@things-factory/shell 10.1.29 → 10.1.33

package/client/themes/dark.css

@@ -1,5 +1,6 @@
 /*
- * Accent-derived slots read `--brand-<slot>` so a product can set them from its own brand.css.
+ * Accent-derived slots read `--brand-<slot>` so a product can set them from its own accent theme
+ * file, named after the product (`plant-accent.css`) - never after a shell theme file.
  * Neutral slots read `--suite-<slot>`, set by the product suite (@things-factory/operato-suite) for the
  * apps that depend on it. Bundle order does not matter for a var(); the fallback is the shell value.
  * Error, shadow and scrim stay literal on purpose - nobody above the platform owns them.

package/client/themes/light.css

@@ -1,5 +1,6 @@
 /*
- * Accent-derived slots read `--brand-<slot>` so a product can set them from its own brand.css.
+ * Accent-derived slots read `--brand-<slot>` so a product can set them from its own accent theme
+ * file, named after the product (`plant-accent.css`) - never after a shell theme file.
  * Neutral slots read `--suite-<slot>`, set by the product suite (@things-factory/operato-suite) for the
  * apps that depend on it. Bundle order does not matter for a var(); the fallback is the shell value.
  * Error, shadow and scrim stay literal on purpose - nobody above the platform owns them.

package/client/themes/theme-base.css

@@ -12,7 +12,7 @@
  *
  * [넣는 것]  브랜드와 무관하게 항상 성립해야 하는 규칙(테마 스킴, 공통 접근성 기본값 등)
  * [넣지 않는 것]  브랜드 색값.
- *   Products set accent colours only, as `--brand-<slot>` in their own `brand.css`. The shell
+ *   Products set accent colours only, as `--brand-<slot>` in their own `<product>-accent.css`. The shell
  *   `light.css` / `dark.css` read the 26 accent-derived md-sys slots from those variables, the 17
  *   neutral slots from `--suite-<slot>` (the product suite's shared greys), and keep the last 6
  *   (error, shadow, scrim) literal. See tests/md-sys-slot-owners.test.ts.

package/dist-server/index.d.ts

@@ -8,6 +8,8 @@ export * from './middlewares/index.js';
 export * from './bootstrap-hooks.js';
 export * from './graphql-local-client.js';
 export * from './service/index.js';
+export * from './refusal/index.js';
+export * from './reversibility/index.js';
 export * from './typeorm/long-text-column.js';
 export * from './typeorm/encrypt-transform.js';
 export * from './typeorm/encrypt-json-transform.js';

package/dist-server/index.js

@@ -11,6 +11,8 @@ tslib_1.__exportStar(require("./middlewares/index.js"), exports);
 tslib_1.__exportStar(require("./bootstrap-hooks.js"), exports);
 tslib_1.__exportStar(require("./graphql-local-client.js"), exports);
 tslib_1.__exportStar(require("./service/index.js"), exports);
+tslib_1.__exportStar(require("./refusal/index.js"), exports);
+tslib_1.__exportStar(require("./reversibility/index.js"), exports);
 tslib_1.__exportStar(require("./typeorm/long-text-column.js"), exports);
 tslib_1.__exportStar(require("./typeorm/encrypt-transform.js"), exports);
 tslib_1.__exportStar(require("./typeorm/encrypt-json-transform.js"), exports);

