@jini-ai/cms 0.3.6 → 0.3.8

package/dist/media/html-attributes.d.ts

@@ -1,17 +1,17 @@
 /**
  * @file Server-side allowlist for `MediaRecord.htmlAttributes` (2026-09-07) — the enforcement half
- * of a validator that ALSO has a browser-side copy in Tovu's admin
+ * of a validator that ALSO has a browser-side copy in the consuming product's admin
  * (`apps/admin/src/features/media/rules.ts`, `parseMediaHtmlAttributes` and friends).
  *
  * Deliberately duplicated, not shared via one imported module, for the same reason this codebase
- * already hand-copies `DEFAULT_ALLOWED_MIME_TYPES` into Tovu's `FILE_HANDLER_ALLOWED_MIME_TYPES`/
+ * already hand-copies `DEFAULT_ALLOWED_MIME_TYPES` into that admin's `FILE_HANDLER_ALLOWED_MIME_TYPES`/
  * `IMPORTABLE_CONTENT_TYPES`: `@jini-ai/cms/media`'s barrel (`index.ts`) re-exports files that
  * import real Node built-ins (`node:crypto` in `media-service.ts`, `node:fs` in
  * `blob-store.fs.ts`, native `sharp` bindings in `image-transformer.sharp.ts`) — importing this
- * subpath from a browser-bundled Vite app (Tovu's `apps/admin`) risks pulling those into the admin
+ * subpath from a browser-bundled Vite app (that product's `apps/admin`) risks pulling those into the admin
  * SPA's bundle even if only this one pure function is actually used, and this admin's own copy
  * already exists, tested, with no such risk. This file is the copy every Node-side consumer
- * (`media-service.ts`'s own `updateMediaMetadata`, and Tovu's `apps/website` render path, both pure
+ * (`media-service.ts`'s own `updateMediaMetadata`, and that product's `apps/website` render path, both pure
  * backend code) can safely import from `@jini-ai/cms/media` instead of re-deriving the rules a
  * third time.
  *
@@ -21,7 +21,7 @@
  * needed — that is the one piece of drift risk this duplication accepts, the same risk every other
  * hand-copied list in this codebase already accepts.
  *
- * This is a SECURITY boundary, not a syntax convenience: media metadata is authored in Tovu's admin
+ * This is a SECURITY boundary, not a syntax convenience: media metadata is authored in the consuming product's admin
  * but rendered on the public site, so a free-text HTML-attribute passthrough is a stored-XSS vector
  * (`onerror`, `onclick`, `style`, `href="javascript:"`, any `on*` handler) the moment it reaches a
  * public page. A client-side-only check is not a control, since the API accepts whatever a caller
@@ -33,7 +33,7 @@
  * families (checked separately in {@link isAllowedMediaHtmlAttributeName}). Picked for the owner's
  * stated near-term uses (animations, custom WebMCP hooks) plus the standard `<img>`/`<video>`
  * attributes those uses actually need; extend this list, not the parser, when a new one is needed —
- * and keep it in sync with the identical constant in Tovu's admin copy (see this file's header).
+ * and keep it in sync with the identical constant in that admin's copy (see this file's header).
  */
 export declare const MEDIA_HTML_ATTRIBUTE_ALLOWED_NAMES: readonly ["loading", "decoding", "playsinline", "muted", "loop", "autoplay", "poster"];
 /** Whether `name` is on the allowlist — a well-formed attribute name

package/dist/media/html-attributes.js

@@ -1,17 +1,17 @@
 /**
  * @file Server-side allowlist for `MediaRecord.htmlAttributes` (2026-09-07) — the enforcement half
- * of a validator that ALSO has a browser-side copy in Tovu's admin
+ * of a validator that ALSO has a browser-side copy in the consuming product's admin
  * (`apps/admin/src/features/media/rules.ts`, `parseMediaHtmlAttributes` and friends).
  *
  * Deliberately duplicated, not shared via one imported module, for the same reason this codebase
- * already hand-copies `DEFAULT_ALLOWED_MIME_TYPES` into Tovu's `FILE_HANDLER_ALLOWED_MIME_TYPES`/
+ * already hand-copies `DEFAULT_ALLOWED_MIME_TYPES` into that admin's `FILE_HANDLER_ALLOWED_MIME_TYPES`/
  * `IMPORTABLE_CONTENT_TYPES`: `@jini-ai/cms/media`'s barrel (`index.ts`) re-exports files that
  * import real Node built-ins (`node:crypto` in `media-service.ts`, `node:fs` in
  * `blob-store.fs.ts`, native `sharp` bindings in `image-transformer.sharp.ts`) — importing this
- * subpath from a browser-bundled Vite app (Tovu's `apps/admin`) risks pulling those into the admin
+ * subpath from a browser-bundled Vite app (that product's `apps/admin`) risks pulling those into the admin
  * SPA's bundle even if only this one pure function is actually used, and this admin's own copy
  * already exists, tested, with no such risk. This file is the copy every Node-side consumer
- * (`media-service.ts`'s own `updateMediaMetadata`, and Tovu's `apps/website` render path, both pure
+ * (`media-service.ts`'s own `updateMediaMetadata`, and that product's `apps/website` render path, both pure
  * backend code) can safely import from `@jini-ai/cms/media` instead of re-deriving the rules a
  * third time.
  *
@@ -21,7 +21,7 @@
  * needed — that is the one piece of drift risk this duplication accepts, the same risk every other
  * hand-copied list in this codebase already accepts.
  *
- * This is a SECURITY boundary, not a syntax convenience: media metadata is authored in Tovu's admin
+ * This is a SECURITY boundary, not a syntax convenience: media metadata is authored in the consuming product's admin
  * but rendered on the public site, so a free-text HTML-attribute passthrough is a stored-XSS vector
  * (`onerror`, `onclick`, `style`, `href="javascript:"`, any `on*` handler) the moment it reaches a
  * public page. A client-side-only check is not a control, since the API accepts whatever a caller
@@ -33,7 +33,7 @@
  * families (checked separately in {@link isAllowedMediaHtmlAttributeName}). Picked for the owner's
  * stated near-term uses (animations, custom WebMCP hooks) plus the standard `<img>`/`<video>`
  * attributes those uses actually need; extend this list, not the parser, when a new one is needed —
- * and keep it in sync with the identical constant in Tovu's admin copy (see this file's header).
+ * and keep it in sync with the identical constant in that admin's copy (see this file's header).
  */
 export const MEDIA_HTML_ATTRIBUTE_ALLOWED_NAMES = [
     "loading",

