@jini-ai/cms 0.5.2 → 0.5.3

package/dist/widgets/entry-payload.d.ts

@@ -0,0 +1,103 @@
+import type { ContentTypeRepoPort } from "../content-types/index.js";
+import type { WidgetHostPorts } from "./host-ports.js";
+import type { Clock as ClockPort } from "@jini-ai/core/primitives";
+import type { OutboxPort } from "../core/index.js";
+import type { EntryRecord } from "../entries/index.js";
+import type { WidgetAreaDoc, WidgetAreaEntry, WidgetInstanceEntry, WidgetInstanceStatus, WidgetPlacementNode, WidgetRegionKey, WidgetTypeKey } from "./types.js";
+/**
+ * @file Storage-shape plumbing shared by `write-service.ts`/`region-area-service.ts` — how a
+ * widget instance's/`widget_area`'s data actually lives inside an `entries` row.
+ *
+ * Purpose (a real, disclosed deviation from the spec's literal storage-path wording — see the
+ * implementation report):
+ * `features/entries/write-service.ts`'s `updateEntry` can only change `title`/`fieldsJson` — it has
+ * no parameter to change `bodyJson` at all once an entry is created (confirmed by reading its
+ * `UpdateEntryRequired.input` shape and body). Widget config MUST be updatable (REQ-05/AC-04), so
+ * it cannot live in `bodyJson`.
+ *
+ * Owner namespace (2026-07-21, fixed): `features/entries/field-validation.ts`'s
+ * `validateFieldsAgainstSchema` now accepts an `owner` parameter instead of hardcoding `site`
+ * (a real, confirmed gap against ADR-022 §2 — see that file's header and the implementation
+ * report). Widget instances write under `fields.ext.widget.*` (`WIDGET_FIELD_NAMESPACE`) and
+ * `widget_area` entries under `fields.ext.widgets.*` (`WIDGET_AREA_FIELD_NAMESPACE`), matching
+ * REQ-01/REQ-11's literal namespacing — not a shared `site` bag.
+ * Since 2026-10-04 that namespace is a property of the registered content type (`owner` below), not
+ * a per-call `owner` argument: the entries chokepoint reads it off the type, so the generic entries
+ * routes can no longer validate a widget payload under `ext.site` (how two unreadable probe rows
+ * reached production on 2026-08-03).
+ *
+ * A widget instance's `config` shape is still polymorphic per `widgetType` (declared in
+ * `registry.ts`'s per-type `configSchema`, a JSON-Schema-like validator, not the generic entries
+ * fixed-field-list schema `validateFieldsAgainstSchema` checks) — the generic entries content-type
+ * field list genuinely cannot express "shape varies by widgetType" regardless of which `ext` owner
+ * it validates under, and widgets already runs its own `validateWidgetConfig` (REQ-02) against the
+ * real per-type schema before ever reaching this layer. So this file still stores the real
+ * config/doc data as one JSON-serialized string in a single required `payload` text field — now
+ * under the correct owner namespace — rather than mapping each config key to its own generic-entries
+ * field, which round-trips the exact `WidgetInstanceEntry.config`/`WidgetAreaEntry.doc` shapes the
+ * public contracts (`types.ts`) declare. `bodyJson` is left unused by this feature (REQ-11's
+ * `bodyJson.placements` placement is a separate, disclosed deviation, not fixed by this namespace
+ * change — see the implementation report).
