@jini-ai/cms 0.3.11 → 0.4.1

package/dist/navigation/menu-service.js

@@ -1,3 +1,4 @@
+import { nowIso as kernelNowIso } from "@jini-ai/core/primitives";
 /**
  * @file Write-service for the `navigation` library.
  *
@@ -9,14 +10,14 @@
  *
  * How it relates to the project:
  * - Storage is `MenuRepoPort` (`repo.memory.ts`) — a self-contained repo, not
- *   the generic entries repo (see `repo.memory.ts`'s file header for why).
+ * the generic entries repo (see `repo.memory.ts`'s file header for why).
  * - Location assignment additionally writes `NavLocationBindingRepoPort`
- *   (`ports.ts`), the one real port this library declares.
+ * (`ports.ts`), the one real port this library declares.
  * - In production this whole module runs inside the command
- *   gateway/write chokepoint (same-transaction revision, attribution,
- *   `entry_refs` extraction). That gateway is not implemented as running code
- *   yet, so these functions are the chokepoint's future *contents*, called
- *   directly for now.
+ * gateway/write chokepoint (same-transaction revision, attribution,
+ * `entry_refs` extraction). That gateway is not implemented as running code
+ * yet, so these functions are the chokepoint's future *contents* called
+ * directly for now.
  *
  * Architectural role:
  * Feature logic only. No Express/route code, no direct SQL — everything goes
@@ -28,7 +29,7 @@ import { NAV_DOC_TYPE, } from "./types.js";
 // Outbox event publication — each mutating function below
 // enqueues its matching NAVIGATION_EVENTS entry after its repo write(s)
 // succeed, never on a rejection path. Mirrors the host's proven
-// `outbox.enqueue()` call shape.
+// `outbox.enqueue` call shape.
 // ---------------------------------------------------------------------------
 /**
  * `payload` is typed as a plain `Record<string, unknown>` (not the specific
@@ -42,7 +43,7 @@ function buildEvent(required) {
     return {
         id: required.idGen.newId(),
         name: required.name,
-        occurredAt: required.clock.nowIso(),
+        occurredAt: kernelNowIso({ clock: required.clock }),
         aggregateId: required.aggregateId,
         workspaceId: required.workspaceId,
         payload: required.payload,
@@ -52,10 +53,19 @@ function buildEvent(required) {
 // Typed errors
 // ---------------------------------------------------------------------------
 export class MenuNotFoundError extends Error {
+    constructor({ message }, optionalArgs = {}) {
+        super(message, optionalArgs);
+    }
 }
 export class MenuValidationError extends Error {
+    constructor({ message }, optionalArgs = {}) {
+        super(message, optionalArgs);
+    }
 }
 export class MenuConflictError extends Error {
+    constructor({ message }, optionalArgs = {}) {
+        super(message, optionalArgs);
+    }
 }
 /**
  * The 409-style purge rejection: hard delete is blocked while the menu is
@@ -65,8 +75,9 @@ export class MenuConflictError extends Error {
  */
 export class MenuLocationBoundError extends MenuConflictError {
     boundLocations;
-    constructor(message, boundLocations) {
-        super(message);
+    constructor(requiredArgs, optionalArgs = {}) {
+        const { message, boundLocations } = requiredArgs;
+        super({ message: message });
         this.boundLocations = boundLocations;
     }
 }
@@ -83,17 +94,17 @@ const RESERVED_TARGET_KINDS = new Set(["dynamicQuery", "content"]);
 /**
  * Fixed placeholder origin {@link isAllowedHref} resolves a claimed same-origin-relative href
  * against, to compare the RESOLVED origin rather than the raw string shape. Mirrors
- * `apps/website/src/server/inbound/public-http/http/site/render.ts`'s identically-named constant
+ * the host's public renderer's identically-named constant
  * byte-for-byte — see that file's own header for why a fixed placeholder origin is sufficient (only
  * the relationship between the resolved URL's origin and this one is ever inspected, never the
  * placeholder value itself).
  */
-const SAFE_HREF_RESOLUTION_BASE = "http://tovu-safehref.invalid/";
+const SAFE_HREF_RESOLUTION_BASE = "http://safehref.invalid/";
 const SAFE_HREF_RESOLUTION_ORIGIN = new URL(SAFE_HREF_RESOLUTION_BASE).origin;
 /**
  * The CANONICAL href allowlist for an author-authored link — same accepted shapes (`#…`, same-origin