package/dist-server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../server/index.ts"],"names":[],"mappings":";;;AAAA,gEAAqC;AACrC,4EAAiD;AACjD,qEAA0C;AAC1C,2DAAgC;AAChC,sDAA2B;AAC3B,oEAAyC;AACzC,iEAAsC;AACtC,+DAAoC;AACpC,oEAAyC;AACzC,6DAAkC;AAElC,wEAA6C;AAC7C,yEAA8C;AAC9C,8EAAmD;AACnD,uEAA4C;AAC5C,uEAA4C","sourcesContent":["export * from './migrations/index.js'\nexport * from './initializers/naming-strategy.js'\nexport * from './initializers/database.js'\nexport * from './utils/index.js'\nexport * from './pubsub.js'\nexport * from './pubsub-log-transport.js'\nexport * from './middlewares/index.js'\nexport * from './bootstrap-hooks.js'\nexport * from './graphql-local-client.js'\nexport * from './service/index.js'\n\nexport * from './typeorm/long-text-column.js'\nexport * from './typeorm/encrypt-transform.js'\nexport * from './typeorm/encrypt-json-transform.js'\nexport * from './typeorm/json5-transform.js'\nexport * from './typeorm/round-transform.js'\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../server/index.ts"],"names":[],"mappings":";;;AAAA,gEAAqC;AACrC,4EAAiD;AACjD,qEAA0C;AAC1C,2DAAgC;AAChC,sDAA2B;AAC3B,oEAAyC;AACzC,iEAAsC;AACtC,+DAAoC;AACpC,oEAAyC;AACzC,6DAAkC;AAClC,6DAAkC;AAClC,mEAAwC;AAExC,wEAA6C;AAC7C,yEAA8C;AAC9C,8EAAmD;AACnD,uEAA4C;AAC5C,uEAA4C","sourcesContent":["export * from './migrations/index.js'\nexport * from './initializers/naming-strategy.js'\nexport * from './initializers/database.js'\nexport * from './utils/index.js'\nexport * from './pubsub.js'\nexport * from './pubsub-log-transport.js'\nexport * from './middlewares/index.js'\nexport * from './bootstrap-hooks.js'\nexport * from './graphql-local-client.js'\nexport * from './service/index.js'\nexport * from './refusal/index.js'\nexport * from './reversibility/index.js'\n\nexport * from './typeorm/long-text-column.js'\nexport * from './typeorm/encrypt-transform.js'\nexport * from './typeorm/encrypt-json-transform.js'\nexport * from './typeorm/json5-transform.js'\nexport * from './typeorm/round-transform.js'\n"]}

package/dist-server/refusal/index.d.ts

@@ -0,0 +1 @@
+export * from './refusal.js';

package/dist-server/refusal/index.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./refusal.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist-server/refusal/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../server/refusal/index.ts"],"names":[],"mappings":";;;AAAA,uDAA4B","sourcesContent":["export * from './refusal.js'\n"]}