+ */
+export declare const WIDGET_PAYLOAD_FIELD = "payload";
+interface WidgetInstancePayload {
+    widgetType: WidgetTypeKey;
+    /** `Record<string, unknown>`, not `JsonObject`, matching the stub-frozen `Create/UpdateWidgetInstanceInput.config` shape (`write-service.ts`) — cast to `JsonObject` only at the `WidgetInstanceEntry` read-model boundary below. */
+    config: Record<string, unknown>;
+    status: WidgetInstanceStatus;
+}
+interface WidgetAreaPayload {
+    regionKey: WidgetRegionKey;
+    doc: WidgetAreaDoc;
+}
+export declare function buildWidgetInstanceFieldsJson({ payload }: {
+    payload: WidgetInstancePayload;
+}, _optional?: Record<string, never>): unknown;
+export declare function parseWidgetInstancePayload({ fieldsJson }: {
+    fieldsJson: unknown;
+}, _optional?: Record<string, never>): WidgetInstancePayload;
+export declare function buildWidgetAreaFieldsJson({ payload }: {
+    payload: WidgetAreaPayload;
+}, _optional?: Record<string, never>): unknown;
+export declare function parseWidgetAreaPayload({ fieldsJson }: {
+    fieldsJson: unknown;
+}, _optional?: Record<string, never>): WidgetAreaPayload;
+export declare function toWidgetInstanceEntry({ entry }: {
+    entry: EntryRecord;
+}, _optional?: Record<string, never>): WidgetInstanceEntry;
+export declare function toWidgetAreaEntry({ entry }: {
+    entry: EntryRecord;
+}, _optional?: Record<string, never>): WidgetAreaEntry;
+/** Stable, workspace-unique slug for a region's `widget_area` entry — also the natural de-dup key REQ-13's idempotent seeding relies on. */
+export declare function widgetAreaSlug({ regionKey }: {
+    regionKey: WidgetRegionKey;
+}, _optional?: Record<string, never>): string;
+export declare function emptyWidgetAreaDoc(_required: Record<string, never>, _optional?: Record<string, never>): WidgetAreaDoc;
+export declare function areaDocWithPlacements(required: {
+    doc: WidgetAreaDoc;
+    placements: readonly WidgetPlacementNode[];
+}, _optional?: Record<string, never>): WidgetAreaDoc;
+/**
+ * Registers the `widget`/`widget_area` seeded content types (ADR-047 §1, REQ-11) in `workspaceId`
+ * if not already present — idempotent, safe to call before every write. Delegates to
+ * `features/content-types/write-service.ts`'s real `registerContentType` chokepoint (the same
+ * mechanism any Collections content type is registered through) rather than hand-constructing a
+ * `content_types` row, per this task's "compose real infra, don't reimplement" directive. Each
+ * type gets exactly one required `text`-kind field (`payload`) — see this file's header for why
+ * the real config/doc data is JSON-serialized into that one field rather than expressed as
+ * per-field scalar columns.
+ */
+export declare function ensureWidgetContentTypesRegistered(required: {
+    deps: {
+        host: Pick<WidgetHostPorts, "contentTypes">;
+        contentTypeRepo: ContentTypeRepoPort;
+        clock: ClockPort;
+        ids: {
+            newId: () => string;
+        };
+        outbox: OutboxPort;
+    };
+    workspaceId: string;
+}, _optional?: Record<string, never>): Promise<void>;
+export {};
+//# sourceMappingURL=entry-payload.d.ts.map

package/dist/widgets/entry-payload.js

@@ -0,0 +1,160 @@
+import { isNonArrayRecord } from "@jini-ai/core";
+import { PRE_AUTHORIZED, WIDGETS_SYSTEM_ACTOR_ID } from "./authorize-helper.js";
+import { WIDGET_AREA_CONTENT_TYPE, WIDGET_AREA_FIELD_NAMESPACE, WIDGET_CONTENT_TYPE, WIDGET_FIELD_NAMESPACE, } from "./types.js";
+/**
+ * @file Storage-shape plumbing shared by `write-service.ts`/`region-area-service.ts` — how a
+ * widget instance's/`widget_area`'s data actually lives inside an `entries` row.
+ *
+ * Purpose (a real, disclosed deviation from the spec's literal storage-path wording — see the
+ * implementation report):
+ * `features/entries/write-service.ts`'s `updateEntry` can only change `title`/`fieldsJson` — it has
+ * no parameter to change `bodyJson` at all once an entry is created (confirmed by reading its
+ * `UpdateEntryRequired.input` shape and body). Widget config MUST be updatable (REQ-05/AC-04), so
+ * it cannot live in `bodyJson`.
+ *
+ * Owner namespace (2026-07-21, fixed): `features/entries/field-validation.ts`'s
+ * `validateFieldsAgainstSchema` now accepts an `owner` parameter instead of hardcoding `site`
+ * (a real, confirmed gap against ADR-022 §2 — see that file's header and the implementation
+ * report). Widget instances write under `fields.ext.widget.*` (`WIDGET_FIELD_NAMESPACE`) and
+ * `widget_area` entries under `fields.ext.widgets.*` (`WIDGET_AREA_FIELD_NAMESPACE`), matching
+ * REQ-01/REQ-11's literal namespacing — not a shared `site` bag.
