeKey: input.key,
@@ -140,6 +162,12 @@ export async function updateContentTypeFields(required) {
     if (!current) {
         return { ok: false, error: new ContentTypeNotFoundError(`content type '${input.key}' was not found in workspace '${input.workspaceId}'`) };
     }
+    // Row 15's sibling — a tombstoned type is terminal (INV-06); this check runs before the version
+    // check so a stale-version update against a tombstoned row still reports "tombstoned", not
+    // "version conflict" (the tombstone tore down every queryable index, so the schema is moot).
+    if (current.status === "tombstone") {
+        return { ok: false, error: new EntityNotLiveError("content type", input.key, "tombstoned") };
+    }
     // U-004-B1: expectedVersion checked FIRST — before fields_empty, before any per-field guard.
     if (input.expectedVersion !== current.version) {
         return { ok: false, error: new VersionConflictError(`expected version ${input.expectedVersion} for content type '${input.key}', found ${current.version}`) };
@@ -173,7 +201,7 @@ export async function updateContentTypeFields(required) {
     const before = current.fields;
     const after = input.fields;
     const now = deps.clock.nowIso();
-    const updated = { ...current, fields: after, version: current.version + 1 };
+    const updated = { ...current, fields: after, label: input.label ?? current.label, version: current.version + 1 };
     await deps.repo.transaction(async () => {
         await deps.repo.save(updated);
         await deps.repo.appendRevision({

package/dist/entries/index.d.ts

@@ -28,8 +28,8 @@ export { validateFieldsAgainstSchema, selectVisibleEntryFields } from "./field-v
 export { ForbiddenError, EntryNotFoundError, ContentTypeNotFoundError, ContentTypeNotActiveError, EntrySlugConflictError, VersionConflictError, EntryFieldValidationError, } from "./errors.js";
 export type { EntryLifecycleOp, EntryLifecycleHandler } from "./lifecycle-dispatch.js";
 export { ENTRY_LIFECYCLE_OP_NAMES, ENTRY_LIFECYCLE_OPS, parseEntryLifecycleOp, } from "./lifecycle-dispatch.js";
-export type { AuthorizeFn, EntryRevisionInput, EntryRepoPort, ContentTypeLookupPort, OutboxPort, WatermarkPort, CreateEntryRequired, UpdateEntryRequired, PublishUnpublishEntryRequired, } from "./write-service.js";
-export { createEntry, updateEntry, publishEntry, unpublishEntry } from "./write-service.js";
+export type { AuthorizeFn, EntryRevisionInput, EntryRepoPort, ContentTypeLookupPort, OutboxPort, WatermarkPort, CreateEntryRequired, UpdateEntryRequired, PublishUnpublishEntryRequired, ImportEntryRequired, } from "./write-service.js";
+export { createEntry, updateEntry, publishEntry, unpublishEntry, importEntry } from "./write-service.js";
 /**
  * The in-memory repository. Exported for the same reason `navigation` exports its own: a host's
  * concrete adapter implements the port directly, and the in-memory implementation is the reference

package/dist/entries/index.js

@@ -12,7 +12,7 @@ export { validateFieldsAgainstSchema, selectVisibleEntryFields } from "./field-v
  */
 export { ForbiddenError, EntryNotFoundError, ContentTypeNotFoundError, ContentTypeNotActiveError, EntrySlugConflictError, VersionConflictError, EntryFieldValidationError, } from "./errors.js";
 export { ENTRY_LIFECYCLE_OP_NAMES, ENTRY_LIFECYCLE_OPS, parseEntryLifecycleOp, } from "./lifecycle-dispatch.js";
-export { createEntry, updateEntry, publishEntry, unpublishEntry } from "./write-service.js";
+export { createEntry, updateEntry, publishEntry, unpublishEntry, importEntry } from "./write-service.js";
 /**
  * The in-memory repository. Exported for the same reason `navigation` exports its own: a host's
  * concrete adapter implements the port directly, and the in-memory implementation is the reference