package/dist/media/index.d.ts

@@ -21,7 +21,7 @@ export { withSha256Lock } from "./blob-gc-lock.js";
 export { DEFAULT_GC_GRACE_MS, resolveGcGraceMs, isBlobUnreferenced, tombstoneBlobIfUnreferenced, runBlobGcDeletePass, runBlobGcUnlinkPass, runBlobGcCycle, runMonthlyOrphanSweepStub, } from "./blob-gc.js";
 export { InMemoryBlobStore } from "./blob-store.memory.js";
 export { LocalFsBlobStore, type LocalFsBlobStoreDeps } from "./blob-store.fs.js";
-export { DEFAULT_MAX_UPLOAD_BYTES, DEFAULT_ALLOWED_MIME_TYPES, resolveWriteOnceSource, uploadMedia, listMedia, getMediaById, findMediaByIdOrSlug, updateMediaMetadata, trashMedia, purgeMedia, type UploadMediaInput, type UploadMediaDeps, type UpdateMediaMetadataInput, type FindMediaByIdOrSlugRequired, } from "./media-service.js";
+export { DEFAULT_MAX_UPLOAD_BYTES, DEFAULT_ALLOWED_MIME_TYPES, resolveWriteOnceSource, uploadMedia, listMedia, getMediaById, findMediaByIdOrSlug, updateMediaMetadata, trashMedia, purgeMedia, isValidMediaSlugFormat, type UploadMediaInput, type UploadMediaDeps, type UpdateMediaMetadataInput, type FindMediaByIdOrSlugRequired, } from "./media-service.js";
 export type { TransformFit, TransformFormat, TransformParams, TransformDefinitionRecord, } from "./transform-types.js";
 export { TransformValidationError, mimeForTransformFormat, MAX_TRANSFORM_DIMENSION_PX } from "./transform-types.js";
 export { withRenditionLock, withTransformRegistryLock } from "./transform-lock.js";

package/dist/media/index.js

@@ -6,7 +6,7 @@ export { withSha256Lock } from "./blob-gc-lock.js";
 export { DEFAULT_GC_GRACE_MS, resolveGcGraceMs, isBlobUnreferenced, tombstoneBlobIfUnreferenced, runBlobGcDeletePass, runBlobGcUnlinkPass, runBlobGcCycle, runMonthlyOrphanSweepStub, } from "./blob-gc.js";
 export { InMemoryBlobStore } from "./blob-store.memory.js";
 export { LocalFsBlobStore } from "./blob-store.fs.js";
-export { DEFAULT_MAX_UPLOAD_BYTES, DEFAULT_ALLOWED_MIME_TYPES, resolveWriteOnceSource, uploadMedia, listMedia, getMediaById, findMediaByIdOrSlug, updateMediaMetadata, trashMedia, purgeMedia, } from "./media-service.js";
+export { DEFAULT_MAX_UPLOAD_BYTES, DEFAULT_ALLOWED_MIME_TYPES, resolveWriteOnceSource, uploadMedia, listMedia, getMediaById, findMediaByIdOrSlug, updateMediaMetadata, trashMedia, purgeMedia, isValidMediaSlugFormat, } from "./media-service.js";
 export { TransformValidationError, mimeForTransformFormat, MAX_TRANSFORM_DIMENSION_PX } from "./transform-types.js";
 export { withRenditionLock, withTransformRegistryLock } from "./transform-lock.js";
 export { registerTransform, getLatestTransformDefinition, isLatestTransformVersion, isReferencedByPublishedContent, } from "./transform-registry.js";

package/dist/media/media-service.d.ts

@@ -23,7 +23,7 @@ export declare const DEFAULT_MAX_UPLOAD_BYTES: number;
  * image types above, an accepted video is never re-encoded — there is no
  * `TransformFormat` for video (`transform-types.ts`'s union is image-only), so
  * a video asset's public URL bypasses the transform/rendition pipeline
- * entirely and serves the original bytes as-is (host concern; see Tovu's
+ * entirely and serves the original bytes as-is (host concern; see the host's
  * `routes/site/media-rendition.ts`). This widens the SAME advisory,
  * client-declared-string check item 4 above already discloses as untrusted —
  * no new ingress hardening was added for video.
@@ -49,6 +49,7 @@ export declare function resolveWriteOnceSource(required: {
     existing: MediaSource | undefined;
     requestedSha256: string;
 }, _optional?: Record<string, never>): MediaSource;
+export declare function isValidMediaSlugFormat(slug: string): boolean;
 export interface UploadMediaInput {
     workspaceId: UUID;
     bytes: Uint8Array;

