@jini-ai/cms 0.3.5 → 0.3.7

package/dist/navigation/menu-service.d.ts

@@ -46,6 +46,55 @@ export declare class MenuLocationBoundError extends MenuConflictError {
 export declare const DEFAULT_MAX_TREE_DEPTH = 5;
 /** Default max total item count across the whole tree. */
 export declare const DEFAULT_MAX_ITEM_COUNT = 500;
+/**
+ * The CANONICAL href allowlist for an author-authored link — same accepted shapes (`#…`, same-origin
+ * `/…`, `http(s)://`, `mailto:`) as the host's render-time `safeHref` in `render.ts` and its
+ * `features/theme/static-render.ts` duplicate. **This is now the single source of truth**: exported
+ * from this package's public surface (`navigation/index.ts` -> `@jini-ai/cms/navigation`) so the
+ * dependency runs the direction that is actually legal — the host already depends on `@jini-ai/cms`, not
+ * the reverse — rather than each consumer hand-copying the predicate.
+ *
+ * The two host-side copies (`render.ts:252`, `features/theme/static-render.ts:210`, both a coercing
+ * `value => passes ? value : "#"` wrapper around the identical predicate below) have **not yet been
+ * retired to import this** — that edit is intentionally out of this change's scope (a
+ * `check:boundaries` no-deep-import concern is NOT what blocks it: `render.ts` already imports
+ * `@jini-ai/cms/core` today, and `features/theme` already imports `@jini-ai/cms/core` too, so both
+ * call sites may legally import `@jini-ai/cms/navigation` directly — verified by grep, not assumed).
+ * Until that follow-up lands, `apps/website/development/scripts/check-menu-href-allowlist-sync.ts`
+ * behaviorally gates the three copies against the same adversarial table so a divergence fails CI
+ * instead of drifting silently.
+ *
+ * Replaced (this change) a `URL_SCHEME_DENYLIST` (`startsWith` on a lowercased, `.trim()`ed string)
+ * that failed open: the WHATWG `URL` parser strips TAB/LF/CR from ANYWHERE in the input and folds a
+ * leading backslash to `/` for `http(s)`, so `"java\tscript:alert(1)"`, `" javascript:alert(1)"`,
+ * `"file:///etc/passwd"`, `"blob:…"`, `"about:blank"`, `"//evil.example"` (protocol-relative), and
+ * `"/\evil.example"` all resolved to a dangerous or off-origin target while never matching any
+ * `startsWith` prefix in the old list. An allowlist closes the whole bypass class at once (case,
+ * embedded control characters, and scheme are all irrelevant to an allowlist the same way) rather
+ * than needing a new prefix bolted on per newly-discovered shape.
+ *
+ * `validateTarget`'s caller REJECTS on a `false` result (`MenuValidationError`, surfaced as HTTP 400)
+ * rather than silently coercing the way `safeHref`'s render-time callers degrade to `"#"` — a
+ * write-time author-facing path should say so, not quietly rewrite the input. Verified against the
+ * workspace's stored menu data (`content.db`, `content.seed.db`) before this change: every existing
+ * `url`-kind href already starts with `#` or `/`, so this tightening rejects nothing that exists
+ * today — it governs `createMenu` too, so it also reaches the Jini MCP agent-tool path, not just
+ * hrefs written through the host's admin editor.
+ *
+ * @param rawHref - The href to check, already confirmed non-empty by `validateTarget`. Any string is
+ *   otherwise a valid input — this function performs no other precondition checks.
+ * @returns `true` when `rawHref` passes the allowlist, `false` otherwise.
+ * @complexity O(1) — a handful of string checks plus one `URL` construction on the `/…` branch.
+ */
+export declare function isAllowedHref(rawHref: string): boolean;
+/**
+ * Human-readable description of {@link isAllowedHref}'s accepted shapes — the single source of truth
+ * for both `validateTarget`'s rejection message below and `agent-tools.ts`'s published JSON Schema
+ * `href` description, so an author-facing 400 and an LLM-facing tool description can never drift out
+ * of sync with each other the way three independent copies of the URL-checking LOGIC itself did
+ * before this change.
+ */
+export declare const ALLOWED_HREF_SHAPES_DESCRIPTION = "an in-page anchor ('#...'), a same-origin relative path ('/...'), an 'http://' or 'https://' URL, or a 'mailto:' address";
 export interface TreeValidationLimits {
     maxDepth?: number | undefined;
     maxItemCount?: number | undefined;
@@ -54,15 +103,22 @@ export interface TreeValidationLimits {
  * Validates a candidate item tree and returns a defensively-cloned copy.
  *
  * Checks (total/bounded validation + target integrity):
+ * - `items` (and every `children` array) is actually an array, and every node
+ *   in it is a non-null object — untrusted JSON bodies can carry `null`
+ *   entries or a non-array `items`/`children`, which must reject as a
+ *   `MenuValidationError`, not throw an uncaught `TypeError`;
  * - every node has a non-empty `id`, unique across the whole tree (id
  *   stability is a caller responsibility — see `updateMenuTree` doc for the
  *   simplification this build accepts);
  * - nesting depth stays within `maxDepth`;
  * - total item count stays within `maxItemCount`;
- * - every target's `kind` is one of the four v1 kinds — reserved kinds
- *   (`dynamicQuery`, `content`) are rejected with a clear "not yet" error
- *   rather than silently accepted;
- * - `url` targets reject a scheme denylist (`javascript:`, `data:`, `vbscript:`).
+ * - every node has a `target` object (a missing/`null` `target` rejects
+ *   rather than crashing) whose `kind` is one of the four v1 kinds — reserved
+ *   kinds (`dynamicQuery`, `content`) are rejected with a clear "not yet"
+ *   error rather than silently accepted;
+ * - `url` targets require a non-empty string `href` and pass an origin/scheme
+ *   ALLOWLIST (`#…`, same-origin `/…`, `http(s)://`, `mailto:` — see
+ *   {@link isAllowedHref}), not a scheme denylist.
  *
  * @complexity O(n) over total node count for one full walk; no per-node
  * backtracking. Space is O(n) for the cloned tree plus O(n) for the id set.