+ * Since 2026-10-04 that namespace is a property of the registered content type (`owner` below), not
+ * a per-call `owner` argument: the entries chokepoint reads it off the type, so the generic entries
+ * routes can no longer validate a widget payload under `ext.site` (how two unreadable probe rows
+ * reached production on 2026-08-03).
+ *
+ * A widget instance's `config` shape is still polymorphic per `widgetType` (declared in
+ * `registry.ts`'s per-type `configSchema`, a JSON-Schema-like validator, not the generic entries
+ * fixed-field-list schema `validateFieldsAgainstSchema` checks) — the generic entries content-type
+ * field list genuinely cannot express "shape varies by widgetType" regardless of which `ext` owner
+ * it validates under, and widgets already runs its own `validateWidgetConfig` (REQ-02) against the
+ * real per-type schema before ever reaching this layer. So this file still stores the real
+ * config/doc data as one JSON-serialized string in a single required `payload` text field — now
+ * under the correct owner namespace — rather than mapping each config key to its own generic-entries
+ * field, which round-trips the exact `WidgetInstanceEntry.config`/`WidgetAreaEntry.doc` shapes the
+ * public contracts (`types.ts`) declare. `bodyJson` is left unused by this feature (REQ-11's
+ * `bodyJson.placements` placement is a separate, disclosed deviation, not fixed by this namespace
+ * change — see the implementation report).
+ */
+export const WIDGET_PAYLOAD_FIELD = "payload";
+/** Reads the single `payload` text field out of an entry's `fieldsJson.ext.<owner>` envelope. */
+function readPayloadString(fieldsJson, owner) {
+    const fields = { value: fieldsJson };
+    if (!isNonArrayRecord(fields))
+        throw new Error("widgets: malformed fieldsJson (expected an object)");
+    const ext = { value: fields.value.ext };
+    if (!isNonArrayRecord(ext))
+        throw new Error("widgets: malformed fieldsJson (missing ext)");
+    const ownerBag = { value: ext.value[owner] };
+    if (!isNonArrayRecord(ownerBag) || typeof ownerBag.value[WIDGET_PAYLOAD_FIELD] !== "string") {
+        throw new Error(`widgets: malformed fieldsJson (missing fields.ext.${owner}.payload)`);
+    }
+    return ownerBag.value[WIDGET_PAYLOAD_FIELD];
+}
+function buildFieldsJson(payload, owner) {
+    return { ext: { [owner]: { [WIDGET_PAYLOAD_FIELD]: JSON.stringify(payload) } } };
+}
+export function buildWidgetInstanceFieldsJson({ payload }, _optional = {}) {
+    return buildFieldsJson(payload, WIDGET_FIELD_NAMESPACE);
+}
+export function parseWidgetInstancePayload({ fieldsJson }, _optional = {}) {
+    return JSON.parse(readPayloadString(fieldsJson, WIDGET_FIELD_NAMESPACE));
+}
+export function buildWidgetAreaFieldsJson({ payload }, _optional = {}) {
+    return buildFieldsJson(payload, WIDGET_AREA_FIELD_NAMESPACE);
+}
+export function parseWidgetAreaPayload({ fieldsJson }, _optional = {}) {
+    return JSON.parse(readPayloadString(fieldsJson, WIDGET_AREA_FIELD_NAMESPACE));
+}
+export function toWidgetInstanceEntry({ entry }, _optional = {}) {
+    const payload = parseWidgetInstancePayload({ fieldsJson: entry.fieldsJson });
+    return {
+        id: entry.id,
+        workspaceId: entry.workspaceId,
+        slug: entry.slug,
+        title: entry.title,
+        status: payload.status,
+        widgetType: payload.widgetType,
+        config: payload.config,
+        updatedAt: entry.updatedAt,
+        version: entry.version,
+    };
+}
+export function toWidgetAreaEntry({ entry }, _optional = {}) {
+    const payload = parseWidgetAreaPayload({ fieldsJson: entry.fieldsJson });
+    return {
+        id: entry.id,
+        workspaceId: entry.workspaceId,
+        regionKey: payload.regionKey,
+        doc: payload.doc,
+        updatedAt: entry.updatedAt,
+        version: entry.version,
+    };
+}
+/** Stable, workspace-unique slug for a region's `widget_area` entry — also the natural de-dup key REQ-13's idempotent seeding relies on. */
