@jini-ai/cms 0.3.8 → 0.3.9

package/dist/content-types/errors.d.ts

@@ -1,3 +1,4 @@
+import { ToolInputError } from "@jini-ai/core";
 /**
  * @file Typed error surface for the `content-types` package.
  *
@@ -10,26 +11,41 @@
  * the constructor sets `this.name` explicitly (confirmed empirically in Session 2 of this
  * workstream) — every class below sets it.
  *
+ * Every class the five wired agent tools (`define`/`update_fields`/`deprecate`/`reactivate`/
+ * `tombstone`) can actually throw extends `ToolInputError` (`@jini-ai/core`), not plain `Error` —
+ * mirroring `core/entity-liveness.ts`'s `EntityNotLiveError` (see its file header for the full
+ * rationale). Without that, `write-service.ts`/`lifecycle.ts` return these via a `Result` that
+ * `tool-registrations.ts`'s `fromResult` re-throws unwrapped, `@jini-ai/daemon`'s `ToolExecutor`
+ * sees a plain `Error` it cannot distinguish from a genuine internal fault, and every HTTP-facing
+ * mapping of that failure (`@jini-ai/http-kit`'s `delegated-tools.ts`) redacts it to a 500
+ * `INTERNAL_ERROR` — so a model calling `collections_content_type_define` on a key that already
+ * exists never sees "use collections_content_type_update_fields", only an opaque failure it cannot
+ * act on. `CleanupNotEligibleError` is the one exception: `collections_plan_cleanup`/
+ * `collections_execute_cleanup` are declared but not yet wired to any handler
+ * (`tool-registrations.ts`'s `UNWIRED_CONTENT_TYPES_TOOL_IDS`), so nothing reaches a model through
+ * it today — left as plain `Error` until that wiring exists and it can be verified the same way.
+ *
  * Architectural role:
- * `features/content-types` domain logic. No dependencies.
+ * `features/content-types` domain logic. Depends on `@jini-ai/core` only for the `ToolInputError`
+ * marker above.
  */
-export declare class ForbiddenError extends Error {
+export declare class ForbiddenError extends ToolInputError {
     constructor(message: string);
 }
 /** CIC U-002-B1 guard 1 — `key`/field-name grammar gate `^[a-z][a-z0-9_]{0,63}$` (U-001-B2). */
-export declare class InvalidKeyGrammarError extends Error {
+export declare class InvalidKeyGrammarError extends ToolInputError {
     constructor(message: string);
 }
 /** CIC U-002-B1 guard 2 — `key` is one of the permanently reserved legacy `posts` keys. */
-export declare class ReservedContentTypeKeyError extends Error {
+export declare class ReservedContentTypeKeyError extends ToolInputError {
     constructor(message: string);
 }
 /** CIC U-002-B1 guard 3 — a field name fails the identifier grammar gate. */
-export declare class InvalidFieldNameGrammarError extends Error {
+export declare class InvalidFieldNameGrammarError extends ToolInputError {
     constructor(message: string);
 }
 /** CIC U-001-B1 / U-002-B1 guard 4 — a field `kind` is not one of the closed field-kind enum. */
-export declare class InvalidFieldKindError extends Error {
+export declare class InvalidFieldKindError extends ToolInputError {
     constructor(message: string);
 }
 /**
@@ -64,7 +80,7 @@ export declare class StorageOnlyFieldNotQueryableError extends InvalidFieldKindE
  * `violation.received` names the offending value's TYPE, never the value — a field payload can
  * carry operator content, and this message reaches both an HTTP client and a model.
  */
-export declare class InvalidFieldShapeError extends Error {
+export declare class InvalidFieldShapeError extends ToolInputError {
     readonly code: "VALIDATION_ERROR";
     readonly violation: {
         path: string;
@@ -78,18 +94,31 @@ export declare class InvalidFieldShapeError extends Error {
     });
 }
 /** CIC U-002-B1 guard 5 — more than the per-type cap of `queryable` fields were submitted. */
-export declare class QueryableFieldCapExceededError extends Error {
+export declare class QueryableFieldCapExceededError extends ToolInputError {
     constructor(message: string);
 }
 /** CIC U-004-B1 — `expectedVersion` did not match the current row's version (OCC conflict). */
-export declare class VersionConflictError extends Error {
+export declare class VersionConflictError extends ToolInputError {
     constructor(message: string);
 }
-export declare class ContentTypeNotFoundError extends Error {
+export declare class ContentTypeNotFoundError extends ToolInputError {
     constructor(message: string);
 }
+/**
+ * Row 7 (web-high fix plan, 2026-09-24) — `registerContentType` loaded no existing row before
+ * saving, so two concurrent first-widget creates (or a caller retrying an existing key) could
+ * silently overwrite the current fields, and registering a tombstoned key could resurrect it
+ * (INV-06 forbids any transition out of tombstone, including via a fresh register). Thrown when
+ * `deps.repo.findByKey` already returns a row for the key, whether that row is active/deprecated
+ * or tombstoned — `tombstoned` distinguishes the two so a caller/HTTP route can give the right
+ * guidance (retry with update-fields, vs. the key is permanently gone).
+ */
+export declare class ContentTypeAlreadyExistsError extends ToolInputError {
+    readonly tombstoned: boolean;
+    constructor(key: string, tombstoned: boolean);
+}
 /** A generic validation rejection carrying a stable machine-readable `details.reason`. */
-export declare class ValidationError extends Error {
+export declare class ValidationError extends ToolInputError {
     readonly code: "VALIDATION_ERROR";
     readonly details: {
         reason: string;
@@ -97,7 +126,7 @@ export declare class ValidationError extends Error {
     constructor(message: string, reason: string);
 }
 /** REQ-09..12 lifecycle state-machine guard rejection (INV-06 terminal-tombstone, EC-09 deprecate-first). */
-export declare class ContentTypeLifecycleError extends Error {
+export declare class ContentTypeLifecycleError extends ToolInputError {
     constructor(message: string);
 }
 /** REQ-20 `planCleanup` eligibility-gate rejection; `reason` is one of a closed, ordered set. */