  * `/…`, `http(s)://`, `mailto:`) as the host's render-time `safeHref` in `render.ts` and its
- * `features/theme/static-render.ts` duplicate. **This is now the single source of truth**: exported
+ * `features/theme/static-render.ts` duplicate. **This is now the single source of truth** exported
  * from this package's public surface (`navigation/index.ts` -> `@jini-ai/cms/navigation`) so the
  * dependency runs the direction that is actually legal — the host already depends on `@jini-ai/cms`, not
  * the reverse — rather than each consumer hand-copying the predicate.
@@ -104,14 +115,14 @@ const SAFE_HREF_RESOLUTION_ORIGIN = new URL(SAFE_HREF_RESOLUTION_BASE).origin;
  * `check:boundaries` no-deep-import concern is NOT what blocks it: `render.ts` already imports
  * `@jini-ai/cms/core` today, and `features/theme` already imports `@jini-ai/cms/core` too, so both
  * call sites may legally import `@jini-ai/cms/navigation` directly — verified by grep, not assumed).
- * Until that follow-up lands, `apps/website/development/scripts/check-menu-href-allowlist-sync.ts`
+ * Until that follow-up lands, the host's menu href allowlist sync check
  * behaviorally gates the three copies against the same adversarial table so a divergence fails CI
  * instead of drifting silently.
  *
- * Replaced (this change) a `URL_SCHEME_DENYLIST` (`startsWith` on a lowercased, `.trim()`ed string)
+ * Replaced (this change) a `URL_SCHEME_DENYLIST` (`startsWith` on a lowercased, `.trim`ed string)
  * that failed open: the WHATWG `URL` parser strips TAB/LF/CR from ANYWHERE in the input and folds a
- * leading backslash to `/` for `http(s)`, so `"java\tscript:alert(1)"`, `" javascript:alert(1)"`,
- * `"file:///etc/passwd"`, `"blob:…"`, `"about:blank"`, `"//evil.example"` (protocol-relative), and
+ * leading backslash to `/` for `http(s)`, so `"java\tscript:alert"`, `" javascript:alert"`,
+ * `"file:// etc/passwd"`, `"blob:…"`, `"about:blank"`, `"//evil.example"` (protocol-relative), and
  * `"/\evil.example"` all resolved to a dangerous or off-origin target while never matching any
  * `startsWith` prefix in the old list. An allowlist closes the whole bypass class at once (case,
  * embedded control characters, and scheme are all irrelevant to an allowlist the same way) rather
@@ -126,11 +137,11 @@ const SAFE_HREF_RESOLUTION_ORIGIN = new URL(SAFE_HREF_RESOLUTION_BASE).origin;
  * hrefs written through the host's admin editor.
  *
  * @param rawHref - The href to check, already confirmed non-empty by `validateTarget`. Any string is
- *   otherwise a valid input — this function performs no other precondition checks.
+ * otherwise a valid input — this function performs no other precondition checks.
  * @returns `true` when `rawHref` passes the allowlist, `false` otherwise.
- * @complexity O(1) — a handful of string checks plus one `URL` construction on the `/…` branch.
+ * @complexity O — a handful of string checks plus one `URL` construction on the `/…` branch.
  */
-export function isAllowedHref(rawHref) {
+export function isAllowedHref({ rawHref }, _optional = {}) {
     const href = rawHref.trim();
     if (href.startsWith("#"))
         return true;
@@ -159,51 +170,51 @@ export const ALLOWED_HREF_SHAPES_DESCRIPTION = "an in-page anchor ('#...'), a sa
  *
  * Checks (total/bounded validation + target integrity):
  * - `items` (and every `children` array) is actually an array, and every node
- *   in it is a non-null object — untrusted JSON bodies can carry `null`
- *   entries or a non-array `items`/`children`, which must reject as a
- *   `MenuValidationError`, not throw an uncaught `TypeError`;
+ * in it is a non-null object — untrusted JSON bodies can carry `null`
+ * entries or a non-array `items`/`children`, which must reject as a
+ * `MenuValidationError`, not throw an uncaught `TypeError`;
  * - every node has a non-empty `id`, unique across the whole tree (id
- *   stability is a caller responsibility — see `updateMenuTree` doc for the
- *   simplification this build accepts);
+ * stability is a caller responsibility — see `updateMenuTree` doc for the
+ * simplification this build accepts);
  * - nesting depth stays within `maxDepth`;
  * - total item count stays within `maxItemCount`;