package/dist/navigation/menu-service.js

@@ -55,20 +55,100 @@ export const DEFAULT_MAX_ITEM_COUNT = 500;
 const VALID_TARGET_KINDS = new Set(["entryRef", "termRef", "url", "route"]);
 /** Named deferred seams — recognized, rejected until their resolver ships. */
 const RESERVED_TARGET_KINDS = new Set(["dynamicQuery", "content"]);
-const URL_SCHEME_DENYLIST = ["javascript:", "data:", "vbscript:"];
+/**
+ * Fixed placeholder origin {@link isAllowedHref} resolves a claimed same-origin-relative href
+ * against, to compare the RESOLVED origin rather than the raw string shape. Mirrors
+ * `apps/website/src/server/inbound/public-http/http/site/render.ts`'s identically-named constant
+ * byte-for-byte — see that file's own header for why a fixed placeholder origin is sufficient (only
+ * the relationship between the resolved URL's origin and this one is ever inspected, never the
+ * placeholder value itself).
+ */
+const SAFE_HREF_RESOLUTION_BASE = "http://tovu-safehref.invalid/";
+const SAFE_HREF_RESOLUTION_ORIGIN = new URL(SAFE_HREF_RESOLUTION_BASE).origin;
+/**
+ * The CANONICAL href allowlist for an author-authored link — same accepted shapes (`#…`, same-origin
+ * `/…`, `http(s)://`, `mailto:`) as the host's render-time `safeHref` in `render.ts` and its
+ * `features/theme/static-render.ts` duplicate. **This is now the single source of truth**: exported
+ * from this package's public surface (`navigation/index.ts` -> `@jini-ai/cms/navigation`) so the
+ * dependency runs the direction that is actually legal — the host already depends on `@jini-ai/cms`, not
+ * the reverse — rather than each consumer hand-copying the predicate.
+ *
+ * The two host-side copies (`render.ts:252`, `features/theme/static-render.ts:210`, both a coercing
+ * `value => passes ? value : "#"` wrapper around the identical predicate below) have **not yet been
+ * retired to import this** — that edit is intentionally out of this change's scope (a
+ * `check:boundaries` no-deep-import concern is NOT what blocks it: `render.ts` already imports
+ * `@jini-ai/cms/core` today, and `features/theme` already imports `@jini-ai/cms/core` too, so both
+ * call sites may legally import `@jini-ai/cms/navigation` directly — verified by grep, not assumed).
+ * Until that follow-up lands, `apps/website/development/scripts/check-menu-href-allowlist-sync.ts`
+ * behaviorally gates the three copies against the same adversarial table so a divergence fails CI
+ * instead of drifting silently.
+ *
+ * Replaced (this change) a `URL_SCHEME_DENYLIST` (`startsWith` on a lowercased, `.trim()`ed string)
+ * that failed open: the WHATWG `URL` parser strips TAB/LF/CR from ANYWHERE in the input and folds a
+ * leading backslash to `/` for `http(s)`, so `"java\tscript:alert(1)"`, `" javascript:alert(1)"`,
+ * `"file:///etc/passwd"`, `"blob:…"`, `"about:blank"`, `"//evil.example"` (protocol-relative), and
+ * `"/\evil.example"` all resolved to a dangerous or off-origin target while never matching any
+ * `startsWith` prefix in the old list. An allowlist closes the whole bypass class at once (case,
+ * embedded control characters, and scheme are all irrelevant to an allowlist the same way) rather
+ * than needing a new prefix bolted on per newly-discovered shape.
+ *
+ * `validateTarget`'s caller REJECTS on a `false` result (`MenuValidationError`, surfaced as HTTP 400)
+ * rather than silently coercing the way `safeHref`'s render-time callers degrade to `"#"` — a
+ * write-time author-facing path should say so, not quietly rewrite the input. Verified against the
+ * workspace's stored menu data (`content.db`, `content.seed.db`) before this change: every existing
+ * `url`-kind href already starts with `#` or `/`, so this tightening rejects nothing that exists
+ * today — it governs `createMenu` too, so it also reaches the Jini MCP agent-tool path, not just
+ * hrefs written through the host's admin editor.
+ *
+ * @param rawHref - The href to check, already confirmed non-empty by `validateTarget`. Any string is
+ *   otherwise a valid input — this function performs no other precondition checks.
+ * @returns `true` when `rawHref` passes the allowlist, `false` otherwise.
+ * @complexity O(1) — a handful of string checks plus one `URL` construction on the `/…` branch.
+ */
+export function isAllowedHref(rawHref) {
+    const href = rawHref.trim();
+    if (href.startsWith("#"))
+        return true;
+    if (/^https?:\/\//i.test(href) || /^mailto:/i.test(href))
+        return true;
+    if (href.startsWith("/")) {
+        try {
+            return new URL(href, SAFE_HREF_RESOLUTION_BASE).origin === SAFE_HREF_RESOLUTION_ORIGIN;
+        }
+        catch {
+            return false;
+        }
+    }
+    return false;
+}
+/**
+ * Human-readable description of {@link isAllowedHref}'s accepted shapes — the single source of truth