+export function widgetAreaSlug({ regionKey }, _optional = {}) {
+    return `widget-area-${regionKey}`;
+}
+export function emptyWidgetAreaDoc(_required, _optional = {}) {
+    return { schemaVersion: 1, placements: [] };
+}
+export function areaDocWithPlacements(required, _optional = {}) {
+    return { schemaVersion: required.doc.schemaVersion, placements: required.placements };
+}
+/**
+ * Registers the `widget`/`widget_area` seeded content types (ADR-047 §1, REQ-11) in `workspaceId`
+ * if not already present — idempotent, safe to call before every write. Delegates to
+ * `features/content-types/write-service.ts`'s real `registerContentType` chokepoint (the same
+ * mechanism any Collections content type is registered through) rather than hand-constructing a
+ * `content_types` row, per this task's "compose real infra, don't reimplement" directive. Each
+ * type gets exactly one required `text`-kind field (`payload`) — see this file's header for why
+ * the real config/doc data is JSON-serialized into that one field rather than expressed as
+ * per-field scalar columns.
+ */
+export async function ensureWidgetContentTypesRegistered(required, _optional = {}) {
+    const { deps, workspaceId } = required;
+    await ensureOneContentTypeRegistered(deps, workspaceId, WIDGET_CONTENT_TYPE, "Widget", WIDGET_FIELD_NAMESPACE);
+    await ensureOneContentTypeRegistered(deps, workspaceId, WIDGET_AREA_CONTENT_TYPE, "Widget Area", WIDGET_AREA_FIELD_NAMESPACE);
+}
+async function ensureOneContentTypeRegistered(deps, workspaceId, key, label, owner) {
+    const existing = await deps.contentTypeRepo.findByKey({ workspaceId, key });
+    if (existing)
+        return;
+    const result = await deps.host.contentTypes.registerContentType({
+        deps: {
+            repo: deps.contentTypeRepo,
+            clock: deps.clock,
+            ids: deps.ids,
+            authorize: PRE_AUTHORIZED,
+            indexProvisioner: deps.host.contentTypes.createIndexProvisioner(),
+            outbox: deps.host.contentTypes.toContentTypeOutbox({ outbox: deps.outbox, clock: deps.clock, idGen: deps.ids, workspaceId }),
+        },
+        input: {
+            actorId: WIDGETS_SYSTEM_ACTOR_ID,
+            // Not a human and not the assistant — this is the widgets subsystem seeding its own two
+            // content types at boot (REQ-13). Recording it as such keeps the audit trail able to say
+            // "nobody did this, the system did".
+            principalKind: "system",
+            workspaceId,
+            key,
+            label,
+            fields: [{ name: WIDGET_PAYLOAD_FIELD, kind: "text", required: true, queryable: false }],
+            // The envelope namespace belongs to the type (2026-10-04): every entry write, including the
+            // generic entries routes, now validates this type's payload under `ext.<owner>` with no
+            // caller passing it. `content-types/declared-owners.ts` restores it on SQL reads.
+            owner,
+        },
+    });
+    if (!result.ok) {
+        // S9 (web-high fix plan, 2026-09-24): two concurrent first-widget creates both saw `findByKey`
+        // return null above and both called `registerContentType`; the loser now gets
+        // `ContentTypeAlreadyExistsError` instead of silently overwriting the winner's row. That is
+        // exactly the outcome this function wants — a content type now exists — so treat it as success,
+        // UNLESS the key was tombstoned (`tombstoned: true`), which is a real, unrecoverable failure.
+        const existingError = deps.host.contentTypes.alreadyExists(result.error);
+        if (existingError && !existingError.tombstoned)
+            return;
+        throw result.error;
+    }
+}
+//# sourceMappingURL=entry-payload.js.map

package/dist/widgets/errors.d.ts

@@ -0,0 +1,136 @@
+/**
+ * @file Typed domain errors for `widgets` (SPEC-043).