package/dist/entries/write-service.d.ts

@@ -1,5 +1,5 @@
 import type { ClockPort } from "../core/ports.js";
-import type { ActorIdentityInput, EntryRecord, OwningContentType, Result } from "./types.js";
+import type { ActorIdentityInput, EntryRecord, EntryStatus, OwningContentType, Result } from "./types.js";
 /**
  * @file The `entries` write chokepoint: `createEntry`,
  * `updateEntry`, `publishEntry`, `unpublishEntry`.
@@ -184,6 +184,63 @@ export interface UpdateEntryRequired {
 export declare function updateEntry(required: UpdateEntryRequired): Promise<Result<{
     entry: EntryRecord;
 }, Error>>;
+export interface ImportEntryRequired {
+    deps: {
+        entryRepo: EntryRepoPort;
+        contentTypeRepo: ContentTypeLookupPort;
+        clock: ClockPort;
+        authorize: AuthorizeFn;
+        outbox: OutboxPort;
+        watermark?: WatermarkPort;
+        onWritten?: (entry: EntryRecord) => Promise<void>;
+    };
+    input: ActorIdentityInput & {
+        workspaceId: string;
+        /** The source's own id, preserved verbatim — unlike `createEntry`, which always mints a fresh
+         * one. Anything referencing this entry by id (widgets, term assignments) needs it to survive
+         * a publish round trip unchanged (plan-publish-all-types-2026-09-25.md §0.3 "Identity"). */
+        id: string;
+        type: string;
+        slug: string;
+        title: string;
+        /** Caller-given, unlike `createEntry`'s forced `"draft"` — an import carries the source's real
+         * status across. */
+        status: EntryStatus;
+        fieldsJson: unknown;
+        bodyJson?: unknown;
+        /** Caller-given, unlike `createEntry`'s forced `null`. */
+        publishedAt: string | null;
+        /**
+         * The publish factory's three-way CAS contract: `undefined` means "no row with this id may
+         * already exist" (an import-as-create); a number means "a row with this id must exist and be
+         * at exactly this version" (an import-as-update). Both cases end in `VersionConflictError` on
+         * mismatch, never a silent create-over-existing or a silent no-op.
+         */
+        expectedVersion: number | undefined;
+        /** The `ext` sub-key `fieldsJson` is namespaced under. Defaults to `"site"` — see `field-validation.ts`'s `validateFieldsAgainstSchema`. */
+        owner?: string | undefined;
+    };
+}
+/**
+ * Slice J1 (plan-publish-all-types-2026-09-25.md) — the publish-content import chokepoint for
+ * `entries`. Combines `createEntry`'s owning-type/field-validation guards with `updateEntry`'s
+ * version-CAS discipline, but preserves the caller's own `id`/`status`/`publishedAt` instead of
+ * minting a fresh id and forcing `draft`/`null` — the two behaviors a straight `createEntry` call
+ * cannot produce, and the reason this is a new function rather than a wider `createEntry`.
+ *
+ * A tombstoned owning type refuses the import (mirrors `resolveExistingEntryForTransition`'s
+ * REQ-28 rule); unlike `createEntry`'s REQ-10, a `deprecated` owning type does NOT block an
+ * import — REQ-10 exists to stop new manual authoring against a type an operator is winding down,
+ * not to stop a publish run from keeping an already-existing entry's already-existing type in
+ * sync. Slug uniqueness is deliberately not checked here: the publish factory's own `address`
+ * precheck (config.address, F1) owns that refusal before `importEntry` is ever called.
+ *
+ * @complexity O(1) plus one content-type read, one field-validation pass, one id lookup, and one
+ * same-tx write pair.
+ */
+export declare function importEntry(required: ImportEntryRequired): Promise<Result<{
+    entry: EntryRecord;
+}, Error>>;
 export interface PublishUnpublishEntryRequired {
     deps: ExistingEntryTransitionDeps;
     input: ActorIdentityInput & {

package/dist/entries/write-service.js

@@ -150,6 +150,93 @@ export async function updateEntry(required) {
     await deps.outbox.enqueue({ name: "entry.updated", payload: { workspaceId: input.workspaceId, entryId: current.id } });
     return { ok: true, value: { entry: updated } };
 }
+/**
+ * Slice J1 (plan-publish-all-types-2026-09-25.md) — the publish-content import chokepoint for
+ * `entries`. Combines `createEntry`'s owning-type/field-validation guards with `updateEntry`'s
+ * version-CAS discipline, but preserves the caller's own `id`/`status`/`publishedAt` instead of
+ * minting a fresh id and forcing `draft`/`null` — the two behaviors a straight `createEntry` call
+ * cannot produce, and the reason this is a new function rather than a wider `createEntry`.
+ *
+ * A tombstoned owning type refuses the import (mirrors `resolveExistingEntryForTransition`'s
+ * REQ-28 rule); unlike `createEntry`'s REQ-10, a `deprecated` owning type does NOT block an
+ * import — REQ-10 exists to stop new manual authoring against a type an operator is winding down,
+ * not to stop a publish run from keeping an already-existing entry's already-existing type in
+ * sync. Slug uniqueness is deliberately not checked here: the publish factory's own `address`
+ * precheck (config.address, F1) owns that refusal before `importEntry` is ever called.
+ *
+ * @complexity O(1) plus one content-type read, one field-validation pass, one id lookup, and one
+ * same-tx write pair.
+ */
+export async function importEntry(required) {
+    const { deps, input } = required;
+    const authResult = await deps.authorize({ principalId: input.actorId, permission: "admin.collections.manage", workspaceId: input.workspaceId, entityType: "entry" });
+    if (!authResult.allowed) {
+        return { ok: false, error: new ForbiddenError(`principal '${input.actorId}' cannot import entry '${input.id}' (${authResult.reason})`) };
+    }
+    const contentType = await deps.contentTypeRepo.findByKey({ workspaceId: input.workspaceId, key: input.type });
+    if (!contentType || contentType.workspaceId !== input.workspaceId) {
+        return { ok: false, error: new ContentTypeNotFoundError(`content type '${input.type}' was not found in workspace '${input.workspaceId}'`) };
+    }
+    if (contentType.status === "tombstone") {
+        return { ok: false, error: new ContentTypeNotActiveError(`content type '${input.type}' is tombstoned; entries cannot be imported into it`) };
+    }
+    const validation = validateFieldsAgainstSchema({ schema: contentType.fields, fieldsJson: input.fieldsJson, owner: input.owner });
+    if (!validation.valid) {
+        return { ok: false, error: new EntryFieldValidationError(validation.fieldErrors) };
+    }
+    const existing = await deps.entryRepo.findById({ workspaceId: input.workspaceId, id: input.id });
+    if (input.expectedVersion === undefined) {
+        if (existing) {
+            return { ok: false, error: new VersionConflictError(`entry '${input.id}' already exists in workspace '${input.workspaceId}', but no expectedVersion was supplied for import`) };
+        }
+    }
+    else {
+        if (!existing) {
+            return { ok: false, error: new VersionConflictError(`expected version ${input.expectedVersion} for entry '${input.id}', but no such entry exists`) };
+        }
+        if (existing.version !== input.expectedVersion) {
+            return { ok: false, error: new VersionConflictError(`expected version ${input.expectedVersion} for entry '${input.id}', found ${existing.version}`) };
+        }
+        // Same id, different type means this is not the row the caller's plan was made against; a
+        // silent type move would also dodge the REQ-28 tombstone check on the entry's REAL type.
+        if (existing.type !== input.type) {
+            return { ok: false, error: new VersionConflictError(`entry '${input.id}' is of type '${existing.type}', not '${input.type}'; an import cannot change an entry's type`) };
+        }
+    }
+    const now = deps.clock.nowIso();
+    const entry = {
+        id: input.id,
+        workspaceId: input.workspaceId,
+        type: input.type,
+        slug: input.slug,
+        status: input.status,
+        title: input.title,
+        bodyJson: input.bodyJson ?? null,
+        fieldsJson: input.fieldsJson,
+        publishedAt: input.publishedAt,
+        createdAt: existing?.createdAt ?? now,
+        updatedAt: now,
+        version: existing ? existing.version + 1 : 1,
+    };
+    await deps.entryRepo.transaction(async () => {
+        await deps.entryRepo.save(entry);
+        await deps.entryRepo.appendRevision({
+            entryId: entry.id,
+            workspaceId: input.workspaceId,
+            op: existing ? "update" : "create",
+            stateJson: entry,
+            actorId: input.actorId,
+            ...delegationFields(input),
+            recordedAt: now,
+        });
+        if (deps.watermark)
+            await deps.watermark.stampWatermark({ workspaceId: input.workspaceId });
+        if (deps.onWritten)
+            await deps.onWritten(entry);
+    });
+    await deps.outbox.enqueue({ name: "entry.imported", payload: { workspaceId: input.workspaceId, entryId: entry.id, type: input.type, slug: input.slug } });
+    return { ok: true, value: { entry } };
+}
 async function transitionEntryStatus(required, target) {
     const { deps, input } = required;
     const resolved = await resolveExistingEntryForTransition(deps, input);