+ * for both `validateTarget`'s rejection message below and `agent-tools.ts`'s published JSON Schema
+ * `href` description, so an author-facing 400 and an LLM-facing tool description can never drift out
+ * of sync with each other the way three independent copies of the URL-checking LOGIC itself did
+ * before this change.
+ */
+export const ALLOWED_HREF_SHAPES_DESCRIPTION = "an in-page anchor ('#...'), a same-origin relative path ('/...'), an 'http://' or 'https://' URL, or a 'mailto:' address";
 /**
  * Validates a candidate item tree and returns a defensively-cloned copy.
  *
  * Checks (total/bounded validation + target integrity):
+ * - `items` (and every `children` array) is actually an array, and every node
+ *   in it is a non-null object — untrusted JSON bodies can carry `null`
+ *   entries or a non-array `items`/`children`, which must reject as a
+ *   `MenuValidationError`, not throw an uncaught `TypeError`;
  * - every node has a non-empty `id`, unique across the whole tree (id
  *   stability is a caller responsibility — see `updateMenuTree` doc for the
  *   simplification this build accepts);
  * - nesting depth stays within `maxDepth`;
  * - total item count stays within `maxItemCount`;
- * - every target's `kind` is one of the four v1 kinds — reserved kinds
- *   (`dynamicQuery`, `content`) are rejected with a clear "not yet" error
- *   rather than silently accepted;
- * - `url` targets reject a scheme denylist (`javascript:`, `data:`, `vbscript:`).
+ * - every node has a `target` object (a missing/`null` `target` rejects
+ *   rather than crashing) whose `kind` is one of the four v1 kinds — reserved
+ *   kinds (`dynamicQuery`, `content`) are rejected with a clear "not yet"
+ *   error rather than silently accepted;
+ * - `url` targets require a non-empty string `href` and pass an origin/scheme
+ *   ALLOWLIST (`#…`, same-origin `/…`, `http(s)://`, `mailto:` — see
+ *   {@link isAllowedHref}), not a scheme denylist.
  *
  * @complexity O(n) over total node count for one full walk; no per-node
  * backtracking. Space is O(n) for the cloned tree plus O(n) for the id set.
@@ -80,6 +160,9 @@ export function validateAndCloneTree(items, limits = {}) {
     const seenIds = new Set();
     let count = 0;
     function walk(nodes, depth) {
+        if (!Array.isArray(nodes)) {
+            throw new MenuValidationError("menu items must be an array");
+        }
         if (depth > maxDepth) {
             throw new MenuValidationError(`menu tree exceeds max nesting depth of ${maxDepth}`);
         }
@@ -88,6 +171,9 @@ export function validateAndCloneTree(items, limits = {}) {
             if (count > maxItemCount) {
                 throw new MenuValidationError(`menu tree exceeds max item count of ${maxItemCount}`);
             }
+            if (!node || typeof node !== "object") {
+                throw new MenuValidationError("every menu item must be an object");
+            }
             if (!node.id || !node.id.trim()) {
                 throw new MenuValidationError("every menu item requires a non-empty id");
             }
@@ -102,7 +188,16 @@ export function validateAndCloneTree(items, limits = {}) {
     }
     return walk(items, 1);
 }
+/**
+ * Guards every field this function reads off an untrusted `target` before reading it — a `target`
+ * arriving `null`/`undefined` (missing from the request body) or a `url` target missing `href`
+ * previously threw an uncaught `TypeError` here, which the host's route handler had no case for and
+ * surfaced as a 500 instead of the intended 400 `MenuValidationError` path.
+ */
 function validateTarget(target) {
+    if (!target || typeof target !== "object") {
+        throw new MenuValidationError("every menu item requires a target");
+    }
     const kind = target.kind;
     if (RESERVED_TARGET_KINDS.has(kind)) {
         throw new MenuValidationError(`target kind '${kind}' is a reserved seam and is not supported yet`);
@@ -111,9 +206,12 @@ function validateTarget(target) {
         throw new MenuValidationError(`unknown target kind '${kind}'`);
     }
     if (kind === "url") {
-        const href = target.href.trim().toLowerCase();
-        if (URL_SCHEME_DENYLIST.some((scheme) => href.startsWith(scheme))) {
-            throw new MenuValidationError(`url target uses a disallowed scheme: '${target.href}'`);
+        const rawHref = target.href;
+        if (typeof rawHref !== "string" || !rawHref.trim()) {
+            throw new MenuValidationError("url target requires a non-empty href");
+        }
+        if (!isAllowedHref(rawHref)) {
+            throw new MenuValidationError(`url target href is not allowed: '${rawHref}'. Accepted shapes: ${ALLOWED_HREF_SHAPES_DESCRIPTION}.`);
         }
     }
 }