+ *
+ * Purpose:
+ * One class per error this module originates; route handlers map these 1:1 to HTTP codes.
+ * Mirrors the `forms/errors.ts` / `PostConflictError`-style convention already used throughout
+ * this codebase.
+ *
+ * `this.name` fix (found during implementation, additive-only — no constructor signature
+ * changed): `class X extends Error {}` does NOT give an instance a `.name` of `"X"` on this
+ * runtime unless the constructor sets `this.name` explicitly (confirmed by
+ * `features/entries/errors.ts`'s own header, which documents and applies this exact fix already).
+ * Without it, `Error.prototype.toString()` — what `assert.rejects(fn, /ClassName/)` matches
+ * against — reads `"Error: <message>"` for every class here, so a certified test asserting
+ * `/WidgetConfigValidationError/` etc. could never pass regardless of which error actually threw.
+ */
+/** `WIDGETS_TYPE_UNREGISTERED` (400) — `widgetType` is not present in the registry (REQ-03). */
+export declare class WidgetTypeUnregisteredError extends Error {
+    readonly widgetType: string;
+    constructor({ message, widgetType }: {
+        message: string;
+        widgetType: string;
+    }, _optional?: Record<string, never>);
+}
+/** `WIDGETS_CONFIG_VALIDATION_ERROR` (400) — config fails the type's registered schema (REQ-02). */
+export declare class WidgetConfigValidationError extends Error {
+    readonly fieldErrors: Array<{
+        field: string;
+        reason: string;
+    }>;
+    constructor({ message, fieldErrors }: {
+        message: string;
+        fieldErrors?: Array<{
+            field: string;
+            reason: string;
+        }>;
+    }, _optional?: Record<string, never>);
+}
+/** `WIDGETS_VERSION_CONFLICT` (409) — optimistic-concurrency mismatch (REQ-06). */
+export declare class WidgetVersionConflictError extends Error {
+    readonly currentVersion: number;
+    constructor({ message, currentVersion }: {
+        message: string;
+        currentVersion: number;
+    }, _optional?: Record<string, never>);
+}
+/** `WIDGETS_AREA_CONFLICT` (409) — a `widget_area` mutation lost an OCC race (REQ-15). */
+export declare class WidgetAreaConflictError extends Error {
+    readonly currentVersion: number;
+    constructor({ message, currentVersion }: {
+        message: string;
+        currentVersion: number;
+    }, _optional?: Record<string, never>);
+}
+/**
+ * `WIDGETS_REFERENCED` (409) — delete attempted without `.force` while the
+ * instance is still referenced by at least one placement (REQ-42).
+ */
+export declare class WidgetReferencedError extends Error {
+    readonly referencingLocations: Array<{
+        kind: "region" | "embed";
+        entryId: string;
+    }>;
+    constructor({ message, referencingLocations }: {
+        message: string;
+        referencingLocations?: Array<{
+            kind: "region" | "embed";
+            entryId: string;
+        }>;
+    }, _optional?: Record<string, never>);
+}
+/**
+ * `WIDGETS_EMBED_GUARDRAIL_VIOLATION` (400) — a `widgetEmbed` mutation would
+ * create recursion or exceed the per-document embed count (REQ-19/20), raised
+ * identically regardless of whether the mutation originated from the live
+ * editor or the server-side/AI command path (INV-04).
+ */
+export declare class WidgetEmbedGuardrailError extends Error {
+    readonly reason: "recursion" | "count-exceeded";
+    constructor({ message, reason }: {
+        message: string;
+        reason: "recursion" | "count-exceeded";
+    }, _optional?: Record<string, never>);
+}
+/** `WIDGETS_INSTANCE_NOT_FOUND` (404). */
+export declare class WidgetInstanceNotFoundError extends Error {
+    constructor({ message }: {
+        message: string;
+    }, _optional?: Record<string, never>);
+}
+/** `WIDGETS_AREA_NOT_FOUND` (404). */
+export declare class WidgetAreaNotFoundError extends Error {
+    constructor({ message }: {
+        message: string;
+    }, _optional?: Record<string, never>);
+}
+/**
+ * `WIDGETS_FORBIDDEN` (403) — a principal lacking the required flat `widgets.*` permission
+ * attempted a widget mutation or read (REQ-40/41, INV-07). Added during implementation: the
+ * original stub-era contract had no distinct forbidden-error class for this library (every other
+ * `write-service.ts`-shaped chokepoint in this codebase — `features/entries`, `features/
+ * content-types` — has its own `ForbiddenError`), so `write-service.ts`/`region-area-service.ts`
+ * had no typed way to signal an `authorize()` rejection distinctly from every other failure mode.