package/dist/content-types/errors.js

@@ -1,3 +1,4 @@
+import { ToolInputError } from "@jini-ai/core";
 /**
  * @file Typed error surface for the `content-types` package.
  *
@@ -10,38 +11,53 @@
  * the constructor sets `this.name` explicitly (confirmed empirically in Session 2 of this
  * workstream) — every class below sets it.
  *
+ * Every class the five wired agent tools (`define`/`update_fields`/`deprecate`/`reactivate`/
+ * `tombstone`) can actually throw extends `ToolInputError` (`@jini-ai/core`), not plain `Error` —
+ * mirroring `core/entity-liveness.ts`'s `EntityNotLiveError` (see its file header for the full
+ * rationale). Without that, `write-service.ts`/`lifecycle.ts` return these via a `Result` that
+ * `tool-registrations.ts`'s `fromResult` re-throws unwrapped, `@jini-ai/daemon`'s `ToolExecutor`
+ * sees a plain `Error` it cannot distinguish from a genuine internal fault, and every HTTP-facing
+ * mapping of that failure (`@jini-ai/http-kit`'s `delegated-tools.ts`) redacts it to a 500
+ * `INTERNAL_ERROR` — so a model calling `collections_content_type_define` on a key that already
+ * exists never sees "use collections_content_type_update_fields", only an opaque failure it cannot
+ * act on. `CleanupNotEligibleError` is the one exception: `collections_plan_cleanup`/
+ * `collections_execute_cleanup` are declared but not yet wired to any handler
+ * (`tool-registrations.ts`'s `UNWIRED_CONTENT_TYPES_TOOL_IDS`), so nothing reaches a model through
+ * it today — left as plain `Error` until that wiring exists and it can be verified the same way.
+ *
  * Architectural role:
- * `features/content-types` domain logic. No dependencies.
+ * `features/content-types` domain logic. Depends on `@jini-ai/core` only for the `ToolInputError`
+ * marker above.
  */
-export class ForbiddenError extends Error {
+export class ForbiddenError extends ToolInputError {
     constructor(message) {
         super(message);
         this.name = "ForbiddenError";
     }
 }
 /** CIC U-002-B1 guard 1 — `key`/field-name grammar gate `^[a-z][a-z0-9_]{0,63}$` (U-001-B2). */
-export class InvalidKeyGrammarError extends Error {
+export class InvalidKeyGrammarError extends ToolInputError {
     constructor(message) {
         super(message);
         this.name = "InvalidKeyGrammarError";
     }
 }
 /** CIC U-002-B1 guard 2 — `key` is one of the permanently reserved legacy `posts` keys. */
-export class ReservedContentTypeKeyError extends Error {
+export class ReservedContentTypeKeyError extends ToolInputError {
     constructor(message) {
         super(message);
         this.name = "ReservedContentTypeKeyError";
     }
 }
 /** CIC U-002-B1 guard 3 — a field name fails the identifier grammar gate. */
-export class InvalidFieldNameGrammarError extends Error {
+export class InvalidFieldNameGrammarError extends ToolInputError {
     constructor(message) {
         super(message);
         this.name = "InvalidFieldNameGrammarError";
     }
 }
 /** CIC U-001-B1 / U-002-B1 guard 4 — a field `kind` is not one of the closed field-kind enum. */
-export class InvalidFieldKindError extends Error {
+export class InvalidFieldKindError extends ToolInputError {
     constructor(message) {
         super(message);
         this.name = "InvalidFieldKindError";