package/dist/media/media-service.js

@@ -58,6 +58,22 @@ import { describeMediaHtmlAttributeError, parseMediaHtmlAttributes } from "./htm
 export { MediaConflictError, MediaNotFoundError, MediaSourceImmutableError, MediaStillReferencedError, MediaValidationError, };
 /** Default byte-size cap (this pass's stand-in for the real ingress policy's streaming cap). */
 export const DEFAULT_MAX_UPLOAD_BYTES = 10 * 1024 * 1024; // 10 MiB
+/**
+ * Renders a byte count as a human-readable MB figure for the size-cap rejection below (2026-09-21).
+ * Every real caller passes a MiB-scale `maxUploadBytes` (10 MiB default, or a host override such as
+ * Tovu's 50 MiB), so one decimal place is enough precision without ever showing a raw byte count —
+ * the whole point of this fix (see `uploadMedia`'s size-cap check, and `agent-tools.ts`'s file header
+ * for why the catalog description can no longer state a specific number either). `toFixed(1)`'s
+ * trailing `.0` is trimmed so a clean multiple of 1 MB (the common case) reads as `10 MB`, not `10.0
+ * MB`.
+ *
+ * @complexity O(1).
+ */
+function formatMaxUploadBytesAsMb(bytes) {
+    const mb = bytes / (1024 * 1024);
+    const rounded = mb.toFixed(1);
+    return `${rounded.endsWith(".0") ? rounded.slice(0, -2) : rounded} MB`;
+}
 /**
  * Advisory MIME allowlist. SVG is deliberately EXCLUDED (not "TODO, forgot") —
  * SVG must be sanitized at ingest before it's safe to store;
@@ -77,7 +93,7 @@ export const DEFAULT_MAX_UPLOAD_BYTES = 10 * 1024 * 1024; // 10 MiB
  * image types above, an accepted video is never re-encoded — there is no
  * `TransformFormat` for video (`transform-types.ts`'s union is image-only), so
  * a video asset's public URL bypasses the transform/rendition pipeline
- * entirely and serves the original bytes as-is (host concern; see Tovu's
+ * entirely and serves the original bytes as-is (host concern; see the host's
  * `routes/site/media-rendition.ts`). This widens the SAME advisory,
  * client-declared-string check item 4 above already discloses as untrusted —
  * no new ingress hardening was added for video.
@@ -150,7 +166,7 @@ const MEDIA_SLUG_UUID_SHAPE_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9
  *  human for a shorter value — silently truncating an internally-derived value is the same
  *  "coerce, don't fail" convention `deriveTitleFromFilename`/`slugifyMediaTitle` already use. */
 const MEDIA_MAX_SLUG_LENGTH = 120;
-function isValidMediaSlugFormat(slug) {
+export function isValidMediaSlugFormat(slug) {
     return MEDIA_SLUG_FORMAT_PATTERN.test(slug) && !MEDIA_SLUG_UUID_SHAPE_PATTERN.test(slug);
 }
 /** Truncates a slug candidate to `maxLength`, stripping a trailing dash the cut can introduce (so a
@@ -165,9 +181,9 @@ function capSlugCandidate(candidate, maxLength) {
 }
 /** Turns free text into a slug candidate: lowercase, non-alphanumeric runs collapsed to one dash,
  *  leading/trailing dashes trimmed. Same algorithm as `post.ts`'s private `slugify` (duplicated, not
- *  imported — cross-repo: `post.ts` lives in Tovu, this file in `@jini-ai/cms`; this codebase's own
+ *  imported — cross-repo: `post.ts` lives in the host, this file in `@jini-ai/cms`; this codebase's own
  *  precedent for a small hand-copied helper mirrored across a repo boundary is `DEFAULT_ALLOWED_MIME_TYPES`
- *  vs. Tovu's `FILE_HANDLER_ALLOWED_MIME_TYPES`/`IMPORTABLE_CONTENT_TYPES`). Never throws and never
+ *  vs. the host's `FILE_HANDLER_ALLOWED_MIME_TYPES`/`IMPORTABLE_CONTENT_TYPES`). Never throws and never
  *  returns `undefined` — an all-punctuation input collapses to `""`, which every caller here treats
  *  as "derive nothing, fall back to a fixed default" rather than a malformed-input error. */
 function slugifyMediaTitle(title) {
@@ -181,12 +197,12 @@ function slugifyMediaTitle(title) {
  * Derives a unique-per-workspace slug from `title`, suffixing `-2`, `-3`, … on collision — the
  * identical loop shape `post.ts`'s `createPost` uses for its own derived-slug path. Shared by
  * {@link uploadMedia} (derive-on-create) and the backfill a host runs once for pre-existing rows
- * with no slug yet (see Tovu's `development/scripts/backfill-media-slugs.ts`).
+ * with no slug yet (see the host's `development/scripts/backfill-media-slugs.ts`).
  *
  * `base` falls back to `"untitled"` when `title` slugifies to the empty string (all-punctuation or
  * non-Latin titles that `slugifyMediaTitle` strips to nothing) — `uploadMedia`'s own title is never
  * empty (`deriveTitleFromFilename` guarantees a non-empty string), but the backfill script
- * (`development/scripts/backfill-media-slugs.ts`, Tovu) calls this against arbitrary pre-existing
+ * (`development/scripts/backfill-media-slugs.ts`, host-side) calls this against arbitrary pre-existing
  * titles, so this fallback is load-bearing there, not just a defensive floor. Note this is the SAME
  * fallback base every empty-slugifying title collapses onto, so two such titles in one workspace
  * collide on `"untitled"` and are disambiguated by the ordinary suffix loop below exactly like any
@@ -248,7 +264,7 @@ export async function uploadMedia(required, optional = {}) {
         throw new MediaValidationError("uploaded file is empty");
     }
     if (input.bytes.byteLength > maxUploadBytes) {
-        throw new MediaValidationError(`uploaded file exceeds the ${maxUploadBytes}-byte size cap`);
+        throw new MediaValidationError(`uploaded file exceeds the ${formatMaxUploadBytesAsMb(maxUploadBytes)} size cap`);
     }
     const sha256 = createHash("sha256").update(input.bytes).digest("hex");
     const nowIso = deps.clock.nowIso();