package/dist-server/refusal/refusal.d.ts

@@ -0,0 +1,70 @@
+import { GraphQLError } from 'graphql';
+import type { MiddlewareFn } from 'type-graphql';
+/**
+ * **A refusal the server knows and names** (ADR-0054).
+ *
+ * ── Why a gate does not throw a sentence ──────────────────────────────────
+ * A gate that throws an English sentence puts English on a Korean screen. A screen that translates
+ * it is then writing the reason itself, and the gate and the screen end up with two accounts of the
+ * same refusal. So the gate throws a name and values, and the sentence is made where the request's
+ * language is known.
+ *
+ * ── What gets stored is the name ──────────────────────────────────────────
+ * Never write the sentence onto an event or a work row. A sentence differs per reader and the wording
+ * changes later; a stored one freezes that day's language. The `code` is the contract, and it travels
+ * unchanged to the client (ADR-0042 - no mapping table on the way out).
+ *
+ * ── Two traps ─────────────────────────────────────────────────────────────
+ * ① `t(key, undefined)` loses the locale and answers in English, so `params` is always passed - the
+ *    spread below makes an object even when a refusal carries none.
+ * ② Never pass a **value** to `t` as a key: `:` reads as a namespace separator and cuts `urn:epc:…`
+ *    apart. Values travel in `params` only.
+ *
+ * ── Why it lives in the shell ─────────────────────────────────────────────
+ * operato-plant wrote this first and operato-warehouse copied it; worklist is the third consumer as
+ * the work-door screens move there (ADR-0069 decision 3). Everything it needs is `graphql`,
+ * `type-graphql` and the request's `t`, all of which sit at or below the shell, so this is the floor
+ * that every consumer already stands on. The translations stay with each module: `refusalKey` names
+ * `error.<code>` inside the caller's own namespace, and a module that does not declare the key falls
+ * back to the English sentence rather than printing the key.
+ */
+export declare class Refusal extends Error {
+    readonly code: string;
+    readonly params: RefusalParams;
+    /**
+     * @param code this refusal's name (kebab). It states **the gate's fact**; a screen does not pick its
+     *   own sentence from this name.
+     * @param params the values the sentence is built from.
+     * @param english the sentence used when the translation key is missing. An English sentence reads
+     *   better than the key printed raw.
+     */
+    constructor(code: string, params: RefusalParams, english: string);
+}
+/** Values a refusal sentence is built from. Scalars only: they travel in the GraphQL response as they are. */
+export type RefusalParams = Record<string, string | number | boolean | null>;
+export declare function refusalKey(code: string): string;
+type Translate = (key: string, options?: Record<string, unknown>) => string;
+/**
+ * **The one place a refusal becomes a sentence.** The resolver wrapper and the worklist callbacks both
+ * call this, so the two exits cannot drift apart.
+ *
+ * Apollo's own `extensions.code` gets `BAD_USER_INPUT`: a refusal is not a server error, and left empty
+ * Apollo would fill in `INTERNAL_SERVER_ERROR`. The name rides separately in `extensions.refusal`; its
+ * presence is what tells a client the server refused on purpose.
+ */
+export declare function speakRefusal(refusal: Refusal, context: {
+    t?: Translate;
+}): GraphQLError;
+/** Rethrow a refusal as a sentence in the caller's language; anything else passes through untouched. */
+export declare function rethrowSpoken(error: unknown, context: {
+    t?: Translate;
+}): never;
+/** A resolver class passes through this (`@UseMiddleware(SpeakRefusals)`). */
+export declare const SpeakRefusals: MiddlewareFn<any>;
+/**
+ * An activity callback runs inside a worklist mutation, not the module's own resolver, so
+ * `SpeakRefusals` never sees what it throws. Declarations wrap their callback in this: the same
+ * `speakRefusal`, the other exit.
+ */
+export declare function speaksRefusals(callback: (instance: any, addendum: any, context: any) => Promise<void>): (instance: any, addendum: any, context: any) => Promise<void>;
+export {};