@@ -82,7 +98,7 @@ export class StorageOnlyFieldNotQueryableError extends InvalidFieldKindError {
  * `violation.received` names the offending value's TYPE, never the value — a field payload can
  * carry operator content, and this message reaches both an HTTP client and a model.
  */
-export class InvalidFieldShapeError extends Error {
+export class InvalidFieldShapeError extends ToolInputError {
     code = "VALIDATION_ERROR";
     violation;
     constructor(violation) {
@@ -92,27 +108,46 @@ export class InvalidFieldShapeError extends Error {
     }
 }
 /** CIC U-002-B1 guard 5 — more than the per-type cap of `queryable` fields were submitted. */
-export class QueryableFieldCapExceededError extends Error {
+export class QueryableFieldCapExceededError extends ToolInputError {
     constructor(message) {
         super(message);
         this.name = "QueryableFieldCapExceededError";
     }
 }
 /** CIC U-004-B1 — `expectedVersion` did not match the current row's version (OCC conflict). */
-export class VersionConflictError extends Error {
+export class VersionConflictError extends ToolInputError {
     constructor(message) {
         super(message);
         this.name = "VersionConflictError";
     }
 }
-export class ContentTypeNotFoundError extends Error {
+export class ContentTypeNotFoundError extends ToolInputError {
     constructor(message) {
         super(message);
         this.name = "CONTENT_TYPE_NOT_FOUND";
     }
 }
+/**
+ * Row 7 (web-high fix plan, 2026-09-24) — `registerContentType` loaded no existing row before
+ * saving, so two concurrent first-widget creates (or a caller retrying an existing key) could
+ * silently overwrite the current fields, and registering a tombstoned key could resurrect it
+ * (INV-06 forbids any transition out of tombstone, including via a fresh register). Thrown when
+ * `deps.repo.findByKey` already returns a row for the key, whether that row is active/deprecated
+ * or tombstoned — `tombstoned` distinguishes the two so a caller/HTTP route can give the right
+ * guidance (retry with update-fields, vs. the key is permanently gone).
+ */
+export class ContentTypeAlreadyExistsError extends ToolInputError {
+    tombstoned;
+    constructor(key, tombstoned) {
+        super(tombstoned
+            ? `content type '${key}' was permanently deleted; its key can't be reused (INV-06)`
+            : `content type '${key}' already exists; use collections_content_type_update_fields to change its fields`);
+        this.name = "ContentTypeAlreadyExistsError";
+        this.tombstoned = tombstoned;
+    }
+}
 /** A generic validation rejection carrying a stable machine-readable `details.reason`. */
-export class ValidationError extends Error {
+export class ValidationError extends ToolInputError {
     code = "VALIDATION_ERROR";
     details;
     constructor(message, reason) {
@@ -122,7 +157,7 @@ export class ValidationError extends Error {
     }
 }
 /** REQ-09..12 lifecycle state-machine guard rejection (INV-06 terminal-tombstone, EC-09 deprecate-first). */
-export class ContentTypeLifecycleError extends Error {
+export class ContentTypeLifecycleError extends ToolInputError {
     constructor(message) {
         super(message);
         this.name = "ContentTypeLifecycleError";