package/dist/settings/dictionaries/index.d.ts

@@ -4,11 +4,11 @@
  *
  * Relocated here from Jini's `@jini-ai/ui` (2026-08-08): these keys aren't UI-rendering logic,
  * they're settings-domain presentation copy, and this package's `settings` module is the actual
- * domain owner shared across every host (Tovu, Zana, ...). `@jini-ai/ui` keeps the *component*
+ * domain owner shared across every host. `@jini-ai/ui` keeps the *component*
  * that renders a settings dialog; a host supplies the copy, and this is the shared copy any
  * OD-parity host can reuse instead of re-authoring its own. See project memory "Settings-dialog
- * i18n relocation" for the full decision record and the sibling move of the 8 Tovu-specific
- * capability-fact keys (those stayed host-side — see Tovu's own `settings-capabilities-i18n.ts`).
+ * i18n relocation" for the full decision record and the sibling move of the 8 host-specific
+ * capability-fact keys (those stayed host-side — see the host's own `settings-capabilities-i18n.ts`).
  *
  * No `en` dictionary: this package's convention (matching `@jini-ai/ui`) is "the English string
  * IS the key" — `translateSettingsDialog` falls back to the raw key for English and any

package/dist/settings/dictionaries/index.js

@@ -4,11 +4,11 @@
  *
  * Relocated here from Jini's `@jini-ai/ui` (2026-08-08): these keys aren't UI-rendering logic,
  * they're settings-domain presentation copy, and this package's `settings` module is the actual
- * domain owner shared across every host (Tovu, Zana, ...). `@jini-ai/ui` keeps the *component*
+ * domain owner shared across every host. `@jini-ai/ui` keeps the *component*
  * that renders a settings dialog; a host supplies the copy, and this is the shared copy any
  * OD-parity host can reuse instead of re-authoring its own. See project memory "Settings-dialog
- * i18n relocation" for the full decision record and the sibling move of the 8 Tovu-specific
- * capability-fact keys (those stayed host-side — see Tovu's own `settings-capabilities-i18n.ts`).
+ * i18n relocation" for the full decision record and the sibling move of the 8 host-specific
+ * capability-fact keys (those stayed host-side — see the host's own `settings-capabilities-i18n.ts`).
  *
  * No `en` dictionary: this package's convention (matching `@jini-ai/ui`) is "the English string
  * IS the key" — `translateSettingsDialog` falls back to the raw key for English and any

package/dist/taxonomy/agent-tools.d.ts

@@ -48,9 +48,10 @@
  * `ToolRegistration`s.
  *
  * Architectural role:
- * `features/taxonomy` domain declaration. Imports only `TAXONOMY_ALLOWED_CONTENT_TYPES` from its
- * own `write-service.ts`, so the published `contentType` enum cannot drift from what the domain
- * actually accepts.
+ * `features/taxonomy` domain declaration. As of A2 (taxonomy plan) it imports nothing from its own
+ * `write-service.ts` — `contentType` is published as an open string (see `CONTENT_TYPE_SCHEMA`
+ * below), since Collections entries widened the set of legal values past the fixed `post`/`page`
+ * allow-list this file used to mirror as an `enum`.
  */
 export type AgentToolSideEffect = "none" | "mutates-durable-state" | "mints-token";
 export type AgentToolActorClassRule = "confirmer-must-equal-own-delegatedBy" | "user-only" | "none";
@@ -69,7 +70,7 @@ export interface AgentToolDefinition {
      */
     inputSchema?: Readonly<Record<string, unknown>>;
 }
-/** The Taxonomy domain's fixed agent-tool catalog: 6 wired (1 read, 4 ordinary writes, 1 gated-plan
+/** The Taxonomy domain's fixed agent-tool catalog: 7 wired (1 read, 5 ordinary writes, 1 gated-plan
  * read) + 1 declared-but-never-wired destructive tool — see this file's header for the full
  * `mergeTerm` safety analysis. */
 export declare const taxonomyAgentToolCatalog: AgentToolDefinition[];