package/dist-server/refusal/refusal.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SpeakRefusals = exports.Refusal = void 0;
+exports.refusalKey = refusalKey;
+exports.speakRefusal = speakRefusal;
+exports.rethrowSpoken = rethrowSpoken;
+exports.speaksRefusals = speaksRefusals;
+const graphql_1 = require("graphql");
+/**
+ * **A refusal the server knows and names** (ADR-0054).
+ *
+ * ── Why a gate does not throw a sentence ──────────────────────────────────
+ * A gate that throws an English sentence puts English on a Korean screen. A screen that translates
+ * it is then writing the reason itself, and the gate and the screen end up with two accounts of the
+ * same refusal. So the gate throws a name and values, and the sentence is made where the request's
+ * language is known.
+ *
+ * ── What gets stored is the name ──────────────────────────────────────────
+ * Never write the sentence onto an event or a work row. A sentence differs per reader and the wording
+ * changes later; a stored one freezes that day's language. The `code` is the contract, and it travels
+ * unchanged to the client (ADR-0042 - no mapping table on the way out).
+ *
+ * ── Two traps ─────────────────────────────────────────────────────────────
+ * ① `t(key, undefined)` loses the locale and answers in English, so `params` is always passed - the
+ *    spread below makes an object even when a refusal carries none.
+ * ② Never pass a **value** to `t` as a key: `:` reads as a namespace separator and cuts `urn:epc:…`
+ *    apart. Values travel in `params` only.
+ *
+ * ── Why it lives in the shell ─────────────────────────────────────────────
+ * operato-plant wrote this first and operato-warehouse copied it; worklist is the third consumer as
+ * the work-door screens move there (ADR-0069 decision 3). Everything it needs is `graphql`,
+ * `type-graphql` and the request's `t`, all of which sit at or below the shell, so this is the floor
+ * that every consumer already stands on. The translations stay with each module: `refusalKey` names
+ * `error.<code>` inside the caller's own namespace, and a module that does not declare the key falls
+ * back to the English sentence rather than printing the key.
+ */
+class Refusal extends Error {
+    /**
+     * @param code this refusal's name (kebab). It states **the gate's fact**; a screen does not pick its
+     *   own sentence from this name.
+     * @param params the values the sentence is built from.
+     * @param english the sentence used when the translation key is missing. An English sentence reads
+     *   better than the key printed raw.
+     */
+    constructor(code, params, english) {
+        super(english);
+        this.name = 'Refusal';
+        this.code = code;
+        this.params = params;
+    }
+}
+exports.Refusal = Refusal;
+function refusalKey(code) {
+    return `error.${code}`;
+}
+/**
+ * **The one place a refusal becomes a sentence.** The resolver wrapper and the worklist callbacks both
+ * call this, so the two exits cannot drift apart.
+ *
+ * Apollo's own `extensions.code` gets `BAD_USER_INPUT`: a refusal is not a server error, and left empty
+ * Apollo would fill in `INTERNAL_SERVER_ERROR`. The name rides separately in `extensions.refusal`; its
+ * presence is what tells a client the server refused on purpose.
+ */
+function speakRefusal(refusal, context) {
+    const sentence = context.t
+        ? /* Always pass params - `undefined` here loses the locale and answers in English. */
+            context.t(refusalKey(refusal.code), { ...refusal.params, defaultValue: refusal.message })
+        : refusal.message;
+    return new graphql_1.GraphQLError(sentence, {
+        originalError: refusal,
+        extensions: { code: 'BAD_USER_INPUT', refusal: { code: refusal.code, params: refusal.params } }
+    });
+}
+/** Rethrow a refusal as a sentence in the caller's language; anything else passes through untouched. */
+function rethrowSpoken(error, context) {
+    throw error instanceof Refusal ? speakRefusal(error, context) : error;
+}
+/** A resolver class passes through this (`@UseMiddleware(SpeakRefusals)`). */
+const SpeakRefusals = async ({ context }, next) => {
+    try {
+        return await next();
+    }
+    catch (error) {
+        rethrowSpoken(error, context);
+    }
+};
+exports.SpeakRefusals = SpeakRefusals;
+/**
+ * An activity callback runs inside a worklist mutation, not the module's own resolver, so
+ * `SpeakRefusals` never sees what it throws. Declarations wrap their callback in this: the same
+ * `speakRefusal`, the other exit.
+ */
+function speaksRefusals(callback) {
+    return async (instance, addendum, context) => {
+        try {
+            await callback(instance, addendum, context);
+        }
+        catch (error) {
+            rethrowSpoken(error, context);
+        }
+    };
+}
+//# sourceMappingURL=refusal.js.map