package/dist/content-types/index.d.ts

@@ -30,7 +30,7 @@ export { ForbiddenError, InvalidKeyGrammarError, ReservedContentTypeKeyError, In
  * carries the parent maps this to the same `400 VALIDATION_ERROR` with no change. Catch it by
  * name only if the finer distinction matters.
  */
-StorageOnlyFieldNotQueryableError, InvalidFieldShapeError, QueryableFieldCapExceededError, VersionConflictError, ContentTypeNotFoundError, ValidationError, ContentTypeLifecycleError, CleanupNotEligibleError, } from "./errors.js";
+StorageOnlyFieldNotQueryableError, InvalidFieldShapeError, QueryableFieldCapExceededError, VersionConflictError, ContentTypeNotFoundError, ContentTypeAlreadyExistsError, ValidationError, ContentTypeLifecycleError, CleanupNotEligibleError, } from "./errors.js";
 /**
  * The queryable-field index machinery. `IDENTIFIER_GRAMMAR_PATTERN` is exported because it is the
  * single definition of the identifier grammar — the published agent-tool schemas reference it

package/dist/content-types/index.js

@@ -20,7 +20,7 @@ export { ForbiddenError, InvalidKeyGrammarError, ReservedContentTypeKeyError, In
  * carries the parent maps this to the same `400 VALIDATION_ERROR` with no change. Catch it by
  * name only if the finer distinction matters.
  */
-StorageOnlyFieldNotQueryableError, InvalidFieldShapeError, QueryableFieldCapExceededError, VersionConflictError, ContentTypeNotFoundError, ValidationError, ContentTypeLifecycleError, CleanupNotEligibleError, } from "./errors.js";
+StorageOnlyFieldNotQueryableError, InvalidFieldShapeError, QueryableFieldCapExceededError, VersionConflictError, ContentTypeNotFoundError, ContentTypeAlreadyExistsError, ValidationError, ContentTypeLifecycleError, CleanupNotEligibleError, } from "./errors.js";
 export { IDENTIFIER_GRAMMAR_PATTERN, validateIdentifierGrammar, mapFieldKindToCast, buildQueryableFieldIndexName, resolveFieldIndexTransition, } from "./index-provisioning.js";
 export { registerContentType, updateContentTypeFields } from "./write-service.js";
 export { deprecateContentType, reactivateContentType, tombstoneContentType, } from "./lifecycle.js";