package/dist/taxonomy/agent-tools.js

@@ -48,11 +48,11 @@
  * `ToolRegistration`s.
  *
  * Architectural role:
- * `features/taxonomy` domain declaration. Imports only `TAXONOMY_ALLOWED_CONTENT_TYPES` from its
- * own `write-service.ts`, so the published `contentType` enum cannot drift from what the domain
- * actually accepts.
+ * `features/taxonomy` domain declaration. As of A2 (taxonomy plan) it imports nothing from its own
+ * `write-service.ts` — `contentType` is published as an open string (see `CONTENT_TYPE_SCHEMA`
+ * below), since Collections entries widened the set of legal values past the fixed `post`/`page`
+ * allow-list this file used to mirror as an `enum`.
  */
-import { TAXONOMY_ALLOWED_CONTENT_TYPES } from "./write-service.js";
 const TAXONOMY_ID_SCHEMA = {
     type: "string",
     minLength: 1,
@@ -63,12 +63,17 @@ const TERM_ID_SCHEMA = {
     minLength: 1,
     description: "A term id, as returned by taxonomy_create_term or taxonomy_list.",
 };
+/** A2 (taxonomy plan) — an open string, not an `enum` of `TAXONOMY_ALLOWED_CONTENT_TYPES`. `post`
+ * and `page` are always eligible; a Collection key (e.g. `'recipes'`) is eligible when that
+ * Collection's own content-type policy allows it — a call the write-service's
+ * `contentTypeTaxonomyPolicy` makes, not this schema. An `enum` here would reject a valid
+ * Collection key before the request ever reached that check. */
 const CONTENT_TYPE_SCHEMA = {
     type: "string",
-    enum: [...TAXONOMY_ALLOWED_CONTENT_TYPES],
-    description: "The content kind the target row actually is. Only 'post' and 'page' are eligible for term assignment (a permanent allow-list) — any other value is rejected before anything is written.",
+    minLength: 1,
+    description: "'post', 'page', or a Collection key (entries of that Collection).",
 };
-/** The Taxonomy domain's fixed agent-tool catalog: 6 wired (1 read, 4 ordinary writes, 1 gated-plan
+/** The Taxonomy domain's fixed agent-tool catalog: 7 wired (1 read, 5 ordinary writes, 1 gated-plan
  * read) + 1 declared-but-never-wired destructive tool — see this file's header for the full
  * `mergeTerm` safety analysis. */
 export const taxonomyAgentToolCatalog = [
@@ -128,8 +133,8 @@ export const taxonomyAgentToolCatalog = [
     {
         name: "taxonomy_assign_terms",
         description: "Assigns one or more existing terms to a piece of content (the same <TermPicker> operation the Collections editor and the Categories & " +
-            "Tags screen both use). Additive only — this call ADDS assignments; it never removes a term not present in termIds, and calling it twice " +
-            "with the same term is a no-op (idempotent). Every termId is validated (must exist; its taxonomy must be applicable to contentType) " +
+            "Tags screen both use). This call ADDS assignments; calling it twice with the same term is a no-op (idempotent). Use " +
+            "taxonomy_unassign_terms to remove an assignment. Every termId is validated (must exist; its taxonomy must be applicable to contentType) " +
             "before ANY row is written, so a bad id in the list rejects the whole call rather than partially assigning.",
         sideEffects: "mutates-durable-state",
         authorization: { permission: "admin.taxonomy.manage" },
@@ -139,11 +144,29 @@ export const taxonomyAgentToolCatalog = [
             required: ["contentType", "contentId", "termIds"],
             properties: {
                 contentType: CONTENT_TYPE_SCHEMA,
-                contentId: { type: "string", minLength: 1, description: "The id of the post/page row to assign terms to." },
+                contentId: { type: "string", minLength: 1, description: "The id of the content row to assign terms to." },
                 termIds: { type: "array", items: { type: "string" }, description: "Term ids to assign. May be empty (a no-op)." },
             },
         },
     },
+    {
+        name: "taxonomy_unassign_terms",
+        description: "Removes one or more previously-assigned terms from a piece of content. Idempotent — removing a term that isn't currently assigned is a " +
+            "no-op, not an error. Every termId is validated the same way taxonomy_assign_terms validates them (must exist; its taxonomy must be " +
+            "applicable to contentType) before anything is removed.",
+        sideEffects: "mutates-durable-state",
+        authorization: { permission: "admin.taxonomy.manage" },
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["contentType", "contentId", "termIds"],
+            properties: {
+                contentType: CONTENT_TYPE_SCHEMA,
+                contentId: { type: "string", minLength: 1, description: "The id of the content row to unassign terms from." },
+                termIds: { type: "array", items: { type: "string" }, description: "Term ids to unassign. May be empty (a no-op)." },
+            },
+        },
+    },
     {
         name: "taxonomy_plan_merge_term",
         description: "Previews merging one term into another: recomputes and returns the current overlap-loss disclosure (how many pieces of content are " +

package/dist/taxonomy/content-lookup.d.ts

@@ -42,4 +42,39 @@ export declare function createPostBackedContentLookup(deps: {
     postRepo: ContentRecordLookupPort;
     workspaceId: string;
 }): ContentLookupPort;
+/**
+ * A1 (taxonomy plan) — the single capability taxonomy needs from a host's Collections entry
+ * repository, narrowed the same way {@link ContentRecordLookupPort} narrows the post repo. The
+ * field is `type` (an entry's own column name), mapped to this port's `kind` by
+ * {@link createEntryBackedContentLookup} below — never renamed in the host's own repo just to
+ * satisfy this shape.
+ */
+export interface EntryRecordLookupPort {
+    findById(r: {
+        workspaceId: string;
+        id: string;
+    }): Promise<{
+        workspaceId: string;
+        type: string;
+    } | null>;
+}
+/** `ContentLookupPort` adapter backed by a host's Collections entry repository — the entries-table
+ * counterpart to `createPostBackedContentLookup` above, for every `contentType` that is a
+ * Collection key rather than `post`/`page`. */
+export declare function createEntryBackedContentLookup(deps: {
+    entryRepo: EntryRecordLookupPort;
+    workspaceId: string;
+}): ContentLookupPort;
+/**
+ * Routes a `resolve()` call to the post repo for `post`/`page` (`isContentTypeOnAllowList`) and to
+ * the entry repo for every other `contentType` — a Collection key. `assignTerms`/`unassignTerms`'s
+ * `validateAssignmentTarget` (write-service.ts) already decides whether a non-post/page
+ * `contentType` is ELIGIBLE via `contentTypeTaxonomyPolicy` before calling this at all; this
+ * function only decides which table a resolvable id is looked up against.
+ */
+export declare function createContentLookup(deps: {
+    postRepo: ContentRecordLookupPort;
+    entryRepo: EntryRecordLookupPort;
+    workspaceId: string;
+}): ContentLookupPort;
 //# sourceMappingURL=content-lookup.d.ts.map