package/dist-server/refusal/refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refusal.js","sourceRoot":"","sources":["../../server/refusal/refusal.ts"],"names":[],"mappings":";;;AAqDA,gCAEC;AAYD,oCAUC;AAGD,sCAEC;AAgBD,wCAUC;AA5GD,qCAAsC;AAGtC;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAa,OAAQ,SAAQ,KAAK;IAIhC;;;;;;OAMG;IACH,YAAY,IAAY,EAAE,MAAqB,EAAE,OAAe;QAC9D,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,SAAS,CAAA;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AAjBD,0BAiBC;AAKD,SAAgB,UAAU,CAAC,IAAY;IACrC,OAAO,SAAS,IAAI,EAAE,CAAA;AACxB,CAAC;AAID;;;;;;;GAOG;AACH,SAAgB,YAAY,CAAC,OAAgB,EAAE,OAA0B;IACvE,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC;QACxB,CAAC,CAAC,oFAAoF;YACpF,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3F,CAAC,CAAC,OAAO,CAAC,OAAO,CAAA;IAEnB,OAAO,IAAI,sBAAY,CAAC,QAAQ,EAAE;QAChC,aAAa,EAAE,OAAO;QACtB,UAAU,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE;KAChG,CAAC,CAAA;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAgB,aAAa,CAAC,KAAc,EAAE,OAA0B;IACtE,MAAM,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AACvE,CAAC;AAED,8EAA8E;AACvE,MAAM,aAAa,GAAsB,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE;IAC1E,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAA;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAC/B,CAAC;AACH,CAAC,CAAA;AANY,QAAA,aAAa,iBAMzB;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAC5B,QAAuE;IAEvE,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;QAC3C,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC,CAAA;AACH,CAAC","sourcesContent":["import { GraphQLError } from 'graphql'\nimport type { MiddlewareFn } from 'type-graphql'\n\n/**\n * **A refusal the server knows and names** (ADR-0054).\n *\n * ── Why a gate does not throw a sentence ──────────────────────────────────\n * A gate that throws an English sentence puts English on a Korean screen. A screen that translates\n * it is then writing the reason itself, and the gate and the screen end up with two accounts of the\n * same refusal. So the gate throws a name and values, and the sentence is made where the request's\n * language is known.\n *\n * ── What gets stored is the name ──────────────────────────────────────────\n * Never write the sentence onto an event or a work row. A sentence differs per reader and the wording\n * changes later; a stored one freezes that day's language. The `code` is the contract, and it travels\n * unchanged to the client (ADR-0042 - no mapping table on the way out).\n *\n * ── Two traps ─────────────────────────────────────────────────────────────\n * ① `t(key, undefined)` loses the locale and answers in English, so `params` is always passed - the\n *    spread below makes an object even when a refusal carries none.\n * ② Never pass a **value** to `t` as a key: `:` reads as a namespace separator and cuts `urn:epc:…`\n *    apart. Values travel in `params` only.\n *\n * ── Why it lives in the shell ─────────────────────────────────────────────\n * operato-plant wrote this first and operato-warehouse copied it; worklist is the third consumer as\n * the work-door screens move there (ADR-0069 decision 3). Everything it needs is `graphql`,\n * `type-graphql` and the request's `t`, all of which sit at or below the shell, so this is the floor\n * that every consumer already stands on. The translations stay with each module: `refusalKey` names\n * `error.<code>` inside the caller's own namespace, and a module that does not declare the key falls\n * back to the English sentence rather than printing the key.\n */\nexport class Refusal extends Error {\n  readonly code: string\n  readonly params: RefusalParams\n\n  /**\n   * @param code this refusal's name (kebab). It states **the gate's fact**; a screen does not pick its\n   *   own sentence from this name.\n   * @param params the values the sentence is built from.\n   * @param english the sentence used when the translation key is missing. An English sentence reads\n   *   better than the key printed raw.\n   */\n  constructor(code: string, params: RefusalParams, english: string) {\n    super(english)\n    this.name = 'Refusal'\n    this.code = code\n    this.params = params\n  }\n}\n\n/** Values a refusal sentence is built from. Scalars only: they travel in the GraphQL response as they are. */\nexport type RefusalParams = Record<string, string | number | boolean | null>\n\nexport function refusalKey(code: string): string {\n  return `error.${code}`\n}\n\ntype Translate = (key: string, options?: Record<string, unknown>) => string\n\n/**\n * **The one place a refusal becomes a sentence.** The resolver wrapper and the worklist callbacks both\n * call this, so the two exits cannot drift apart.\n *\n * Apollo's own `extensions.code` gets `BAD_USER_INPUT`: a refusal is not a server error, and left empty\n * Apollo would fill in `INTERNAL_SERVER_ERROR`. The name rides separately in `extensions.refusal`; its\n * presence is what tells a client the server refused on purpose.\n */\nexport function speakRefusal(refusal: Refusal, context: { t?: Translate }): GraphQLError {\n  const sentence = context.t\n    ? /* Always pass params - `undefined` here loses the locale and answers in English. */\n      context.t(refusalKey(refusal.code), { ...refusal.params, defaultValue: refusal.message })\n    : refusal.message\n\n  return new GraphQLError(sentence, {\n    originalError: refusal,\n    extensions: { code: 'BAD_USER_INPUT', refusal: { code: refusal.code, params: refusal.params } }\n  })\n}\n\n/** Rethrow a refusal as a sentence in the caller's language; anything else passes through untouched. */\nexport function rethrowSpoken(error: unknown, context: { t?: Translate }): never {\n  throw error instanceof Refusal ? speakRefusal(error, context) : error\n}\n\n/** A resolver class passes through this (`@UseMiddleware(SpeakRefusals)`). */\nexport const SpeakRefusals: MiddlewareFn<any> = async ({ context }, next) => {\n  try {\n    return await next()\n  } catch (error) {\n    rethrowSpoken(error, context)\n  }\n}\n\n/**\n * An activity callback runs inside a worklist mutation, not the module's own resolver, so\n * `SpeakRefusals` never sees what it throws. Declarations wrap their callback in this: the same\n * `speakRefusal`, the other exit.\n */\nexport function speaksRefusals(\n  callback: (instance: any, addendum: any, context: any) => Promise<void>\n): (instance: any, addendum: any, context: any) => Promise<void> {\n  return async (instance, addendum, context) => {\n    try {\n      await callback(instance, addendum, context)\n    } catch (error) {\n      rethrowSpoken(error, context)\n    }\n  }\n}\n"]}