package/dist/media/media-service.js

@@ -51,6 +51,7 @@
  * bespoke `MediaRecord` table in place of a generic-entries model.
  */
 import { createHash } from "node:crypto";
+import { assertEntityLive } from "../core/entity-liveness.js";
 import { MediaConflictError, MediaNotFoundError, MediaSourceImmutableError, MediaStillReferencedError, MediaValidationError, } from "./types.js";
 import { withSha256Lock } from "./blob-gc-lock.js";
 import { tombstoneBlobIfUnreferenced } from "./blob-gc.js";
@@ -457,6 +458,7 @@ export async function updateMediaMetadata(required, _optional = {}) {
     const existing = await deps.mediaRepo.findById({ workspaceId: input.workspaceId, id: input.id });
     if (!existing)
         throw new MediaNotFoundError(`media '${input.id}' was not found`);
+    assertEntityLive({ entityType: "media", entityId: input.id, state: existing.status === "trashed" ? "trashed" : "live" });
     if (input.width !== undefined && input.width !== null)
         assertPositiveIntegerOrThrow(input.width, "width");
     if (input.height !== undefined && input.height !== null)

package/dist/navigation/menu-service.d.ts

@@ -1,27 +1,3 @@
-/**
- * @file Write-service for the `navigation` library.
- *
- * Purpose:
- * Implements the menu mutation slice: create, whole-tree update (OCC), soft
- * delete → hard purge, and location assignment. Mirrors the host's `post`
- * feature style (required/optional param objects, typed errors, OCC via
- * `version`).
- *
- * How it relates to the project:
- * - Storage is `MenuRepoPort` (`repo.memory.ts`) — a self-contained repo, not
- *   the generic entries repo (see `repo.memory.ts`'s file header for why).
- * - Location assignment additionally writes `NavLocationBindingRepoPort`
- *   (`ports.ts`), the one real port this library declares.
- * - In production this whole module runs inside the command
- *   gateway/write chokepoint (same-transaction revision, attribution,
- *   `entry_refs` extraction). That gateway is not implemented as running code
- *   yet, so these functions are the chokepoint's future *contents*, called
- *   directly for now.
- *
- * Architectural role:
- * Feature logic only. No Express/route code, no direct SQL — everything goes
- * through the injected repo ports (`deps`).
- */
 import type { ClockPort, IdGeneratorPort, OutboxPort, UUID } from "../core/ports.js";
 import type { MenuRepoPort } from "./repo.memory.js";
 import type { NavLocationBindingRepoPort } from "./ports.js";

package/dist/navigation/menu-service.js

@@ -1,3 +1,28 @@
+/**
+ * @file Write-service for the `navigation` library.
+ *
+ * Purpose:
+ * Implements the menu mutation slice: create, whole-tree update (OCC), soft
+ * delete → hard purge, and location assignment. Mirrors the host's `post`
+ * feature style (required/optional param objects, typed errors, OCC via
+ * `version`).
+ *
+ * How it relates to the project:
+ * - Storage is `MenuRepoPort` (`repo.memory.ts`) — a self-contained repo, not
+ *   the generic entries repo (see `repo.memory.ts`'s file header for why).
+ * - Location assignment additionally writes `NavLocationBindingRepoPort`
+ *   (`ports.ts`), the one real port this library declares.
+ * - In production this whole module runs inside the command
+ *   gateway/write chokepoint (same-transaction revision, attribution,
+ *   `entry_refs` extraction). That gateway is not implemented as running code
+ *   yet, so these functions are the chokepoint's future *contents*, called
+ *   directly for now.
+ *
+ * Architectural role:
+ * Feature logic only. No Express/route code, no direct SQL — everything goes
+ * through the injected repo ports (`deps`).
+ */
+import { assertEntityLive } from "../core/entity-liveness.js";
 import { NAV_DOC_TYPE, } from "./types.js";
 // ---------------------------------------------------------------------------
 // Outbox event publication — each mutating function below
@@ -293,6 +318,7 @@ export async function updateMenuTree(required, optional = {}) {
     const existing = await deps.repo.findById({ workspaceId: input.workspaceId, id: input.id });
     if (!existing)
         throw new MenuNotFoundError(`menu '${input.id}' was not found`);
+    assertEntityLive({ entityType: "menu", entityId: input.id, state: existing.status === "trash" ? "trashed" : "live" });
     if (existing.version !== input.expectedVersion) {
         throw new MenuConflictError(`menu '${input.id}' was modified concurrently (expected version ${input.expectedVersion}, found ${existing.version})`);
     }
@@ -360,6 +386,7 @@ export async function assignLocation(required, _optional = {}) {
     const menu = await deps.repo.findById({ workspaceId: input.workspaceId, id: input.menuId });
     if (!menu)
         throw new MenuNotFoundError(`menu '${input.menuId}' was not found`);
+    assertEntityLive({ entityType: "menu", entityId: input.menuId, state: menu.status === "trash" ? "trashed" : "live" });
     const now = deps.clock.nowIso();
     const existingBinding = await deps.bindingRepo.findByLocation({
         workspaceId: input.workspaceId,