+ */
+export declare class WidgetForbiddenError extends Error {
+    constructor({ message }: {
+        message: string;
+    }, _optional?: Record<string, never>);
+}
+/** `WIDGETS_EMBED_HOST_NOT_FOUND` (404) — no post, page, or content entry with that id in this workspace (or it is trashed). */
+export declare class WidgetEmbedHostNotFoundError extends Error {
+    constructor({ message }: {
+        message: string;
+    }, _optional?: Record<string, never>);
+}
+/**
+ * `WIDGETS_EMBED_PLACEMENT_NOT_FOUND` (404) — `removeWidgetEmbed` was called with a `placementId`
+ * that matches no `widgetEmbed` node in the host's body (already removed, or never existed). Fixed
+ * during the C4d leftovers pass: `removeEmbedByPlacementId` is a no-op filter — before this class
+ * existed, a stale or bogus `placementId` fell through to `writeHostBody` unchanged and reported
+ * success while writing nothing.
+ */
+export declare class WidgetEmbedPlacementNotFoundError extends Error {
+    constructor({ message }: {
+        message: string;
+    }, _optional?: Record<string, never>);
+}
+/** `WIDGETS_EMBED_HOST_UNSUPPORTED` (400) — the host exists but has no rich-text body a widgetEmbed node can live in. */
+export declare class WidgetEmbedHostUnsupportedError extends Error {
+    readonly reason: "html-page" | "widget-area";
+    constructor({ message, reason }: {
+        message: string;
+        reason: "html-page" | "widget-area";
+    }, _optional?: Record<string, never>);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/widgets/errors.js

@@ -0,0 +1,136 @@
+/**
+ * @file Typed domain errors for `widgets` (SPEC-043).
+ *
+ * Purpose:
+ * One class per error this module originates; route handlers map these 1:1 to HTTP codes.
+ * Mirrors the `forms/errors.ts` / `PostConflictError`-style convention already used throughout
+ * this codebase.
+ *
+ * `this.name` fix (found during implementation, additive-only — no constructor signature
+ * changed): `class X extends Error {}` does NOT give an instance a `.name` of `"X"` on this
+ * runtime unless the constructor sets `this.name` explicitly (confirmed by
+ * `features/entries/errors.ts`'s own header, which documents and applies this exact fix already).
+ * Without it, `Error.prototype.toString()` — what `assert.rejects(fn, /ClassName/)` matches
+ * against — reads `"Error: <message>"` for every class here, so a certified test asserting
+ * `/WidgetConfigValidationError/` etc. could never pass regardless of which error actually threw.
+ */
+/** `WIDGETS_TYPE_UNREGISTERED` (400) — `widgetType` is not present in the registry (REQ-03). */
+export class WidgetTypeUnregisteredError extends Error {
+    widgetType;
+    constructor({ message, widgetType }, _optional = {}) {
+        super(message);
+        this.widgetType = widgetType;
+        this.name = "WidgetTypeUnregisteredError";
+    }
+}
+/** `WIDGETS_CONFIG_VALIDATION_ERROR` (400) — config fails the type's registered schema (REQ-02). */
+export class WidgetConfigValidationError extends Error {
+    fieldErrors;
+    constructor({ message, fieldErrors = [] }, _optional = {}) {
+        super(message);
+        this.fieldErrors = fieldErrors;
+        this.name = "WidgetConfigValidationError";
+    }
+}
+/** `WIDGETS_VERSION_CONFLICT` (409) — optimistic-concurrency mismatch (REQ-06). */
+export class WidgetVersionConflictError extends Error {
+    currentVersion;
+    constructor({ message, currentVersion }, _optional = {}) {
+        super(message);
+        this.currentVersion = currentVersion;
+        this.name = "WidgetVersionConflictError";
+    }
+}
+/** `WIDGETS_AREA_CONFLICT` (409) — a `widget_area` mutation lost an OCC race (REQ-15). */
+export class WidgetAreaConflictError extends Error {
+    currentVersion;
+    constructor({ message, currentVersion }, _optional = {}) {
+        super(message);
+        this.currentVersion = currentVersion;
+        this.name = "WidgetAreaConflictError";
+    }
+}
+/**
+ * `WIDGETS_REFERENCED` (409) — delete attempted without `.force` while the
+ * instance is still referenced by at least one placement (REQ-42).