package/dist-server/reversibility/index.d.ts

@@ -0,0 +1 @@
+export * from './reversibility.js';

package/dist-server/reversibility/index.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./reversibility.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist-server/reversibility/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../server/reversibility/index.ts"],"names":[],"mappings":";;;AAAA,6DAAkC","sourcesContent":["export * from './reversibility.js'\n"]}

package/dist-server/reversibility/reversibility.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Whether an operation's effect can be undone (ADR-0064 decision 1).
+ *
+ * - `irreversible`  the effect happens there and then, and there is no way back.
+ * - `compensable`   it cannot be undone, but the original record stays and a new record corrects it.
+ * - `reversible`    a paired operation returns to the same state, and no other record holds the id of a
+ *                   removed row (a row made again has a new id).
+ * - `unknown`       not yet established. A value of its own, so the classifier never guesses a neighbour.
+ *
+ * Screens ask a destructive confirmation only for `irreversible`.
+ *
+ * ── 왜 shell 인가 (ADR-0064 보탬, 2026-09-20) ────────────────────────────────
+ * operato-plant 가 먼저 적었고 `@things-factory/station` 이 둘째 소비자로 서면서 올라왔다 —
+ * `refusal` 이 지난 길과 같다. 자리가 그 옆인 것은 같은 종류의 선언이기 때문이다: **문이 하는 일에
+ * 대해 서버가 아는 사실.** 소비처 넷이 이미 shell 을 들고 있다.
+ *
+ * **worklist 가 아닌 까닭.** 거기에는 이미 `Reversibility` 라는 이름이 있고 그것은 다른 타입이다
+ * (`{ reversible: boolean, caveat? }` — 결재 슬롯이 읽는 모양). 「승인을 되돌릴 수 있나」와 「이 문의
+ * 효과를 되돌릴 수 있나」는 다른 사실이고, 한 꾸러미에서 한 이름을 두고 다투게 두지 않는다.
+ *
+ * **화면은 이 상수를 import 하지 않는다.** 화면이 읽는 값은 질의로 오는 문자열이고, shell 의
+ * 클라이언트 진입점은 부수 효과를 들고 있어 타입 하나를 위해 지날 자리가 아니다.
+ */
+export declare const REVERSIBILITIES: readonly ["irreversible", "compensable", "reversible", "unknown"];
+export type Reversibility = (typeof REVERSIBILITIES)[number];