  * - every node has a `target` object (a missing/`null` `target` rejects
- *   rather than crashing) whose `kind` is one of the four v1 kinds — reserved
- *   kinds (`dynamicQuery`, `content`) are rejected with a clear "not yet"
- *   error rather than silently accepted;
+ * rather than crashing) whose `kind` is one of the four v1 kinds — reserved
+ * kinds (`dynamicQuery`, `content`) are rejected with a clear "not yet"
+ * error rather than silently accepted;
  * - `url` targets require a non-empty string `href` and pass an origin/scheme
- *   ALLOWLIST (`#…`, same-origin `/…`, `http(s)://`, `mailto:` — see
- *   {@link isAllowedHref}), not a scheme denylist.
+ * ALLOWLIST (`#…`, same-origin `/…`, `http(s)://`, `mailto:` — see
+ * {@link isAllowedHref}), not a scheme denylist.
  *
  * @complexity O(n) over total node count for one full walk; no per-node
  * backtracking. Space is O(n) for the cloned tree plus O(n) for the id set.
  * @overallScore 100
  */
-export function validateAndCloneTree(items, limits = {}) {
+export function validateAndCloneTree({ items }, limits = {}) {
     const maxDepth = limits.maxDepth ?? DEFAULT_MAX_TREE_DEPTH;
     const maxItemCount = limits.maxItemCount ?? DEFAULT_MAX_ITEM_COUNT;
     const seenIds = new Set();
     let count = 0;
     function walk(nodes, depth) {
         if (!Array.isArray(nodes)) {
-            throw new MenuValidationError("menu items must be an array");
+            throw new MenuValidationError({ message: "menu items must be an array" });
         }
         if (depth > maxDepth) {
-            throw new MenuValidationError(`menu tree exceeds max nesting depth of ${maxDepth}`);
+            throw new MenuValidationError({ message: `menu tree exceeds max nesting depth of ${maxDepth}` });
         }
         return nodes.map((node) => {
             count += 1;
             if (count > maxItemCount) {
-                throw new MenuValidationError(`menu tree exceeds max item count of ${maxItemCount}`);
+                throw new MenuValidationError({ message: `menu tree exceeds max item count of ${maxItemCount}` });
             }
             if (!node || typeof node !== "object") {
-                throw new MenuValidationError("every menu item must be an object");
+                throw new MenuValidationError({ message: "every menu item must be an object" });
             }
             if (!node.id || !node.id.trim()) {
-                throw new MenuValidationError("every menu item requires a non-empty id");
+                throw new MenuValidationError({ message: "every menu item requires a non-empty id" });
             }
             if (seenIds.has(node.id)) {
-                throw new MenuValidationError(`duplicate item id '${node.id}' in menu tree`);
+                throw new MenuValidationError({ message: `duplicate item id '${node.id}' in menu tree` });
             }
             seenIds.add(node.id);
             validateTarget(node.target);
@@ -221,30 +232,30 @@ export function validateAndCloneTree(items, limits = {}) {
  */
 function validateTarget(target) {
     if (!target || typeof target !== "object") {
-        throw new MenuValidationError("every menu item requires a target");
+        throw new MenuValidationError({ message: "every menu item requires a target" });
     }
     const kind = target.kind;
     if (RESERVED_TARGET_KINDS.has(kind)) {
-        throw new MenuValidationError(`target kind '${kind}' is a reserved seam and is not supported yet`);
+        throw new MenuValidationError({ message: `target kind '${kind}' is a reserved seam and is not supported yet` });
     }
     if (!VALID_TARGET_KINDS.has(kind)) {
-        throw new MenuValidationError(`unknown target kind '${kind}'`);
+        throw new MenuValidationError({ message: `unknown target kind '${kind}'` });
     }
     if (kind === "url") {
         const rawHref = target.href;
         if (typeof rawHref !== "string" || !rawHref.trim()) {
-            throw new MenuValidationError("url target requires a non-empty href");
+            throw new MenuValidationError({ message: "url target requires a non-empty href" });
         }
-        if (!isAllowedHref(rawHref)) {
-            throw new MenuValidationError(`url target href is not allowed: '${rawHref}'. Accepted shapes: ${ALLOWED_HREF_SHAPES_DESCRIPTION}.`);