package/dist/taxonomy/content-lookup.js

@@ -1,3 +1,4 @@
+import { isContentTypeOnAllowList } from "./write-service.js";
 export function createPostBackedContentLookup(deps) {
     return {
         async resolve({ contentId }) {
@@ -6,4 +7,31 @@ export function createPostBackedContentLookup(deps) {
         },
     };
 }
+/** `ContentLookupPort` adapter backed by a host's Collections entry repository — the entries-table
+ * counterpart to `createPostBackedContentLookup` above, for every `contentType` that is a
+ * Collection key rather than `post`/`page`. */
+export function createEntryBackedContentLookup(deps) {
+    return {
+        async resolve({ contentId }) {
+            const entry = await deps.entryRepo.findById({ workspaceId: deps.workspaceId, id: contentId });
+            return entry ? { workspaceId: entry.workspaceId, kind: entry.type } : null;
+        },
+    };
+}
+/**
+ * Routes a `resolve()` call to the post repo for `post`/`page` (`isContentTypeOnAllowList`) and to
+ * the entry repo for every other `contentType` — a Collection key. `assignTerms`/`unassignTerms`'s
+ * `validateAssignmentTarget` (write-service.ts) already decides whether a non-post/page
+ * `contentType` is ELIGIBLE via `contentTypeTaxonomyPolicy` before calling this at all; this
+ * function only decides which table a resolvable id is looked up against.
+ */
+export function createContentLookup(deps) {
+    const postLookup = createPostBackedContentLookup({ postRepo: deps.postRepo, workspaceId: deps.workspaceId });
+    const entryLookup = createEntryBackedContentLookup({ entryRepo: deps.entryRepo, workspaceId: deps.workspaceId });
+    return {
+        async resolve(params) {
+            return isContentTypeOnAllowList(params.contentType) ? postLookup.resolve(params) : entryLookup.resolve(params);
+        },
+    };
+}
 //# sourceMappingURL=content-lookup.js.map

package/dist/taxonomy/index.d.ts

@@ -19,7 +19,7 @@
  * has no imports at all: the ceremony is a parameter, not a dependency.
  */
 export { TaxonomyNotApplicableError, WorkspaceMismatchError, ContentTypeMismatchError, TaxonomyNotHierarchicalError, ParentCrossTaxonomyError, TermNotFoundError, HierarchyCycleDetectedError, wouldCreateCycle, validateContentJoin, validateHierarchyAssignment, type TermTreeLookup, } from "./validation-chain.js";
-export { TAXONOMY_ALLOWED_CONTENT_TYPES, isContentTypeOnAllowList, TaxonomyRecordNotFoundError, TermRecordNotFoundError, ContentRecordNotFoundError, TermHasAssignedContentError, TermHasChildTermsError, TaxonomyHasAssignedContentError, createTaxonomy, createTerm, renameTerm, assignTerms, deleteTerm, deleteTaxonomy, onContentDeleted, type AuthorizeFn, type Taxonomy, type Term, type TaxonomyRepoPort, type TermRepoPort, type EntryTermRepoPort, type ContentLookupPort, type TaxonomyRevisionRow, type TaxonomyRevisionRepoPort, type ClockPort, type IdGeneratorPort, type WriteServiceDeps, type CreateTaxonomyRequired, type CreateTermRequired, type RenameTermRequired, type AssignTermsRequired, type DeleteTermRequired, type DeleteTaxonomyRequired, type DeletableTaxonomyRepoPort, type DeletableTermRepoPort, type AssignmentCountEntryTermRepoPort, type TransactionalRepoPort, type EntryTermsCleanupPort, type OnContentDeletedRequired, } from "./write-service.js";
+export { TAXONOMY_ALLOWED_CONTENT_TYPES, isContentTypeOnAllowList, TaxonomyRecordNotFoundError, TermRecordNotFoundError, ContentRecordNotFoundError, TermHasAssignedContentError, TermHasChildTermsError, TaxonomyHasAssignedContentError, createTaxonomy, createTerm, renameTerm, assignTerms, unassignTerms, deleteTerm, deleteTaxonomy, onContentDeleted, type AuthorizeFn, type Taxonomy, type Term, type TaxonomyRepoPort, type TermRepoPort, type EntryTermRepoPort, type ContentLookupPort, type ContentTypeTaxonomyPolicyPort, type UnassignableEntryTermRepoPort, type TaxonomyRevisionRow, type TaxonomyRevisionRepoPort, type ClockPort, type IdGeneratorPort, type WriteServiceDeps, type CreateTaxonomyRequired, type CreateTermRequired, type RenameTermRequired, type AssignTermsRequired, type UnassignTermsRequired, type DeleteTermRequired, type DeleteTaxonomyRequired, type DeletableTaxonomyRepoPort, type DeletableTermRepoPort, type AssignmentCountEntryTermRepoPort, type TransactionalRepoPort, type EntryTermsCleanupPort, type OnContentDeletedRequired, } from "./write-service.js";
 export { listTaxonomiesWithTerms, type TaxonomyListPort, type TermListPort, type TaxonomyWithTerms, } from "./list.js";
 /**
  * The domain half of the `mergeTerm` ceremony — see this file's header for why the gateway itself
@@ -32,7 +32,7 @@ export { InMemoryTaxonomyRepo, InMemoryTermRepo, InMemoryEntryTermRepo, InMemory
  * satisfy — see `content-lookup.ts` for why it is declared here rather than imported from a
  * content feature.
  */
-export { createPostBackedContentLookup, type ContentRecordLookupPort, } from "./content-lookup.js";
+export { createPostBackedContentLookup, createEntryBackedContentLookup, createContentLookup, type ContentRecordLookupPort, type EntryRecordLookupPort, } from "./content-lookup.js";
 /** The agent-tool surface for this domain (see `agent-tools.ts` for what is deliberately omitted). */
 export { taxonomyAgentToolCatalog, type AgentToolDefinition as TaxonomyAgentToolDefinition, type AgentToolSideEffect as TaxonomyAgentToolSideEffect, type AgentToolActorClassRule as TaxonomyAgentToolActorClassRule, } from "./agent-tools.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/taxonomy/index.js