package/dist/media/tool-registrations.d.ts

@@ -92,6 +92,18 @@ export interface MediaToolDeps {
         media: MediaRecord;
         bytes: Uint8Array;
     }) => Promise<void>;
+    /**
+     * Optional host-supplied override of `uploadMedia`'s own `DEFAULT_MAX_UPLOAD_BYTES` (10 MiB,
+     * `media-service.ts`), forwarded verbatim as `uploadMedia`'s third (`optional`) argument in the
+     * `media_upload_asset` handler below (2026-09-21). Before this field existed, the handler called
+     * `uploadMedia({ deps, input })` with no third argument at all, so EVERY host's assistant upload
+     * tool was hard-capped at 10 MiB regardless of what limit that host's own HTTP upload route
+     * enforced — a host raising its own cap (e.g. to 50 MiB) had no way to raise this tool's cap to
+     * match. Omitted: `uploadMedia`'s own default applies unchanged, matching this field's own
+     * pre-2026-09-21 absence for every host that has not opted in yet — the same degrade-soft
+     * contract {@link resolvePublicUrls} and {@link recordUploadContentType} already established.
+     */
+    maxUploadBytes?: number;
 }
 /**
  * This wiring layer's OWN risk classification, authored from what each handler below actually

package/dist/media/tool-registrations.js

@@ -30,6 +30,7 @@ function isMediaShapeRejection(error) {
 function toMediaToolView(record) {
     return {
         id: record.id,
+        slug: record.slug,
         title: record.title,
         alt: record.alt,
         caption: record.caption,
@@ -37,6 +38,8 @@ function toMediaToolView(record) {
         sha256: record.source.sha256,
         status: record.status,
         version: record.version,
+        cssClass: record.cssClass,
+        htmlAttributes: record.htmlAttributes,
     };
 }
 /**
@@ -92,7 +95,7 @@ export function buildMediaRegistrations(routeDeps) {
                         credit: typeof input.credit === "string" ? input.credit : undefined,
                         createdByPrincipal: ctx.principal.id,
                     },
-                });
+                }, { maxUploadBytes: routeDeps.maxUploadBytes });
                 if (routeDeps.recordUploadContentType) {
                     try {
                         await routeDeps.recordUploadContentType({ media, bytes });
@@ -121,18 +124,23 @@ export function buildMediaRegistrations(routeDeps) {
             const input = requireInputRecord(ctx.input);
             const mediaId = requireString(input, "mediaId");
             await requireToolPermission(routeDeps, { principalId: ctx.principal.id, permission: "media.update", entityType: "media", entityId: mediaId });
-            const { media } = await updateMediaMetadata({
-                deps: { clock: routeDeps.clock, mediaRepo: routeDeps.mediaRepo },
-                input: {
-                    workspaceId: routeDeps.workspaceId,
-                    id: mediaId,
-                    title: typeof input.title === "string" ? input.title : undefined,
-                    alt: typeof input.alt === "string" ? input.alt : undefined,
-                    caption: typeof input.caption === "string" ? input.caption : undefined,
-                    credit: typeof input.credit === "string" ? input.credit : undefined,
-                },
+            return withSchemaOnRejection({ toolId: "media_update_metadata", catalog: CATALOG_BY_ID, isShapeRejection: isMediaShapeRejection }, async () => {
+                const { media } = await updateMediaMetadata({
+                    deps: { clock: routeDeps.clock, mediaRepo: routeDeps.mediaRepo },
+                    input: {
+                        workspaceId: routeDeps.workspaceId,
+                        id: mediaId,
+                        title: typeof input.title === "string" ? input.title : undefined,
+                        alt: typeof input.alt === "string" ? input.alt : undefined,
+                        caption: typeof input.caption === "string" ? input.caption : undefined,
+                        credit: typeof input.credit === "string" ? input.credit : undefined,
+                        slug: typeof input.slug === "string" ? input.slug : undefined,
+                        cssClass: typeof input.cssClass === "string" ? input.cssClass : undefined,
+                        htmlAttributes: typeof input.htmlAttributes === "string" ? input.htmlAttributes : undefined,
+                    },
+                });
+                return { media: toMediaToolView(media) };
             });
-            return { media: toMediaToolView(media) };
         },
         media_trash_asset: async (ctx) => {
             const mediaId = requireString(requireInputRecord(ctx.input), "mediaId");

package/dist/media/types.d.ts

@@ -50,7 +50,7 @@ export interface MediaRecord {
      *
      * Derived from `title` at upload time (`deriveMediaSlug`), then independently editable afterward
      * — renaming `title` does NOT recompute this field; it changes only on an explicit `slug` write.
-     * Unique per `(workspaceId, slug)`, enforced by the host's own DB index (see Tovu's
+     * Unique per `(workspaceId, slug)`, enforced by the host's own DB index (see the host's
      * `idx_media_workspace_slug`) — `updateMediaMetadata`'s own `findBySlug` check is a friendly-error
      * courtesy on top of that, not the enforcement itself, the same split `posts_workspace_slug_unique`
      * already establishes for `post`'s identical `slug` field.