+        if (!isAllowedHref({ rawHref: rawHref })) {
+            throw new MenuValidationError({ message: `url target href is not allowed: '${rawHref}'. Accepted shapes: ${ALLOWED_HREF_SHAPES_DESCRIPTION}.` });
         }
     }
 }
 function assertValidTitleAndSlug(title, slug) {
     if (!title)
-        throw new MenuValidationError("title is required");
+        throw new MenuValidationError({ message: "title is required" });
     if (!slug.match(/^[a-z0-9-]+$/)) {
-        throw new MenuValidationError("slug must use lowercase letters, numbers, and dashes");
+        throw new MenuValidationError({ message: "slug must use lowercase letters, numbers, and dashes" });
     }
 }
 /**
@@ -269,8 +280,8 @@ export async function createMenu(required, optional = {}) {
     assertValidTitleAndSlug(title, slug);
     const duplicate = await deps.repo.findBySlug({ workspaceId: input.workspaceId, slug });
     if (duplicate)
-        throw new MenuConflictError(`slug '${slug}' already exists`);
-    const items = validateAndCloneTree(input.items ?? [], optional.limits);
+        throw new MenuConflictError({ message: `slug '${slug}' already exists` });
+    const items = validateAndCloneTree({ items: input.items ?? [] }, optional.limits);
     const menu = {
         id: deps.idGen.newId(),
         workspaceId: input.workspaceId,
@@ -279,7 +290,7 @@ export async function createMenu(required, optional = {}) {
         status: "published",
         doc: { type: NAV_DOC_TYPE, version: 1, items },
         locations: [],
-        updatedAt: deps.clock.nowIso(),
+        updatedAt: kernelNowIso({ clock: deps.clock }),
         version: 1,
     };
     await deps.repo.save(menu);
@@ -304,7 +315,7 @@ export async function createMenu(required, optional = {}) {
  * previous tree and is deferred — a caller-discipline requirement for now,
  * not a runtime-enforced invariant.
  *
- * @complexity O(n) in the new tree size for validation; O(1) additional repo
+ * @complexity O(n) in the new tree size for validation; O additional repo
  * calls (one read, at most one slug-uniqueness read, one write).
  * @overallScore 90
  * @findings Medium: id-stability across edits (ids not renumbered on survive)
@@ -317,10 +328,10 @@ export async function updateMenuTree(required, optional = {}) {
     const { deps, input } = required;
     const existing = await deps.repo.findById({ workspaceId: input.workspaceId, id: input.id });
     if (!existing)
-        throw new MenuNotFoundError(`menu '${input.id}' was not found`);
+        throw new MenuNotFoundError({ message: `menu '${input.id}' was not found` });
     assertEntityLive({ entityType: "menu", entityId: input.id, state: existing.status === "trash" ? "trashed" : "live" });
     if (existing.version !== input.expectedVersion) {
-        throw new MenuConflictError(`menu '${input.id}' was modified concurrently (expected version ${input.expectedVersion}, found ${existing.version})`);
+        throw new MenuConflictError({ message: `menu '${input.id}' was modified concurrently (expected version ${input.expectedVersion}, found ${existing.version})` });
     }
     const title = (input.title ?? existing.title).trim();
     const slug = (input.slug ?? existing.slug).trim().toLowerCase();
@@ -328,16 +339,16 @@ export async function updateMenuTree(required, optional = {}) {
     if (slug !== existing.slug) {
         const duplicate = await deps.repo.findBySlug({ workspaceId: input.workspaceId, slug });
         if (duplicate && duplicate.id !== existing.id) {
-            throw new MenuConflictError(`slug '${slug}' already exists`);
+            throw new MenuConflictError({ message: `slug '${slug}' already exists` });
         }
     }
-    const items = validateAndCloneTree(input.items, optional.limits);
+    const items = validateAndCloneTree({ items: input.items }, optional.limits);
     const menu = {
         ...existing,
         title,
         slug,
         doc: { type: NAV_DOC_TYPE, version: existing.doc.version, items },
-        updatedAt: deps.clock.nowIso(),
+        updatedAt: kernelNowIso({ clock: deps.clock }),
         version: existing.version + 1,
     };
     await deps.repo.save(menu);