@@ -19,7 +19,7 @@
  * has no imports at all: the ceremony is a parameter, not a dependency.
  */
 export { TaxonomyNotApplicableError, WorkspaceMismatchError, ContentTypeMismatchError, TaxonomyNotHierarchicalError, ParentCrossTaxonomyError, TermNotFoundError, HierarchyCycleDetectedError, wouldCreateCycle, validateContentJoin, validateHierarchyAssignment, } from "./validation-chain.js";
-export { TAXONOMY_ALLOWED_CONTENT_TYPES, isContentTypeOnAllowList, TaxonomyRecordNotFoundError, TermRecordNotFoundError, ContentRecordNotFoundError, TermHasAssignedContentError, TermHasChildTermsError, TaxonomyHasAssignedContentError, createTaxonomy, createTerm, renameTerm, assignTerms, deleteTerm, deleteTaxonomy, onContentDeleted, } from "./write-service.js";
+export { TAXONOMY_ALLOWED_CONTENT_TYPES, isContentTypeOnAllowList, TaxonomyRecordNotFoundError, TermRecordNotFoundError, ContentRecordNotFoundError, TermHasAssignedContentError, TermHasChildTermsError, TaxonomyHasAssignedContentError, createTaxonomy, createTerm, renameTerm, assignTerms, unassignTerms, deleteTerm, deleteTaxonomy, onContentDeleted, } from "./write-service.js";
 export { listTaxonomiesWithTerms, } from "./list.js";
 /**
  * The domain half of the `mergeTerm` ceremony — see this file's header for why the gateway itself
@@ -32,7 +32,7 @@ export { InMemoryTaxonomyRepo, InMemoryTermRepo, InMemoryEntryTermRepo, InMemory
  * satisfy — see `content-lookup.ts` for why it is declared here rather than imported from a
  * content feature.
  */
-export { createPostBackedContentLookup, } from "./content-lookup.js";
+export { createPostBackedContentLookup, createEntryBackedContentLookup, createContentLookup, } from "./content-lookup.js";
 /** The agent-tool surface for this domain (see `agent-tools.ts` for what is deliberately omitted). */
 export { taxonomyAgentToolCatalog, } from "./agent-tools.js";
 //# sourceMappingURL=index.js.map

package/dist/taxonomy/repo.memory.d.ts

@@ -1,4 +1,4 @@
-import type { ContentLookupPort, EntryTermRepoPort, TaxonomyRepoPort, TaxonomyRevisionRepoPort, TaxonomyRevisionRow, Term, TermRepoPort } from "./write-service.js";
+import type { ContentLookupPort, EntryTermRepoPort, TaxonomyRepoPort, TaxonomyRevisionRepoPort, TaxonomyRevisionRow, Term, TermRepoPort, UnassignableEntryTermRepoPort } from "./write-service.js";
 import type { Taxonomy } from "./write-service.js";
 import type { TaxonomyListPort, TermListPort } from "./list.js";
 /**
@@ -62,7 +62,7 @@ export declare class InMemoryTermRepo implements TermRepoPort, TermListPort {
         parentId: string;
     }): Promise<number>;
 }
-export declare class InMemoryEntryTermRepo implements EntryTermRepoPort {
+export declare class InMemoryEntryTermRepo implements EntryTermRepoPort, UnassignableEntryTermRepoPort {
     private readonly rows;
     upsert(row: {
         contentType: string;
@@ -94,6 +94,15 @@ export declare class InMemoryEntryTermRepo implements EntryTermRepoPort {
     countByTerm(params: {
         termId: string;
     }): Promise<number>;
+    /** `UnassignableEntryTermRepoPort` — additive capability for `unassignTerms` (A2, taxonomy
+     * plan). Returns the number of rows actually removed (0 or 1, given `entry_terms_unique`'s
+     * `(contentType, contentId, termId)` uniqueness) rather than throwing on a no-op — mirrors
+     * `deleteByContent`'s own "return the removed count" convention. */
+    remove(row: {
+        contentType: string;
+        contentId: string;
+        termId: string;
+    }): Promise<number>;
 }
 export declare class InMemoryTaxonomyRevisionRepo implements TaxonomyRevisionRepoPort {
     readonly rows: TaxonomyRevisionRow[];

package/dist/taxonomy/repo.memory.js

@@ -123,6 +123,17 @@ export class InMemoryEntryTermRepo {
     async countByTerm(params) {
         return this.rows.filter((r) => r.termId === params.termId).length;
     }
+    /** `UnassignableEntryTermRepoPort` — additive capability for `unassignTerms` (A2, taxonomy
+     * plan). Returns the number of rows actually removed (0 or 1, given `entry_terms_unique`'s
+     * `(contentType, contentId, termId)` uniqueness) rather than throwing on a no-op — mirrors
+     * `deleteByContent`'s own "return the removed count" convention. */
+    async remove(row) {
+        const before = this.rows.length;
+        const remaining = this.rows.filter((r) => !(r.contentType === row.contentType && r.contentId === row.contentId && r.termId === row.termId));
+        this.rows.length = 0;
+        this.rows.push(...remaining);
+        return before - this.rows.length;
+    }
 }
 export class InMemoryTaxonomyRevisionRepo {
     rows = [];