package/dist/navigation/index.d.ts

@@ -20,10 +20,10 @@ export { InMemoryMenuRepo, InMemoryNavLocationBindingRepo, type MenuRepoPort, }
  * `isAllowedHref`/`ALLOWED_HREF_SHAPES_DESCRIPTION` (2026-09-03): the canonical author-link
  * allowlist, promoted here specifically so a HOST can import it rather than hand-copy it — the
  * dependency direction a host -> `@jini-ai/cms` is the one that is actually legal (the reverse is
- * not). Tovu's own render-time `safeHref` (`server/inbound/public-http/http/site/render.ts` and its
+ * not). The host's own render-time `safeHref` (`server/inbound/public-http/http/site/render.ts` and its
  * `features/theme/static-render.ts` duplicate) have not yet been migrated to import this — see
  * `menu-service.ts`'s own doc comment on `isAllowedHref` for the retirement plan and why nothing in
- * `check:boundaries` blocks either Tovu call site from doing so.
+ * `check:boundaries` blocks either host-side call site from doing so.
  */
 export { createMenu, updateMenuTree, assignLocation, deleteMenu, validateAndCloneTree, isAllowedHref, ALLOWED_HREF_SHAPES_DESCRIPTION, MenuNotFoundError, MenuValidationError, MenuConflictError, MenuLocationBoundError, DEFAULT_MAX_TREE_DEPTH, DEFAULT_MAX_ITEM_COUNT, type TreeValidationLimits, type CreateMenuDeps, type CreateMenuServiceInput, type CreateMenuRequired, type CreateMenuOptional, type UpdateMenuTreeDeps, type UpdateMenuTreeServiceInput, type UpdateMenuTreeRequired, type UpdateMenuTreeOptional, type AssignLocationDeps, type AssignLocationServiceInput, type AssignLocationRequired, type AssignLocationOptional, type DeleteMenuDeps, type DeleteMenuServiceInput, type DeleteMenuRequired, type DeleteMenuOptional, } from "./menu-service.js";
 export { resolveForLocation, resolveMenuDoc, type ResolveTargetHrefFn, type ResolvedTargetHref, type ResolveForLocationDeps, type ResolveForLocationServiceInput, type ResolveForLocationRequired, type ResolveForLocationOptional, } from "./resolver.js";

package/dist/navigation/index.js

@@ -11,10 +11,10 @@ export { InMemoryMenuRepo, InMemoryNavLocationBindingRepo, } from "./repo.memory
  * `isAllowedHref`/`ALLOWED_HREF_SHAPES_DESCRIPTION` (2026-09-03): the canonical author-link
  * allowlist, promoted here specifically so a HOST can import it rather than hand-copy it — the
  * dependency direction a host -> `@jini-ai/cms` is the one that is actually legal (the reverse is
- * not). Tovu's own render-time `safeHref` (`server/inbound/public-http/http/site/render.ts` and its
+ * not). The host's own render-time `safeHref` (`server/inbound/public-http/http/site/render.ts` and its
  * `features/theme/static-render.ts` duplicate) have not yet been migrated to import this — see
  * `menu-service.ts`'s own doc comment on `isAllowedHref` for the retirement plan and why nothing in
- * `check:boundaries` blocks either Tovu call site from doing so.
+ * `check:boundaries` blocks either host-side call site from doing so.
  */
 export { createMenu, updateMenuTree, assignLocation, deleteMenu, validateAndCloneTree, isAllowedHref, ALLOWED_HREF_SHAPES_DESCRIPTION, MenuNotFoundError, MenuValidationError, MenuConflictError, MenuLocationBoundError, DEFAULT_MAX_TREE_DEPTH, DEFAULT_MAX_ITEM_COUNT, } from "./menu-service.js";
 export { resolveForLocation, resolveMenuDoc, } from "./resolver.js";

package/dist/navigation/menu-service.d.ts

@@ -48,13 +48,13 @@ export declare const DEFAULT_MAX_TREE_DEPTH = 5;
 export declare const DEFAULT_MAX_ITEM_COUNT = 500;
 /**
  * The CANONICAL href allowlist for an author-authored link — same accepted shapes (`#…`, same-origin
- * `/…`, `http(s)://`, `mailto:`) as Tovu's render-time `safeHref` in `render.ts` and its
+ * `/…`, `http(s)://`, `mailto:`) as the host's render-time `safeHref` in `render.ts` and its
  * `features/theme/static-render.ts` duplicate. **This is now the single source of truth**: exported
  * from this package's public surface (`navigation/index.ts` -> `@jini-ai/cms/navigation`) so the
- * dependency runs the direction that is actually legal — Tovu already depends on `@jini-ai/cms`, not
+ * dependency runs the direction that is actually legal — the host already depends on `@jini-ai/cms`, not
  * the reverse — rather than each consumer hand-copying the predicate.
  *
- * The two Tovu copies (`render.ts:252`, `features/theme/static-render.ts:210`, both a coercing
+ * The two host-side copies (`render.ts:252`, `features/theme/static-render.ts:210`, both a coercing
  * `value => passes ? value : "#"` wrapper around the identical predicate below) have **not yet been
  * retired to import this** — that edit is intentionally out of this change's scope (a
  * `check:boundaries` no-deep-import concern is NOT what blocks it: `render.ts` already imports
@@ -79,7 +79,7 @@ export declare const DEFAULT_MAX_ITEM_COUNT = 500;
  * workspace's stored menu data (`content.db`, `content.seed.db`) before this change: every existing
  * `url`-kind href already starts with `#` or `/`, so this tightening rejects nothing that exists
  * today — it governs `createMenu` too, so it also reaches the Jini MCP agent-tool path, not just
- * hrefs written through Tovu's admin editor.
+ * hrefs written through the host's admin editor.
  *
  * @param rawHref - The href to check, already confirmed non-empty by `validateTarget`. Any string is
  *   otherwise a valid input — this function performs no other precondition checks.