@@ -372,7 +383,7 @@ export async function updateMenuTree(required, optional = {}) {
  * transaction machinery — do not copy this sequencing pattern into code that
  * has real transactions available.
  *
- * @complexity O(1) repo calls (bounded: at most two menu reads/writes plus one
+ * @complexity O repo calls (bounded: at most two menu reads/writes plus one
  * binding upsert), independent of workspace size.
  * @overallScore 90
  * @findings Medium: no rollback across the two writes (menu save, then
@@ -385,9 +396,9 @@ export async function assignLocation(required, _optional = {}) {
     const { deps, input } = required;
     const menu = await deps.repo.findById({ workspaceId: input.workspaceId, id: input.menuId });
     if (!menu)
-        throw new MenuNotFoundError(`menu '${input.menuId}' was not found`);
+        throw new MenuNotFoundError({ message: `menu '${input.menuId}' was not found` });
     assertEntityLive({ entityType: "menu", entityId: input.menuId, state: menu.status === "trash" ? "trashed" : "live" });
-    const now = deps.clock.nowIso();
+    const now = kernelNowIso({ clock: deps.clock });
     const existingBinding = await deps.bindingRepo.findByLocation({
         workspaceId: input.workspaceId,
         locationKey: input.locationKey,
@@ -447,17 +458,17 @@ export async function assignLocation(required, _optional = {}) {
 /**
  * Deletion ladder (mirrors the media library's):
  * 1. First call on a non-trashed menu **soft-deletes** it (`status: 'trash'`,
- *    revisioned) and returns — no purge yet.
- * 2. A second call on an already-trashed menu attempts the **hard purge**. If
- *    the menu is still bound to any location, purge is rejected with
- *    `MenuLocationBoundError` (409-style) listing the bound keys, unless
- *    `force` is set — permission-gating that error behind
- *    `navigation.delete.force` is the caller's (gateway's) job, not this
- *    function's; this function only enforces the *shape* of the guard.
+ * revisioned) and returns — no purge yet.
+ * 2. A second call on an already-trashed menu attempts the **hard purge** If
+ * the menu is still bound to any location, purge is rejected with
+ * `MenuLocationBoundError` (409-style) listing the bound keys, unless
+ * `force` is set — permission-gating that error behind
+ * `navigation.delete.force` is the caller's (gateway's) job, not this
+ * function's; this function only enforces the *shape* of the guard.
  * 3. On a successful purge, the menu row and all of its location bindings are
- *    removed.
+ * removed.
  *
- * @complexity O(1) repo calls; O(k) bindings scanned where k = locations this
+ * @complexity O repo calls; O(k) bindings scanned where k = locations this
  * menu holds (small, bounded by registered locations).
  * @overallScore 100
  */
@@ -465,12 +476,12 @@ export async function deleteMenu(required, _optional = {}) {
     const { deps, input } = required;
     const existing = await deps.repo.findById({ workspaceId: input.workspaceId, id: input.id });
     if (!existing)
-        throw new MenuNotFoundError(`menu '${input.id}' was not found`);
+        throw new MenuNotFoundError({ message: `menu '${input.id}' was not found` });
     if (existing.status !== "trash") {
         const trashed = {
             ...existing,
             status: "trash",
-            updatedAt: deps.clock.nowIso(),
+            updatedAt: kernelNowIso({ clock: deps.clock }),
             version: existing.version + 1,
         };
         await deps.repo.save(trashed);
@@ -490,7 +501,7 @@ export async function deleteMenu(required, _optional = {}) {
     });
     if (bindings.length > 0 && !input.force) {
         const boundLocations = bindings.map((row) => row.locationKey);
-        throw new MenuLocationBoundError(`menu '${input.id}' is still bound to location(s): ${boundLocations.join(", ")} — unassign before purging, or use force`, boundLocations);
+        throw new MenuLocationBoundError({ message: `menu '${input.id}' is still bound to location(s): ${boundLocations.join(", ")} — unassign before purging, or use force`, boundLocations: boundLocations });
     }
     await deps.repo.remove({ workspaceId: input.workspaceId, id: input.id });
     await deps.bindingRepo.removeByMenu({ workspaceId: input.workspaceId, menuId: input.id });