package/dist/taxonomy/write-service.d.ts

@@ -102,10 +102,20 @@ export interface ContentLookupPort {
         kind: string;
     } | null>;
 }
+/** ADR-044: the content_types registry's per-type taxonomy allow-list for Collections entries
+ *  (parallel to, never folded into, TAXONOMY_ALLOWED_CONTENT_TYPES — see the decision note).
+ *  `null` = not a live registry type (not applicable). */
+export interface ContentTypeTaxonomyPolicyPort {
+    taxonomiesFor(params: {
+        contentType: string;
+    }): Promise<"all" | ReadonlySet<string> | null>;
+}
 /** The hardcoded post/page taxonomy allow-list (permanent, see
  * `docs/decisions/taxonomy-content-type-allow-list.md`) — every taxonomy is applicable to
- * `post`/`page` content; no other content type is eligible for term assignment until this is
- * deliberately extended. */
+ * `post`/`page` content. This set is never grown to admit a Collection's content-type key; a
+ * Collection entry instead becomes eligible through {@link ContentTypeTaxonomyPolicyPort} above,
+ * an intentionally parallel (not layered) per-content-type policy carried by a host's own
+ * `content_types` registry. */
 export declare const TAXONOMY_ALLOWED_CONTENT_TYPES: ReadonlySet<string>;
 export declare function isContentTypeOnAllowList(contentType: string): boolean;
 export interface TaxonomyRevisionRow {
@@ -146,6 +156,10 @@ export interface WriteServiceDeps {
     /** Resolves a `(contentType, contentId)` pair's real workspace/kind for `assignTerms`'s
      * content-join validation (Finding 1 fix). */
     contentLookup: ContentLookupPort;
+    /** Per-content-type taxonomy allow-list for Collections entries (A1, taxonomy plan). Optional so
+     * other hosts (and every existing test double) don't break — a host that omits it simply never
+     * makes a non-post/page `contentType` resolvable, matching today's behavior exactly. */
+    contentTypeTaxonomyPolicy?: ContentTypeTaxonomyPolicyPort;
 }
 export declare class TaxonomyRecordNotFoundError extends Error {
     constructor(message: string);
@@ -195,20 +209,35 @@ export interface AssignTermsRequired {
     contentId: string;
     termIds: string[];
 }
-/** AC-17/AC-20/INV-05/REQ-13/REQ-14 — upserts every `entry_terms` row (idempotent on-conflict per
- * `entry_terms_unique`, EC-09), then stamps the watermark and enqueues the outbox event exactly
- * ONCE per call regardless of `termIds.length` — never once per term. Never produces a
- * `taxonomy_revisions` row (see this file's header for the disclosed narrowing this implements).
- *
- * Finding 1 fix (TM-adr041-043-044-045-audit-001): every `termId` is validated via
- * `validateContentJoin` (allow-list -> workspace -> lens, `validation-chain.ts`'s fixed order)
- * BEFORE any `entry_terms` row is written — every termId must resolve to a real term, and the
- * target content must resolve to a real row whose kind matches the caller-supplied `contentType`.
- * Validation runs for ALL termIds before ANY write, so a failure partway through never leaves a
- * partial assignment. Content is resolved once per call (not once per term) since every term in
- * one call shares the same `(contentType, contentId)` target.
- */
 export declare function assignTerms(required: AssignTermsRequired, _optional?: Record<string, never>): Promise<void>;
+/** A2 (taxonomy plan) — the removal half of `assignTerms`. `remove()` lives on an additive port
+ * (`UnassignableEntryTermRepoPort`) rather than widening the certified `EntryTermRepoPort`, the
+ * same precedent `AssignmentCountEntryTermRepoPort` already set for `deleteTerm`/`deleteTaxonomy`. */
+export interface UnassignableEntryTermRepoPort {
+    remove(row: {
+        contentType: string;
+        contentId: string;
+        termId: string;
+    }): Promise<number>;
+}
+export interface UnassignTermsRequired {
+    deps: Omit<WriteServiceDeps, "entryTerms"> & {
+        entryTerms: EntryTermRepoPort & UnassignableEntryTermRepoPort;
+    };
+    principalId: string;
+    contentType: string;
+    contentId: string;
+    termIds: string[];
+}
+/** SPEC-018 REQ-07/REQ-13/REQ-14/REQ-17/REQ-22 — spec debt this codebase never built (the spec
+ * always named "assign/unassign tools"; only `assignTerms` shipped). Same
+ * authorize -> validateAssignmentTarget -> write -> stamp -> outbox chokepoint as `assignTerms`,
+ * and — like `assignTerms` — never produces a `taxonomy_revisions` row (REQ-13/INV-05's disclosed
+ * narrowing applies equally to removal). Idempotent: unassigning a row that isn't there is a no-op,
+ * not an error (`remove()`'s 0-vs-1 return is intentionally not surfaced to the caller). Chosen over
+ * a "set terms" replace call — see the taxonomy plan's "What the docs settle" #3 for why replace
+ * risks silently erasing a concurrent assignment. */
+export declare function unassignTerms(required: UnassignTermsRequired, _optional?: Record<string, never>): Promise<void>;
 export interface EntryTermsCleanupPort {
     deleteByContent(params: {
         workspaceId: string;