package/dist/navigation/tool-registrations.d.ts

@@ -1,14 +1,3 @@
-/**
- * @file Navigation's (Menus') half of the agent-tool authorization wiring: maps `agent-tools.ts`'s five
- * catalog entries onto `menu-service.ts`'s read/create/update/assign operations, as
- * `ToolRegistration`s. The entire catalog is wired — `deleteMenu` is deliberately absent from the
- * catalog rather than present-but-unwired; see `navigation/agent-tools.ts`'s own header.
- *
- * Authorization shape: like Media and unlike Forms/Identity/Widgets, `menu-service.ts`'s functions
- * perform NO internal `authorize()` call of their own — every admin HTTP route a host builds gates
- * inline. Every handler here does the same via the kit's `requireToolPermission`, which is the
- * single evaluation for these tools, located where the real route locates it.
- */
 import type { AuthorizeFn } from "../core/commands/command.js";
 import type { OutboxPort } from "../core/ports.js";
 import { type DerivedRiskByToolId, type ToolRegistration } from "../core/tools/registration-kit.js";

package/dist/navigation/tool-registrations.js

@@ -1,3 +1,15 @@
+/**
+ * @file Navigation's (Menus') half of the agent-tool authorization wiring: maps `agent-tools.ts`'s five
+ * catalog entries onto `menu-service.ts`'s read/create/update/assign operations, as
+ * `ToolRegistration`s. The entire catalog is wired — `deleteMenu` is deliberately absent from the
+ * catalog rather than present-but-unwired; see `navigation/agent-tools.ts`'s own header.
+ *
+ * Authorization shape: like Media and unlike Forms/Identity/Widgets, `menu-service.ts`'s functions
+ * perform NO internal `authorize()` call of their own — every admin HTTP route a host builds gates
+ * inline. Every handler here does the same via the kit's `requireToolPermission`, which is the
+ * single evaluation for these tools, located where the real route locates it.
+ */
+import { ToolInputError } from "@jini-ai/core";
 import { buildDomainRegistrations, indexCatalogById, requireInputRecord, requireNumber, requireString, requireToolPermission, withSchemaOnRejection, } from "../core/tools/registration-kit.js";
 import { menusAgentToolCatalog } from "./agent-tools.js";
 import { assignLocation, createMenu, MenuNotFoundError, MenuValidationError, updateMenuTree } from "./menu-service.js";
@@ -65,6 +77,9 @@ export function buildMenusRegistrations(routeDeps) {
         menus_create_menu: async (ctx) => {
             const input = requireInputRecord(ctx.input);
             await requireToolPermission(routeDeps, { principalId: ctx.principal.id, permission: "admin.menus.create", entityType: "menu" });
+            if (input.items !== undefined && !Array.isArray(input.items)) {
+                throw new ToolInputError("'items' must be an array of nav items");
+            }
             return withSchemaOnRejection({ toolId: "menus_create_menu", catalog: CATALOG_BY_ID, isShapeRejection: isMenusShapeRejection }, async () => {
                 const { menu } = await createMenu({
                     deps: menusDeps(routeDeps),

package/dist/taxonomy/content-lookup.d.ts

@@ -36,8 +36,14 @@ export interface ContentRecordLookupPort {
     }): Promise<{
         workspaceId: string;
         kind: string;
+        deletedAt?: string | null;
     } | null>;
 }
+/**
+ * Row 63 (web-high fix plan, 2026-09-24): a trashed post/page must refuse a term assign/unassign,
+ * not silently accept one — `assertEntityLive` throws `EntityNotLiveError` the moment `deletedAt`
+ * is set, before this ever returns a resolvable target to `write-service.ts`'s join guards.
+ */
 export declare function createPostBackedContentLookup(deps: {
     postRepo: ContentRecordLookupPort;
     workspaceId: string;

package/dist/taxonomy/content-lookup.js

@@ -1,9 +1,19 @@
+import { assertEntityLive } from "../core/entity-liveness.js";
 import { isContentTypeOnAllowList } from "./write-service.js";
+/**
+ * Row 63 (web-high fix plan, 2026-09-24): a trashed post/page must refuse a term assign/unassign,
+ * not silently accept one — `assertEntityLive` throws `EntityNotLiveError` the moment `deletedAt`
+ * is set, before this ever returns a resolvable target to `write-service.ts`'s join guards.
+ */
 export function createPostBackedContentLookup(deps) {
     return {
         async resolve({ contentId }) {
             const post = await deps.postRepo.findById({ workspaceId: deps.workspaceId, id: contentId });
-            return post ? { workspaceId: post.workspaceId, kind: post.kind } : null;
+            if (!post)
+                return null;
+            if (post.deletedAt)
+                assertEntityLive({ entityType: post.kind, entityId: contentId, state: "trashed" });
+            return { workspaceId: post.workspaceId, kind: post.kind };
         },
     };
 }