package/dist/navigation/menu-service.js

@@ -67,13 +67,13 @@ const SAFE_HREF_RESOLUTION_BASE = "http://tovu-safehref.invalid/";
 const SAFE_HREF_RESOLUTION_ORIGIN = new URL(SAFE_HREF_RESOLUTION_BASE).origin;
 /**
  * The CANONICAL href allowlist for an author-authored link — same accepted shapes (`#…`, same-origin
- * `/…`, `http(s)://`, `mailto:`) as Tovu's render-time `safeHref` in `render.ts` and its
+ * `/…`, `http(s)://`, `mailto:`) as the host's render-time `safeHref` in `render.ts` and its
  * `features/theme/static-render.ts` duplicate. **This is now the single source of truth**: exported
  * from this package's public surface (`navigation/index.ts` -> `@jini-ai/cms/navigation`) so the
- * dependency runs the direction that is actually legal — Tovu already depends on `@jini-ai/cms`, not
+ * dependency runs the direction that is actually legal — the host already depends on `@jini-ai/cms`, not
  * the reverse — rather than each consumer hand-copying the predicate.
  *
- * The two Tovu copies (`render.ts:252`, `features/theme/static-render.ts:210`, both a coercing
+ * The two host-side copies (`render.ts:252`, `features/theme/static-render.ts:210`, both a coercing
  * `value => passes ? value : "#"` wrapper around the identical predicate below) have **not yet been
  * retired to import this** — that edit is intentionally out of this change's scope (a
  * `check:boundaries` no-deep-import concern is NOT what blocks it: `render.ts` already imports
@@ -98,7 +98,7 @@ const SAFE_HREF_RESOLUTION_ORIGIN = new URL(SAFE_HREF_RESOLUTION_BASE).origin;
  * workspace's stored menu data (`content.db`, `content.seed.db`) before this change: every existing
  * `url`-kind href already starts with `#` or `/`, so this tightening rejects nothing that exists
  * today — it governs `createMenu` too, so it also reaches the Jini MCP agent-tool path, not just
- * hrefs written through Tovu's admin editor.
+ * hrefs written through the host's admin editor.
  *
  * @param rawHref - The href to check, already confirmed non-empty by `validateTarget`. Any string is
  *   otherwise a valid input — this function performs no other precondition checks.

package/dist/settings/dictionaries/index.d.ts

@@ -4,11 +4,11 @@
  *
  * Relocated here from Jini's `@jini-ai/ui` (2026-08-08): these keys aren't UI-rendering logic,
  * they're settings-domain presentation copy, and this package's `settings` module is the actual
- * domain owner shared across every host (Tovu, Zana, ...). `@jini-ai/ui` keeps the *component*
+ * domain owner shared across every host. `@jini-ai/ui` keeps the *component*
  * that renders a settings dialog; a host supplies the copy, and this is the shared copy any
  * OD-parity host can reuse instead of re-authoring its own. See project memory "Settings-dialog
- * i18n relocation" for the full decision record and the sibling move of the 8 Tovu-specific
- * capability-fact keys (those stayed host-side — see Tovu's own `settings-capabilities-i18n.ts`).
+ * i18n relocation" for the full decision record and the sibling move of the 8 host-specific
+ * capability-fact keys (those stayed host-side — see the host's own `settings-capabilities-i18n.ts`).
  *
  * No `en` dictionary: this package's convention (matching `@jini-ai/ui`) is "the English string
  * IS the key" — `translateSettingsDialog` falls back to the raw key for English and any

package/dist/settings/dictionaries/index.js

@@ -4,11 +4,11 @@
  *
  * Relocated here from Jini's `@jini-ai/ui` (2026-08-08): these keys aren't UI-rendering logic,
  * they're settings-domain presentation copy, and this package's `settings` module is the actual
- * domain owner shared across every host (Tovu, Zana, ...). `@jini-ai/ui` keeps the *component*
+ * domain owner shared across every host. `@jini-ai/ui` keeps the *component*
  * that renders a settings dialog; a host supplies the copy, and this is the shared copy any
  * OD-parity host can reuse instead of re-authoring its own. See project memory "Settings-dialog
- * i18n relocation" for the full decision record and the sibling move of the 8 Tovu-specific
- * capability-fact keys (those stayed host-side — see Tovu's own `settings-capabilities-i18n.ts`).
+ * i18n relocation" for the full decision record and the sibling move of the 8 host-specific
+ * capability-fact keys (those stayed host-side — see the host's own `settings-capabilities-i18n.ts`).
  *
  * No `en` dictionary: this package's convention (matching `@jini-ai/ui`) is "the English string
  * IS the key" — `translateSettingsDialog` falls back to the raw key for English and any