package/dist-server/reversibility/reversibility.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REVERSIBILITIES = void 0;
+/**
+ * Whether an operation's effect can be undone (ADR-0064 decision 1).
+ *
+ * - `irreversible`  the effect happens there and then, and there is no way back.
+ * - `compensable`   it cannot be undone, but the original record stays and a new record corrects it.
+ * - `reversible`    a paired operation returns to the same state, and no other record holds the id of a
+ *                   removed row (a row made again has a new id).
+ * - `unknown`       not yet established. A value of its own, so the classifier never guesses a neighbour.
+ *
+ * Screens ask a destructive confirmation only for `irreversible`.
+ *
+ * ── 왜 shell 인가 (ADR-0064 보탬, 2026-09-20) ────────────────────────────────
+ * operato-plant 가 먼저 적었고 `@things-factory/station` 이 둘째 소비자로 서면서 올라왔다 —
+ * `refusal` 이 지난 길과 같다. 자리가 그 옆인 것은 같은 종류의 선언이기 때문이다: **문이 하는 일에
+ * 대해 서버가 아는 사실.** 소비처 넷이 이미 shell 을 들고 있다.
+ *
+ * **worklist 가 아닌 까닭.** 거기에는 이미 `Reversibility` 라는 이름이 있고 그것은 다른 타입이다
+ * (`{ reversible: boolean, caveat? }` — 결재 슬롯이 읽는 모양). 「승인을 되돌릴 수 있나」와 「이 문의
+ * 효과를 되돌릴 수 있나」는 다른 사실이고, 한 꾸러미에서 한 이름을 두고 다투게 두지 않는다.
+ *
+ * **화면은 이 상수를 import 하지 않는다.** 화면이 읽는 값은 질의로 오는 문자열이고, shell 의
+ * 클라이언트 진입점은 부수 효과를 들고 있어 타입 하나를 위해 지날 자리가 아니다.
+ */
+exports.REVERSIBILITIES = ['irreversible', 'compensable', 'reversible', 'unknown'];
+//# sourceMappingURL=reversibility.js.map

package/dist-server/reversibility/reversibility.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reversibility.js","sourceRoot":"","sources":["../../server/reversibility/reversibility.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACU,QAAA,eAAe,GAAG,CAAC,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,CAAU,CAAA","sourcesContent":["/**\n * Whether an operation's effect can be undone (ADR-0064 decision 1).\n *\n * - `irreversible`  the effect happens there and then, and there is no way back.\n * - `compensable`   it cannot be undone, but the original record stays and a new record corrects it.\n * - `reversible`    a paired operation returns to the same state, and no other record holds the id of a\n *                   removed row (a row made again has a new id).\n * - `unknown`       not yet established. A value of its own, so the classifier never guesses a neighbour.\n *\n * Screens ask a destructive confirmation only for `irreversible`.\n *\n * ── 왜 shell 인가 (ADR-0064 보탬, 2026-09-20) ────────────────────────────────\n * operato-plant 가 먼저 적었고 `@things-factory/station` 이 둘째 소비자로 서면서 올라왔다 —\n * `refusal` 이 지난 길과 같다. 자리가 그 옆인 것은 같은 종류의 선언이기 때문이다: **문이 하는 일에\n * 대해 서버가 아는 사실.** 소비처 넷이 이미 shell 을 들고 있다.\n *\n * **worklist 가 아닌 까닭.** 거기에는 이미 `Reversibility` 라는 이름이 있고 그것은 다른 타입이다\n * (`{ reversible: boolean, caveat? }` — 결재 슬롯이 읽는 모양). 「승인을 되돌릴 수 있나」와 「이 문의\n * 효과를 되돌릴 수 있나」는 다른 사실이고, 한 꾸러미에서 한 이름을 두고 다투게 두지 않는다.\n *\n * **화면은 이 상수를 import 하지 않는다.** 화면이 읽는 값은 질의로 오는 문자열이고, shell 의\n * 클라이언트 진입점은 부수 효과를 들고 있어 타입 하나를 위해 지날 자리가 아니다.\n */\nexport const REVERSIBILITIES = ['irreversible', 'compensable', 'reversible', 'unknown'] as const\n\nexport type Reversibility = (typeof REVERSIBILITIES)[number]\n"]}