package/dist/taxonomy/index.d.ts

@@ -19,7 +19,7 @@
  * has no imports at all: the ceremony is a parameter, not a dependency.
  */
 export { TaxonomyNotApplicableError, WorkspaceMismatchError, ContentTypeMismatchError, TaxonomyNotHierarchicalError, ParentCrossTaxonomyError, TermNotFoundError, HierarchyCycleDetectedError, wouldCreateCycle, validateContentJoin, validateHierarchyAssignment, type TermTreeLookup, } from "./validation-chain.js";
-export { TAXONOMY_ALLOWED_CONTENT_TYPES, isContentTypeOnAllowList, TaxonomyRecordNotFoundError, TermRecordNotFoundError, ContentRecordNotFoundError, TermHasAssignedContentError, TermHasChildTermsError, TaxonomyHasAssignedContentError, createTaxonomy, createTerm, renameTerm, assignTerms, unassignTerms, deleteTerm, deleteTaxonomy, onContentDeleted, type AuthorizeFn, type Taxonomy, type Term, type TaxonomyRepoPort, type TermRepoPort, type EntryTermRepoPort, type ContentLookupPort, type ContentTypeTaxonomyPolicyPort, type UnassignableEntryTermRepoPort, type TaxonomyRevisionRow, type TaxonomyRevisionRepoPort, type ClockPort, type IdGeneratorPort, type WriteServiceDeps, type CreateTaxonomyRequired, type CreateTermRequired, type RenameTermRequired, type AssignTermsRequired, type UnassignTermsRequired, type DeleteTermRequired, type DeleteTaxonomyRequired, type DeletableTaxonomyRepoPort, type DeletableTermRepoPort, type AssignmentCountEntryTermRepoPort, type TransactionalRepoPort, type EntryTermsCleanupPort, type OnContentDeletedRequired, } from "./write-service.js";
+export { TAXONOMY_ALLOWED_CONTENT_TYPES, isContentTypeOnAllowList, TaxonomyRecordNotFoundError, TermRecordNotFoundError, ContentRecordNotFoundError, TermHasAssignedContentError, TermHasChildTermsError, TaxonomyHasAssignedContentError, TaxonomyVersionConflictError, createTaxonomy, createTerm, renameTerm, assignTerms, unassignTerms, deleteTerm, deleteTaxonomy, onContentDeleted, importTaxonomy, importTerm, type AuthorizeFn, type Taxonomy, type Term, type TaxonomyRepoPort, type TermRepoPort, type EntryTermRepoPort, type ContentLookupPort, type ContentTypeTaxonomyPolicyPort, type UnassignableEntryTermRepoPort, type TaxonomyRevisionRow, type TaxonomyRevisionRepoPort, type ClockPort, type IdGeneratorPort, type WriteServiceDeps, type CreateTaxonomyRequired, type CreateTermRequired, type RenameTermRequired, type AssignTermsRequired, type UnassignTermsRequired, type DeleteTermRequired, type DeleteTaxonomyRequired, type DeletableTaxonomyRepoPort, type DeletableTermRepoPort, type AssignmentCountEntryTermRepoPort, type TransactionalRepoPort, type EntryTermsCleanupPort, type OnContentDeletedRequired, type ImportableTaxonomyRepoPort, type ImportableTermRepoPort, type ImportTaxonomyRequired, type ImportTermRequired, } from "./write-service.js";
 export { listTaxonomiesWithTerms, type TaxonomyListPort, type TermListPort, type TaxonomyWithTerms, } from "./list.js";
 /**
  * The domain half of the `mergeTerm` ceremony — see this file's header for why the gateway itself

package/dist/taxonomy/index.js

@@ -19,7 +19,7 @@
  * has no imports at all: the ceremony is a parameter, not a dependency.
  */
 export { TaxonomyNotApplicableError, WorkspaceMismatchError, ContentTypeMismatchError, TaxonomyNotHierarchicalError, ParentCrossTaxonomyError, TermNotFoundError, HierarchyCycleDetectedError, wouldCreateCycle, validateContentJoin, validateHierarchyAssignment, } from "./validation-chain.js";
-export { TAXONOMY_ALLOWED_CONTENT_TYPES, isContentTypeOnAllowList, TaxonomyRecordNotFoundError, TermRecordNotFoundError, ContentRecordNotFoundError, TermHasAssignedContentError, TermHasChildTermsError, TaxonomyHasAssignedContentError, createTaxonomy, createTerm, renameTerm, assignTerms, unassignTerms, deleteTerm, deleteTaxonomy, onContentDeleted, } from "./write-service.js";
+export { TAXONOMY_ALLOWED_CONTENT_TYPES, isContentTypeOnAllowList, TaxonomyRecordNotFoundError, TermRecordNotFoundError, ContentRecordNotFoundError, TermHasAssignedContentError, TermHasChildTermsError, TaxonomyHasAssignedContentError, TaxonomyVersionConflictError, createTaxonomy, createTerm, renameTerm, assignTerms, unassignTerms, deleteTerm, deleteTaxonomy, onContentDeleted, importTaxonomy, importTerm, } from "./write-service.js";
 export { listTaxonomiesWithTerms, } from "./list.js";
 /**
  * The domain half of the `mergeTerm` ceremony — see this file's header for why the gateway itself

package/dist/taxonomy/repo.memory.d.ts

@@ -13,6 +13,11 @@ export declare class InMemoryTaxonomyRepo implements TaxonomyRepoPort, TaxonomyL
         hierarchical: boolean;
         allowList?: string[] | undefined;
     } | null>;
+    /** `ImportableTaxonomyRepoPort` — additive capability for `importTaxonomy`'s CAS check and
+     * update-in-place, see `write-service.ts`'s doc comment on that interface. */
+    findByIdFull(id: string): Promise<Taxonomy | null>;
+    /** `ImportableTaxonomyRepoPort` — writes an existing row back in place, preserving its id. */
+    update(row: Taxonomy): Promise<unknown>;
     list(): Promise<Taxonomy[]>;
     /** `DeletableTaxonomyRepoPort` — additive capability for `deleteTaxonomy`, see
      * `write-service.ts`'s doc comment on that interface. */
@@ -44,6 +49,9 @@ export declare class InMemoryTermRepo implements TermRepoPort, TermListPort {
         taxonomyId: string;
         name?: string | undefined;
     } | null>;
+    /** `ImportableTermRepoPort` — additive capability for `importTerm`'s CAS check, see
+     * `write-service.ts`'s doc comment on that interface. */
+    findByIdFull(id: string): Promise<Term | null>;
     listByTaxonomy(params: {
         taxonomyId: string;
     }): Promise<Term[]>;