package/dist/taxonomy/agent-tools.d.ts

@@ -26,18 +26,12 @@
  *   - `confirm()` structurally refuses an agent: `gateway.ts`'s own body — "if (principalKind ===
  *     'agent') throw new ForbiddenError('agent principals may not confirm a gated mutation', ...)"
  *     — before any permission check even runs. No `taxonomy_confirm_merge_term`-equivalent tool
- *     exists in this catalog, and no description below may even imply that step (mirrors
- *     `features/recovery/agent-tools.ts`'s own discipline for `backup_execute_restore`: "the
- *     human confirmation step is exactly the one act the gated-mutations gateway reserves for
- *     kind='user'/api_key principals").
- *   - `execute()` needs a confirmation token a human already minted through the admin UI's own
- *     ceremony (`server/routes/admin/taxonomy/merge-term.ts`'s `/merge/confirm` route) — the same
- *     `confirmer-must-equal-own-delegatedBy` actor-class rule `database_execute_migrate_forward`/
- *     `backup_execute_restore` carry, which `assistant/tool-registration-kit.ts`'s
- *     `ACTOR_CLASS_RULES_REQUIRING_CONFIRMATION_TRANSPORT` refuses to build regardless of this
- *     catalog's own choice, because the host's `ToolExecutor` has no confirmation transport wired.
- *     `taxonomy_execute_merge_term` is declared here (so the exclusion is a structural build-time
- *     refusal, not just an absent handler) but is NEVER wired by `tool-registrations.ts`.
+ *     exists in this catalog.
+ *   - `taxonomy_execute_merge_term` (2026-09-24) asks the human in chat before it runs: the host
+ *     wires it with the kit's `humanConfirmedHandler`, which shows a confirm dialog and only on the
+ *     human's own click confirms as that human (`kind='user'`) and executes as the agent acting for
+ *     them — the `confirmer-must-equal-own-delegatedBy` rule. The model never sees or supplies a
+ *     token. A merge deletes the source term's assignments with no Trash or undo, so it is gated.
  *
  * Naming: `taxonomy_*`, matching this package's own name — distinct from `features/content-types`'
  * `collections_*` prefix (a different pairing) and from `features/entries`' own
@@ -48,9 +42,10 @@
  * `ToolRegistration`s.
  *
  * Architectural role:
- * `features/taxonomy` domain declaration. Imports only `TAXONOMY_ALLOWED_CONTENT_TYPES` from its
- * own `write-service.ts`, so the published `contentType` enum cannot drift from what the domain
- * actually accepts.
+ * `features/taxonomy` domain declaration. As of A2 (taxonomy plan) it imports nothing from its own
+ * `write-service.ts` — `contentType` is published as an open string (see `CONTENT_TYPE_SCHEMA`
+ * below), since Collections entries widened the set of legal values past the fixed `post`/`page`
+ * allow-list this file used to mirror as an `enum`.
  */
 export type AgentToolSideEffect = "none" | "mutates-durable-state" | "mints-token";
 export type AgentToolActorClassRule = "confirmer-must-equal-own-delegatedBy" | "user-only" | "none";
@@ -65,11 +60,11 @@ export interface AgentToolDefinition {
     /**
      * JSON Schema for this tool's `input`, published to the model via `ToolDescriptor.inputSchema`
      * (`assistant/tool-registration-kit.ts`'s `buildDomainRegistrations`, which refuses to wire any
-     * tool lacking one). Optional — `taxonomy_execute_merge_term` is never wired, so it carries none.
+     * tool lacking one).
      */
     inputSchema?: Readonly<Record<string, unknown>>;
 }
-/** The Taxonomy domain's fixed agent-tool catalog: 6 wired (1 read, 4 ordinary writes, 1 gated-plan
+/** The Taxonomy domain's fixed agent-tool catalog: 7 wired (1 read, 5 ordinary writes, 1 gated-plan
  * read) + 1 declared-but-never-wired destructive tool — see this file's header for the full
  * `mergeTerm` safety analysis. */
 export declare const taxonomyAgentToolCatalog: AgentToolDefinition[];