package/dist/navigation/ports.d.ts

@@ -22,7 +22,7 @@
  *
  * INTERFACES ONLY. No feature logic lives here.
  */
-import type { ISODateTime, UUID } from "../core/ports.js";
+import type { ISODateTime, UUID } from "@jini-ai/core/primitives";
 import type { NavLocationBindingRow, NavLocationDescriptor, NavLocationKey, NavMenuDoc, NavMenuEntry, ResolvedNav } from "./types.js";
 /**
  * Persistence for the derived `nav_location_bindings` index. Writes happen only inside the same transaction as the menu-entry

package/dist/navigation/read-model.d.ts

@@ -4,8 +4,10 @@ import { type ResolveTargetHrefFn } from "./resolver.js";
 export interface NavMenuReadModelDeps {
     menuRepo: MenuRepoPort;
     bindingRepo: NavLocationBindingRepoPort;
+}
+export interface NavMenuReadModelOptions {
     /** Overridable for tests / once a host's routing library lands; defaults to the honest placeholder documented above. */
     resolveTargetHref?: ResolveTargetHrefFn | undefined;
 }
-export declare function createNavMenuReadModel(deps: NavMenuReadModelDeps): NavMenuReadModel;
+export declare function createNavMenuReadModel(deps: NavMenuReadModelDeps, optional?: NavMenuReadModelOptions): NavMenuReadModel;
 //# sourceMappingURL=read-model.d.ts.map

package/dist/navigation/read-model.js

@@ -1,7 +1,7 @@
 import { resolveForLocation } from "./resolver.js";
 const DEFAULT_RESOLVE_TARGET_HREF = async () => null;
-export function createNavMenuReadModel(deps) {
-    const resolveTargetHref = deps.resolveTargetHref ?? DEFAULT_RESOLVE_TARGET_HREF;
+export function createNavMenuReadModel(deps, optional = {}) {
+    const resolveTargetHref = optional.resolveTargetHref ?? DEFAULT_RESOLVE_TARGET_HREF;
     return {
         async getMenu(required) {
             return deps.menuRepo.findById({ workspaceId: required.workspaceId, id: required.menuId });

package/dist/navigation/reconcile.d.ts

@@ -1,4 +1,4 @@
-import type { ClockPort, UUID } from "../core/ports.js";
+import type { Clock, UUID } from "@jini-ai/core/primitives";
 import type { MenuRepoPort } from "./repo.memory.js";
 import type { NavLocationBindingRepoPort } from "./ports.js";
 /**
@@ -32,7 +32,7 @@ import type { NavLocationBindingRepoPort } from "./ports.js";
 export interface RebuildNavLocationBindingsDeps {
     menuRepo: MenuRepoPort;
     bindingRepo: NavLocationBindingRepoPort;
-    clock: ClockPort;
+    clock: Clock;
     workspaceId: UUID;
 }
 export interface RebuildNavLocationBindingsResult {

package/dist/navigation/reconcile.js

@@ -1,3 +1,4 @@
+import { nowIso as kernelNowIso } from "@jini-ai/core/primitives";
 /**
  * Recompute the workspace's `nav_location_bindings` index from scratch from
  * every menu's `.locations` field, and replace the stored index with it.
@@ -14,7 +15,7 @@
  */
 export async function rebuildNavLocationBindings(deps) {
     const menus = await deps.menuRepo.list({ workspaceId: deps.workspaceId });
-    const boundAt = deps.clock.nowIso();
+    const boundAt = kernelNowIso({ clock: deps.clock });
     const byLocation = new Map();
     for (const menu of menus) {
         for (const locationKey of menu.locations) {