package/dist/taxonomy/repo.memory.js

@@ -12,6 +12,17 @@ export class InMemoryTaxonomyRepo {
         const row = this.rows.get(id);
         return row ? { id: row.id, hierarchical: row.hierarchical } : null;
     }
+    /** `ImportableTaxonomyRepoPort` — additive capability for `importTaxonomy`'s CAS check and
+     * update-in-place, see `write-service.ts`'s doc comment on that interface. */
+    async findByIdFull(id) {
+        const row = this.rows.get(id);
+        return row ? { ...row } : null;
+    }
+    /** `ImportableTaxonomyRepoPort` — writes an existing row back in place, preserving its id. */
+    async update(row) {
+        this.rows.set(row.id, { ...row });
+        return row;
+    }
     async list() {
         return [...this.rows.values()].map((row) => ({ ...row }));
     }
@@ -54,6 +65,12 @@ export class InMemoryTermRepo {
         const row = this.rows.get(id);
         return row ? { id: row.id, taxonomyId: row.taxonomyId, name: row.name } : null;
     }
+    /** `ImportableTermRepoPort` — additive capability for `importTerm`'s CAS check, see
+     * `write-service.ts`'s doc comment on that interface. */
+    async findByIdFull(id) {
+        const row = this.rows.get(id);
+        return row ? { ...row } : null;
+    }
     async listByTaxonomy(params) {
         return [...this.rows.values()].filter((row) => row.taxonomyId === params.taxonomyId).map((row) => ({ ...row }));
     }

package/dist/taxonomy/write-service.d.ts

@@ -124,7 +124,7 @@ export interface TaxonomyRevisionRow {
      * `"deprecate"` (that ceremony's own header explains why widening this union was out of its
      * scope), a delete has no honest fit among the other four ops, so this widens the union rather
      * than overloading an existing member. */
-    op: "create" | "rename" | "reparent" | "deprecate" | "delete";
+    op: "create" | "rename" | "reparent" | "deprecate" | "delete" | "import";
     previousState: Record<string, unknown> | null;
     actorId: string;
     recordedAt: string;
@@ -171,6 +171,17 @@ export declare class TermRecordNotFoundError extends Error {
 export declare class ContentRecordNotFoundError extends Error {
     constructor(message: string);
 }
+/**
+ * J1 (plan-publish-all-types-2026-09-25.md) — `importTaxonomy`/`importTerm`'s optimistic-concurrency
+ * rejection. Neither `Taxonomy` nor `Term` had a version-checked write before this slice
+ * (`createTaxonomy`/`createTerm` always insert a fresh row; `renameTerm` doesn't check a caller-
+ * supplied version either), so this is a new class rather than a reused one — `content-types`' and
+ * `entries`' own `VersionConflictError`s are each that package's own, per this file's header's
+ * "catch the one it actually called into" rule.
+ */
+export declare class TaxonomyVersionConflictError extends Error {
+    constructor(message: string);
+}
 export interface CreateTaxonomyRequired {
     deps: WriteServiceDeps;
     principalId: string;
@@ -192,6 +203,79 @@ export interface CreateTermRequired {
  * cycle check is therefore always a no-op (`() => false`) here, unlike a reparent of an existing
  * term (not yet built — no certified test in this slice exercises it). */
 export declare function createTerm(required: CreateTermRequired, _optional?: Record<string, never>): Promise<Term>;
+/**
+ * Additive capability beyond the certified `TaxonomyRepoPort` — `findById`'s narrow return
+ * (`{id, hierarchical, allowList?}`) doesn't carry `version`/`name`/`status`/`updatedAt`, which
+ * `importTaxonomy`'s CAS check and update-in-place both need, and `insert`-only leaves no way to
+ * write an existing row back. Same beyond-the-certified-port precedent as `DeletableTaxonomyRepoPort`.
+ */
+export interface ImportableTaxonomyRepoPort {
+    findByIdFull(id: string): Promise<Taxonomy | null>;
+    update(row: Taxonomy): Promise<unknown>;
+}
+export interface ImportTaxonomyRequired {
+    deps: WriteServiceDeps & {
+        taxonomies: TaxonomyRepoPort & ImportableTaxonomyRepoPort;
+    };
+    principalId: string;
+    /** The source's own id, preserved verbatim — unlike `createTaxonomy`, which always mints a fresh
+     * one. Anything referencing this taxonomy by id (its member terms) needs it to survive a publish
+     * round trip unchanged. */
+    id: string;
+    name: string;
+    hierarchical: boolean;
+    /** Same three-way CAS contract as `importEntry`'s `expectedVersion`: `undefined` means "this id
+     * must not already exist" (import-as-create); a number means "a row at exactly this version must
+     * exist" (import-as-update). Either mismatch is a `TaxonomyVersionConflictError`, never a silent
+     * overwrite or a silent no-op. */
+    expectedVersion: number | undefined;
+}
+/**
+ * Slice J1 — the publish-content import chokepoint for `taxonomies`. Address (name) uniqueness is
+ * deliberately not checked here: the publish factory's own `address` precheck (F1's
+ * `config.address`) owns that refusal before this is ever called, mirroring `importEntry`'s
+ * identical split from slug-uniqueness.
+ *
+ * @complexity O(1) — one id lookup, one insert-or-update, one revision append, all outside a
+ * transaction (this package has no SQLite adapter to open one against yet — see `repo.memory.ts`'s
+ * header).
+ */
+export declare function importTaxonomy(required: ImportTaxonomyRequired, _optional?: Record<string, never>): Promise<Taxonomy>;
+/**
+ * Additive capability beyond the certified `TermRepoPort` — `findById`'s narrow return
+ * (`{id, taxonomyId, name?}`) doesn't carry `version`, which `importTerm`'s CAS check needs.
+ * `TermRepoPort` already has `update`, unlike taxonomies, so no additive `update` is needed here.
+ */
+export interface ImportableTermRepoPort {
+    findByIdFull(id: string): Promise<Term | null>;
+}
+export interface ImportTermRequired {
+    deps: WriteServiceDeps & {
+        terms: TermRepoPort & ImportableTermRepoPort;
+    };
+    principalId: string;
+    /** The source's own id, preserved verbatim — unlike `createTerm`, which always mints a fresh one. */
+    id: string;
+    taxonomyId: string;
+    name: string;
+    parentId?: string | null | undefined;
+    /** Same three-way CAS contract as `importTaxonomy.expectedVersion`. */
+    expectedVersion: number | undefined;
+}
+/**
+ * Slice J1 — the publish-content import chokepoint for `terms`. Address (name within
+ * `(taxonomyId, parentId)`) uniqueness is the publish factory's own precheck, not this function's
+ * job — same split as `importTaxonomy`/`importEntry`.
+ *
+ * Unlike `createTerm`, an import can MOVE an existing term (an import-as-update with a new
+ * `parentId`), so the destination's real ancestor chain is loaded first (`loadAncestorChain`) and
+ * handed to the certified `wouldCreateCycle` walk — a publish must never write a parent loop into
+ * live taxonomy, where every tree walk over it would spin forever.
+ *
+ * @complexity O(d) — one taxonomy lookup, one id lookup, one optional parent lookup, `d` ancestor
+ * lookups (the candidate parent's depth), one insert-or-update, one revision append.
+ */
+export declare function importTerm(required: ImportTermRequired, _optional?: Record<string, never>): Promise<Term>;
 export interface RenameTermRequired {
     deps: WriteServiceDeps;
     principalId: string;