+ */
+export class WidgetReferencedError extends Error {
+    referencingLocations;
+    constructor({ message, referencingLocations = [] }, _optional = {}) {
+        super(message);
+        this.referencingLocations = referencingLocations;
+        this.name = "WidgetReferencedError";
+    }
+}
+/**
+ * `WIDGETS_EMBED_GUARDRAIL_VIOLATION` (400) — a `widgetEmbed` mutation would
+ * create recursion or exceed the per-document embed count (REQ-19/20), raised
+ * identically regardless of whether the mutation originated from the live
+ * editor or the server-side/AI command path (INV-04).
+ */
+export class WidgetEmbedGuardrailError extends Error {
+    reason;
+    constructor({ message, reason }, _optional = {}) {
+        super(message);
+        this.reason = reason;
+        this.name = "WidgetEmbedGuardrailError";
+    }
+}
+/** `WIDGETS_INSTANCE_NOT_FOUND` (404). */
+export class WidgetInstanceNotFoundError extends Error {
+    constructor({ message }, _optional = {}) {
+        super(message);
+        this.name = "WidgetInstanceNotFoundError";
+    }
+}
+/** `WIDGETS_AREA_NOT_FOUND` (404). */
+export class WidgetAreaNotFoundError extends Error {
+    constructor({ message }, _optional = {}) {
+        super(message);
+        this.name = "WidgetAreaNotFoundError";
+    }
+}
+/**
+ * `WIDGETS_FORBIDDEN` (403) — a principal lacking the required flat `widgets.*` permission
+ * attempted a widget mutation or read (REQ-40/41, INV-07). Added during implementation: the
+ * original stub-era contract had no distinct forbidden-error class for this library (every other
+ * `write-service.ts`-shaped chokepoint in this codebase — `features/entries`, `features/
+ * content-types` — has its own `ForbiddenError`), so `write-service.ts`/`region-area-service.ts`
+ * had no typed way to signal an `authorize()` rejection distinctly from every other failure mode.
+ */
+export class WidgetForbiddenError extends Error {
+    constructor({ message }, _optional = {}) {
+        super(message);
+        this.name = "WidgetForbiddenError";
+    }
+}
+/** `WIDGETS_EMBED_HOST_NOT_FOUND` (404) — no post, page, or content entry with that id in this workspace (or it is trashed). */
+export class WidgetEmbedHostNotFoundError extends Error {
+    constructor({ message }, _optional = {}) {
+        super(message);
+        this.name = "WidgetEmbedHostNotFoundError";
+    }
+}
+/**
+ * `WIDGETS_EMBED_PLACEMENT_NOT_FOUND` (404) — `removeWidgetEmbed` was called with a `placementId`
+ * that matches no `widgetEmbed` node in the host's body (already removed, or never existed). Fixed
+ * during the C4d leftovers pass: `removeEmbedByPlacementId` is a no-op filter — before this class
+ * existed, a stale or bogus `placementId` fell through to `writeHostBody` unchanged and reported
+ * success while writing nothing.
+ */
+export class WidgetEmbedPlacementNotFoundError extends Error {
+    constructor({ message }, _optional = {}) {
+        super(message);
+        this.name = "WidgetEmbedPlacementNotFoundError";
+    }
+}
+/** `WIDGETS_EMBED_HOST_UNSUPPORTED` (400) — the host exists but has no rich-text body a widgetEmbed node can live in. */
+export class WidgetEmbedHostUnsupportedError extends Error {
+    reason;
+    constructor({ message, reason }, _optional = {}) {
+        super(message);
+        this.reason = reason;
+        this.name = "WidgetEmbedHostUnsupportedError";
+    }
+}
+//# sourceMappingURL=errors.js.map