package/dist/navigation/repo.memory.d.ts

@@ -31,7 +31,7 @@
  * `menu-service.ts`'s job) — these classes are dumb, uniqueness-enforcing
  * collections.
  */
-import type { UUID } from "../core/ports.js";
+import type { UUID } from "@jini-ai/core/primitives";
 import type { NavLocationBindingRepoPort } from "./ports.js";
 import type { NavLocationBindingRow, NavLocationKey, NavMenuEntry } from "./types.js";
 /**
@@ -72,7 +72,9 @@ export interface MenuRepoPort {
  */
 export declare class InMemoryMenuRepo implements MenuRepoPort {
     private rows;
-    constructor(initialRows?: NavMenuEntry[]);
+    constructor(requiredArgs: Record<string, never>, optionalArgs?: {
+        initialRows?: NavMenuEntry[];
+    });
     findById(required: {
         workspaceId: UUID;
         id: UUID;
@@ -103,7 +105,9 @@ export declare class InMemoryMenuRepo implements MenuRepoPort {
  */
 export declare class InMemoryNavLocationBindingRepo implements NavLocationBindingRepoPort {
     private rows;
-    constructor(initialRows?: NavLocationBindingRow[]);
+    constructor(requiredArgs: Record<string, never>, optionalArgs?: {
+        initialRows?: NavLocationBindingRow[];
+    });
     findByLocation(required: {
         workspaceId: UUID;
         locationKey: NavLocationKey;

package/dist/navigation/repo.memory.js

@@ -10,7 +10,8 @@
  */
 export class InMemoryMenuRepo {
     rows;
-    constructor(initialRows = []) {
+    constructor(requiredArgs, optionalArgs = {}) {
+        const { initialRows = [] } = optionalArgs;
         this.rows = [...initialRows];
     }
     async findById(required) {
@@ -50,7 +51,8 @@ export class InMemoryMenuRepo {
  */
 export class InMemoryNavLocationBindingRepo {
     rows;
-    constructor(initialRows = []) {
+    constructor(requiredArgs, optionalArgs = {}) {
+        const { initialRows = [] } = optionalArgs;
         this.rows = [...initialRows];
     }
     async findByLocation(required) {

package/dist/navigation/resolver.d.ts

@@ -54,7 +54,10 @@ export interface ResolvedTargetHref {
  * `null` if it cannot be resolved at all (deleted target, or — for `termRef`
  * today — no schema yet to resolve against).
  */
-export type ResolveTargetHrefFn = (target: NavTarget, context: NavResolveContext) => Promise<ResolvedTargetHref | null>;
+export type ResolveTargetHrefFn = (required: {
+    target: NavTarget;
+    context: NavResolveContext;
+}, optional?: Record<string, never>) => Promise<ResolvedTargetHref | null>;
 export interface ResolveForLocationDeps {
     menuRepo: MenuRepoPort;
     bindingRepo: NavLocationBindingRepoPort;

package/dist/navigation/resolver.js

@@ -105,7 +105,7 @@ async function resolveItem(node, context, resolveTargetHref) {
         // code. termRef in particular has no compatible entry_refs schema today
         // — a resolver with no term schema to
         // consult returns null here, same as any other "cannot resolve" outcome.
-        const result = await resolveTargetHref(node.target, context);
+        const result = await resolveTargetHref({ target: node.target, context });
         if (result === null) {
             href = null;
             available = false;

package/dist/navigation/tool-registrations.d.ts

@@ -1,23 +1,21 @@
+import type { IdGenerator } from "@jini-ai/core/primitives";
+import type { Clock } from "@jini-ai/core/primitives";
 import type { AuthorizeFn } from "../core/commands/command.js";
 import type { OutboxPort } from "../core/ports.js";
-import { type DerivedRiskByToolId, type ToolRegistration } from "../core/tools/registration-kit.js";
+import { type DerivedRiskByToolId, type ToolRegistration } from "@jini-ai/core";
 import type { NavLocationBindingRepoPort } from "./ports.js";
 import type { MenuRepoPort } from "./repo.memory.js";
 /**
  * The exact slice of the route-deps bag Menus' tool handlers read. Declared structurally (rather
  * than importing a host's own `RouteDeps`) so this module carries no back-edge into any host's
  * composition root. A host's `server/routes/*` satisfies this structurally by passing its existing
- * route-deps object; nothing there needs to change shape.
+ * route-deps object after binding the kernel clock/ID contracts.
  */
 export interface MenusToolDeps {
     authorize: AuthorizeFn;
     workspaceId: string;
-    clock: {
-        nowIso(): string;
-    };
-    idGen: {
-        newId(): string;
-    };
+    clock: Clock;
+    idGen: IdGenerator;
     outbox: OutboxPort;
     menuRepo: MenuRepoPort;
     navLocationBindingRepo: NavLocationBindingRepoPort;