package/dist/taxonomy/write-service.js

@@ -1,5 +1,5 @@
 import { ForbiddenError } from "../core/commands/command.js";
-import { validateContentJoin, validateHierarchyAssignment } from "./validation-chain.js";
+import { validateContentJoin, validateHierarchyAssignment, wouldCreateCycle } from "./validation-chain.js";
 /** The hardcoded post/page taxonomy allow-list (permanent, see
  * `docs/decisions/taxonomy-content-type-allow-list.md`) — every taxonomy is applicable to
  * `post`/`page` content. This set is never grown to admit a Collection's content-type key; a
@@ -29,6 +29,20 @@ export class ContentRecordNotFoundError extends Error {
         this.name = "ContentRecordNotFoundError";
     }
 }
+/**
+ * J1 (plan-publish-all-types-2026-09-25.md) — `importTaxonomy`/`importTerm`'s optimistic-concurrency
+ * rejection. Neither `Taxonomy` nor `Term` had a version-checked write before this slice
+ * (`createTaxonomy`/`createTerm` always insert a fresh row; `renameTerm` doesn't check a caller-
+ * supplied version either), so this is a new class rather than a reused one — `content-types`' and
+ * `entries`' own `VersionConflictError`s are each that package's own, per this file's header's
+ * "catch the one it actually called into" rule.
+ */
+export class TaxonomyVersionConflictError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "TaxonomyVersionConflictError";
+    }
+}
 /** `admin.taxonomy.manage` (the flat-string permission convention) — must run before any other
  * side effect of every write-service export in this file. */
 async function authorizeTaxonomyManage(deps, principalId) {
@@ -104,6 +118,157 @@ export async function createTerm(required, _optional = {}) {
     await deps.outbox.enqueue({ name: "taxonomy.term_created", termId: term.id, actorId: principalId, occurredAt: now });
     return term;
 }
+/**
+ * Slice J1 — the publish-content import chokepoint for `taxonomies`. Address (name) uniqueness is
+ * deliberately not checked here: the publish factory's own `address` precheck (F1's
+ * `config.address`) owns that refusal before this is ever called, mirroring `importEntry`'s
+ * identical split from slug-uniqueness.
+ *
+ * @complexity O(1) — one id lookup, one insert-or-update, one revision append, all outside a
+ * transaction (this package has no SQLite adapter to open one against yet — see `repo.memory.ts`'s
+ * header).
+ */
+export async function importTaxonomy(required, _optional = {}) {
+    const { deps, principalId, id, name, hierarchical, expectedVersion } = required;
+    await authorizeTaxonomyManage(deps, principalId);
+    const existing = await deps.taxonomies.findByIdFull(id);
+    if (expectedVersion === undefined) {
+        if (existing) {
+            throw new TaxonomyVersionConflictError(`taxonomy '${id}' already exists, but no expectedVersion was supplied for import`);
+        }
+    }
+    else {
+        if (!existing) {
+            throw new TaxonomyVersionConflictError(`expected version ${expectedVersion} for taxonomy '${id}', but no such taxonomy exists`);
+        }
+        if (existing.version !== expectedVersion) {
+            throw new TaxonomyVersionConflictError(`expected version ${expectedVersion} for taxonomy '${id}', found ${existing.version}`);
+        }
+    }
+    const now = deps.clock.nowIso();
+    const taxonomy = {
+        id,
+        name,
+        hierarchical,
+        status: "active",
+        updatedAt: now,
+        version: existing ? existing.version + 1 : 1,
+    };
+    if (existing) {
+        await deps.taxonomies.update(taxonomy);
+    }
+    else {
+        await deps.taxonomies.insert(taxonomy);
+    }
+    await deps.revisions.insert({
+        taxonomyId: taxonomy.id,
+        op: "import",
+        previousState: existing ? { name: existing.name, hierarchical: existing.hierarchical } : null,
+        actorId: principalId,
+        recordedAt: now,
+    });
+    deps.stampWatermark();
+    await deps.outbox.enqueue({ name: "taxonomy.imported", taxonomyId: taxonomy.id, actorId: principalId, occurredAt: now });
+    return taxonomy;
+}
+/**
+ * Loads `startId`'s ancestor chain (`termId -> parentId`, `startId` included) so the synchronous,
+ * certified `wouldCreateCycle` walk can run over the destination's REAL tree. Stops at a root, a
+ * missing row, or an already-seen id — the last bounds the loop against pre-existing malformed
+ * parent data, mirroring `wouldCreateCycle`'s own `visited` guard.
+ *
+ * @complexity O(d) repo reads for a chain of depth `d`.
+ */
+async function loadAncestorChain(terms, startId) {
+    const chain = new Map();
+    let current = startId;