package/dist/taxonomy/agent-tools.js

@@ -26,18 +26,12 @@
  *   - `confirm()` structurally refuses an agent: `gateway.ts`'s own body — "if (principalKind ===
  *     'agent') throw new ForbiddenError('agent principals may not confirm a gated mutation', ...)"
  *     — before any permission check even runs. No `taxonomy_confirm_merge_term`-equivalent tool
- *     exists in this catalog, and no description below may even imply that step (mirrors
- *     `features/recovery/agent-tools.ts`'s own discipline for `backup_execute_restore`: "the
- *     human confirmation step is exactly the one act the gated-mutations gateway reserves for
- *     kind='user'/api_key principals").
- *   - `execute()` needs a confirmation token a human already minted through the admin UI's own
- *     ceremony (`server/routes/admin/taxonomy/merge-term.ts`'s `/merge/confirm` route) — the same
- *     `confirmer-must-equal-own-delegatedBy` actor-class rule `database_execute_migrate_forward`/
- *     `backup_execute_restore` carry, which `assistant/tool-registration-kit.ts`'s
- *     `ACTOR_CLASS_RULES_REQUIRING_CONFIRMATION_TRANSPORT` refuses to build regardless of this
- *     catalog's own choice, because the host's `ToolExecutor` has no confirmation transport wired.
- *     `taxonomy_execute_merge_term` is declared here (so the exclusion is a structural build-time
- *     refusal, not just an absent handler) but is NEVER wired by `tool-registrations.ts`.
+ *     exists in this catalog.
+ *   - `taxonomy_execute_merge_term` (2026-09-24) asks the human in chat before it runs: the host
+ *     wires it with the kit's `humanConfirmedHandler`, which shows a confirm dialog and only on the
+ *     human's own click confirms as that human (`kind='user'`) and executes as the agent acting for
+ *     them — the `confirmer-must-equal-own-delegatedBy` rule. The model never sees or supplies a
+ *     token. A merge deletes the source term's assignments with no Trash or undo, so it is gated.
  *
  * Naming: `taxonomy_*`, matching this package's own name — distinct from `features/content-types`'
  * `collections_*` prefix (a different pairing) and from `features/entries`' own
@@ -48,11 +42,11 @@
  * `ToolRegistration`s.
  *
  * Architectural role:
- * `features/taxonomy` domain declaration. Imports only `TAXONOMY_ALLOWED_CONTENT_TYPES` from its
- * own `write-service.ts`, so the published `contentType` enum cannot drift from what the domain
- * actually accepts.
+ * `features/taxonomy` domain declaration. As of A2 (taxonomy plan) it imports nothing from its own
+ * `write-service.ts` — `contentType` is published as an open string (see `CONTENT_TYPE_SCHEMA`
+ * below), since Collections entries widened the set of legal values past the fixed `post`/`page`
+ * allow-list this file used to mirror as an `enum`.
  */
-import { TAXONOMY_ALLOWED_CONTENT_TYPES } from "./write-service.js";
 const TAXONOMY_ID_SCHEMA = {
     type: "string",
     minLength: 1,
@@ -63,12 +57,17 @@ const TERM_ID_SCHEMA = {
     minLength: 1,
     description: "A term id, as returned by taxonomy_create_term or taxonomy_list.",
 };
+/** A2 (taxonomy plan) — an open string, not an `enum` of `TAXONOMY_ALLOWED_CONTENT_TYPES`. `post`
+ * and `page` are always eligible; a Collection key (e.g. `'recipes'`) is eligible when that
+ * Collection's own content-type policy allows it — a call the write-service's
+ * `contentTypeTaxonomyPolicy` makes, not this schema. An `enum` here would reject a valid
+ * Collection key before the request ever reached that check. */
 const CONTENT_TYPE_SCHEMA = {
     type: "string",
-    enum: [...TAXONOMY_ALLOWED_CONTENT_TYPES],
-    description: "The content kind the target row actually is. Only 'post' and 'page' are eligible for term assignment (a permanent allow-list) — any other value is rejected before anything is written.",
+    minLength: 1,
+    description: "'post', 'page', or a Collection key (entries of that Collection).",
 };
-/** The Taxonomy domain's fixed agent-tool catalog: 6 wired (1 read, 4 ordinary writes, 1 gated-plan
+/** The Taxonomy domain's fixed agent-tool catalog: 7 wired (1 read, 5 ordinary writes, 1 gated-plan
  * read) + 1 declared-but-never-wired destructive tool — see this file's header for the full
  * `mergeTerm` safety analysis. */
 export const taxonomyAgentToolCatalog = [
@@ -128,8 +127,8 @@ export const taxonomyAgentToolCatalog = [
     {
         name: "taxonomy_assign_terms",
         description: "Assigns one or more existing terms to a piece of content (the same <TermPicker> operation the Collections editor and the Categories & " +
-            "Tags screen both use). Additive only — this call ADDS assignments; it never removes a term not present in termIds, and calling it twice " +
-            "with the same term is a no-op (idempotent). Every termId is validated (must exist; its taxonomy must be applicable to contentType) " +
+            "Tags screen both use). This call ADDS assignments; calling it twice with the same term is a no-op (idempotent). Use " +
+            "taxonomy_unassign_terms to remove an assignment. Every termId is validated (must exist; its taxonomy must be applicable to contentType) " +
             "before ANY row is written, so a bad id in the list rejects the whole call rather than partially assigning.",
         sideEffects: "mutates-durable-state",
         authorization: { permission: "admin.taxonomy.manage" },
@@ -139,19 +138,35 @@ export const taxonomyAgentToolCatalog = [
             required: ["contentType", "contentId", "termIds"],
             properties: {
                 contentType: CONTENT_TYPE_SCHEMA,
-                contentId: { type: "string", minLength: 1, description: "The id of the post/page row to assign terms to." },
+                contentId: { type: "string", minLength: 1, description: "The id of the content row to assign terms to." },
                 termIds: { type: "array", items: { type: "string" }, description: "Term ids to assign. May be empty (a no-op)." },
             },
         },
     },
+    {
+        name: "taxonomy_unassign_terms",
+        description: "Removes one or more previously-assigned terms from a piece of content. Idempotent — removing a term that isn't currently assigned is a " +
+            "no-op, not an error. Every termId is validated the same way taxonomy_assign_terms validates them (must exist; its taxonomy must be " +
+            "applicable to contentType) before anything is removed.",
+        sideEffects: "mutates-durable-state",
+        authorization: { permission: "admin.taxonomy.manage" },
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["contentType", "contentId", "termIds"],
+            properties: {
+                contentType: CONTENT_TYPE_SCHEMA,
+                contentId: { type: "string", minLength: 1, description: "The id of the content row to unassign terms from." },
+                termIds: { type: "array", items: { type: "string" }, description: "Term ids to unassign. May be empty (a no-op)." },
+            },
+        },
+    },
     {
         name: "taxonomy_plan_merge_term",
         description: "Previews merging one term into another: recomputes and returns the current overlap-loss disclosure (how many pieces of content are " +
             "already assigned to BOTH terms, whose duplicate assignment would be silently lost by the merge's own dedup step) plus a planId/planHash " +
             "a human can use in the admin UI's own merge confirmation ceremony. Read-only — performs no merge. Rejects immediately if fromTermId " +
-            "equals intoTermId, before computing anything. This tool can only PLAN a merge; actually executing one requires a human to confirm " +
-            "through the admin UI — no tool in this catalog can do that step (by design: merges are destructive and irreversible for the merged-away " +
-            "term's own identity).",
+            "equals intoTermId, before computing anything. To actually merge, call taxonomy_execute_merge_term, which asks the user to confirm first.",
         sideEffects: "none",
         authorization: { permission: "admin.taxonomy.manage" },
         inputSchema: {
@@ -165,13 +180,22 @@ export const taxonomyAgentToolCatalog = [
         },
     },
     {
-        // EXCLUDED BY DESIGN, never wired: see this file's header. Token-gated; `core/gated-mutations`'s
-        // own confirm() step structurally refuses an agent principal, and no confirmation transport
-        // exists for an agent to be handed a human-minted token through anyway.
+        // Asks the human first — see this file's header.
         name: "taxonomy_execute_merge_term",
-        description: "Executes a previously confirmed term merge using a human-minted confirmation token. NEVER agent-callable — see file header.",
+        description: "Merges one term into another: every piece of content tagged with fromTermId is re-tagged with intoTermId, and fromTermId is " +
+            "deprecated. Shows the user a confirm dialog first and only merges if they confirm. The merge can't be undone. Call " +
+            "taxonomy_plan_merge_term first to see how many items are affected.",
         sideEffects: "mutates-durable-state",
         authorization: { permission: "admin.taxonomy.manage" },
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            required: ["fromTermId", "intoTermId"],
+            properties: {
+                fromTermId: { ...TERM_ID_SCHEMA, description: "The term to merge away. It is deprecated after the merge." },
+                intoTermId: { ...TERM_ID_SCHEMA, description: "The term that receives every assignment." },
+            },
+        },
         actorClassRule: "confirmer-must-equal-own-delegatedBy",
     },
 ];