+    while (current !== null && !chain.has(current)) {
+        const parentId = (await terms.findByIdFull(current))?.parentId ?? null;
+        chain.set(current, parentId);
+        current = parentId;
+    }
+    return chain;
+}
+/**
+ * Slice J1 — the publish-content import chokepoint for `terms`. Address (name within
+ * `(taxonomyId, parentId)`) uniqueness is the publish factory's own precheck, not this function's
+ * job — same split as `importTaxonomy`/`importEntry`.
+ *
+ * Unlike `createTerm`, an import can MOVE an existing term (an import-as-update with a new
+ * `parentId`), so the destination's real ancestor chain is loaded first (`loadAncestorChain`) and
+ * handed to the certified `wouldCreateCycle` walk — a publish must never write a parent loop into
+ * live taxonomy, where every tree walk over it would spin forever.
+ *
+ * @complexity O(d) — one taxonomy lookup, one id lookup, one optional parent lookup, `d` ancestor
+ * lookups (the candidate parent's depth), one insert-or-update, one revision append.
+ */
+export async function importTerm(required, _optional = {}) {
+    const { deps, principalId, id, taxonomyId, name, parentId, expectedVersion } = required;
+    await authorizeTaxonomyManage(deps, principalId);
+    const taxonomy = await deps.taxonomies.findById(taxonomyId);
+    if (!taxonomy) {
+        throw new TaxonomyRecordNotFoundError(`taxonomy '${taxonomyId}' was not found`);
+    }
+    const existing = await deps.terms.findByIdFull(id);
+    if (expectedVersion === undefined) {
+        if (existing) {
+            throw new TaxonomyVersionConflictError(`term '${id}' already exists, but no expectedVersion was supplied for import`);
+        }
+    }
+    else {
+        if (!existing) {
+            throw new TaxonomyVersionConflictError(`expected version ${expectedVersion} for term '${id}', but no such term exists`);
+        }
+        if (existing.version !== expectedVersion) {
+            throw new TaxonomyVersionConflictError(`expected version ${expectedVersion} for term '${id}', found ${existing.version}`);
+        }
+        // A cross-taxonomy move would leave the term's children parented across taxonomies.
+        if (existing.taxonomyId !== taxonomyId) {
+            throw new TaxonomyVersionConflictError(`term '${id}' belongs to taxonomy '${existing.taxonomyId}', not '${taxonomyId}'; an import cannot move a term between taxonomies`);
+        }
+    }
+    const candidateParentId = parentId ?? null;
+    let resolvedParent = "not-applicable";
+    if (candidateParentId !== null) {
+        const parentTerm = await deps.terms.findById(candidateParentId);
+        resolvedParent = parentTerm ? { id: parentTerm.id, taxonomyId: parentTerm.taxonomyId } : null;
+    }
+    const ancestors = candidateParentId === null ? new Map() : await loadAncestorChain(deps.terms, candidateParentId);
+    validateHierarchyAssignment({
+        childTaxonomyId: taxonomyId,
+        taxonomyIsHierarchical: taxonomy.hierarchical,
+        candidateParentId,
+        resolvedParent,
+        wouldCreateCycle: (parent) => wouldCreateCycle({ termId: id, candidateParentId: parent, tree: { getParentId: (termId) => ancestors.get(termId) ?? null } }),
+        termId: existing ? id : "__new__",
+    });
+    const now = deps.clock.nowIso();
+    const term = {
+        id,
+        taxonomyId,
+        parentId: candidateParentId,
+        name,
+        status: "active",
+        updatedAt: now,
+        version: existing ? existing.version + 1 : 1,
+    };
+    if (existing) {
+        await deps.terms.update(term);
+    }
+    else {
+        await deps.terms.insert(term);
+    }
+    await deps.revisions.insert({
+        taxonomyId,
+        op: "import",
+        previousState: existing ? { name: existing.name, parentId: existing.parentId } : null,
+        actorId: principalId,
+        recordedAt: now,
+    });
+    deps.stampWatermark();
+    await deps.outbox.enqueue({ name: "taxonomy.term_imported", termId: term.id, actorId: principalId, occurredAt: now });
+    return term;
+}
 /** AC-15/AC-19/AC-25/REQ-12/REQ-17 — same-tx rename + revision (carrying the pre-rename state) +
  * watermark + outbox. `authorize()` runs before the term lookup, so a denied caller produces zero
  * side effects of any kind. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/cms",
-  "version": "0.3.8",
+  "version": "0.3.10",
   "description": "Content-model capability for Jini-hosted products: framework-free contracts, ports, and domain services in `/core` and per-domain subpaths; Node-bound persistence adapters in `/server`.",
   "license": "Apache-2.0",
   "repository": {