package/dist/content-types/write-service.js

@@ -1,4 +1,5 @@
-import { ContentTypeNotFoundError, ForbiddenError, InvalidFieldKindError, InvalidFieldNameGrammarError, InvalidKeyGrammarError, QueryableFieldCapExceededError, ReservedContentTypeKeyError, StorageOnlyFieldNotQueryableError, ValidationError, VersionConflictError, } from "./errors.js";
+import { EntityNotLiveError } from "../core/entity-liveness.js";
+import { ContentTypeAlreadyExistsError, ContentTypeNotFoundError, ForbiddenError, InvalidFieldKindError, InvalidFieldNameGrammarError, InvalidKeyGrammarError, QueryableFieldCapExceededError, ReservedContentTypeKeyError, StorageOnlyFieldNotQueryableError, ValidationError, VersionConflictError, } from "./errors.js";
 import { resolveFieldIndexTransition, validateIdentifierGrammar } from "./index-provisioning.js";
 import { isContentTypeFieldKind, isIndexableFieldKind, } from "./types.js";
 /** Reserved forever for the legacy `posts` table — an operator Collection can never take these keys. */
@@ -84,6 +85,12 @@ export async function registerContentType(required) {
     if (countQueryableFields(input.fields) > QUERYABLE_FIELD_CAP) {
         return { ok: false, error: new QueryableFieldCapExceededError(`content type '${input.key}' submits more than ${QUERYABLE_FIELD_CAP} queryable fields`) };
     }
+    // Row 7 — a pre-check outside the transaction. Not race-safe by itself (that's the in-tx check
+    // below), but it avoids opening a transaction for the overwhelmingly common not-found case.
+    const existingBeforeTx = await deps.repo.findByKey({ workspaceId: input.workspaceId, key: input.key });
+    if (existingBeforeTx) {
+        return { ok: false, error: new ContentTypeAlreadyExistsError(input.key, existingBeforeTx.status === "tombstone") };
+    }
     const now = deps.clock.nowIso();
     const contentType = {
         workspaceId: input.workspaceId,
@@ -94,22 +101,37 @@ export async function registerContentType(required) {
         version: 1,
         tombstonedAt: null,
     };
-    await deps.repo.transaction(async () => {
-        await deps.repo.save(contentType);
-        await deps.repo.appendRevision({
-            contentTypeKey: input.key,
-            workspaceId: input.workspaceId,
-            op: "register",
-            stateJson: contentType,
-            actorId: input.actorId,
-            principalKind: input.principalKind ?? null,
-            delegatedByWorkspaceId: input.delegatedByWorkspaceId ?? null,
-            delegatedById: input.delegatedById ?? null,
-            recordedAt: now,
+    try {
+        await deps.repo.transaction(async () => {
+            // The check that actually closes the race: two concurrent first-widget creates both see the
+            // pre-check above return null, but only one of them can win this in-tx re-check before save.
+            const existingInTx = await deps.repo.findByKey({ workspaceId: input.workspaceId, key: input.key });
+            if (existingInTx) {
+                throw new ContentTypeAlreadyExistsError(input.key, existingInTx.status === "tombstone");
+            }
+            await deps.repo.save(contentType);
+            await deps.repo.appendRevision({
+                contentTypeKey: input.key,
+                workspaceId: input.workspaceId,
+                op: "register",
+                stateJson: contentType,
+                actorId: input.actorId,
+                principalKind: input.principalKind ?? null,
+                delegatedByWorkspaceId: input.delegatedByWorkspaceId ?? null,
+                delegatedById: input.delegatedById ?? null,
+                recordedAt: now,
+            });
+            if (deps.watermark)
+                await deps.watermark.stampWatermark({ workspaceId: input.workspaceId });
         });
-        if (deps.watermark)
-            await deps.watermark.stampWatermark({ workspaceId: input.workspaceId });
-    });
+    }
+    catch (err) {
+        if (err instanceof ContentTypeAlreadyExistsError)
+            return { ok: false, error: err };
+        throw err;
+    }
+    // Index provisioning runs only once the transaction has committed a new row — never on the
+    // already-exists path above.
     await deps.indexProvisioner.provisionIndexesForNewContentType({
         workspaceId: input.workspaceId,
         contentTypeKey: input.key,
@@ -140,6 +162,12 @@ export async function updateContentTypeFields(required) {
     if (!current) {
         return { ok: false, error: new ContentTypeNotFoundError(`content type '${input.key}' was not found in workspace '${input.workspaceId}'`) };
     }
+    // Row 15's sibling — a tombstoned type is terminal (INV-06); this check runs before the version
+    // check so a stale-version update against a tombstoned row still reports "tombstoned", not
+    // "version conflict" (the tombstone tore down every queryable index, so the schema is moot).
+    if (current.status === "tombstone") {
+        return { ok: false, error: new EntityNotLiveError("content type", input.key, "tombstoned") };
+    }
     // U-004-B1: expectedVersion checked FIRST — before fields_empty, before any per-field guard.
     if (input.expectedVersion !== current.version) {
         return { ok: false, error: new VersionConflictError(`expected version ${input.expectedVersion} for content type '${input.key}', found ${current.version}`) };

package/dist/media/media-service.js

@@ -51,6 +51,7 @@
  * bespoke `MediaRecord` table in place of a generic-entries model.
  */
 import { createHash } from "node:crypto";
+import { assertEntityLive } from "../core/entity-liveness.js";
 import { MediaConflictError, MediaNotFoundError, MediaSourceImmutableError, MediaStillReferencedError, MediaValidationError, } from "./types.js";
 import { withSha256Lock } from "./blob-gc-lock.js";
 import { tombstoneBlobIfUnreferenced } from "./blob-gc.js";
@@ -457,6 +458,7 @@ export async function updateMediaMetadata(required, _optional = {}) {
     const existing = await deps.mediaRepo.findById({ workspaceId: input.workspaceId, id: input.id });
     if (!existing)
         throw new MediaNotFoundError(`media '${input.id}' was not found`);
+    assertEntityLive({ entityType: "media", entityId: input.id, state: existing.status === "trashed" ? "trashed" : "live" });
     if (input.width !== undefined && input.width !== null)
         assertPositiveIntegerOrThrow(input.width, "width");
     if (input.height !== undefined && input.height !== null)

package/dist/navigation/menu-service.d.ts

@@ -1,27 +1,3 @@
-/**
- * @file Write-service for the `navigation` library.
- *
- * Purpose:
- * Implements the menu mutation slice: create, whole-tree update (OCC), soft
- * delete → hard purge, and location assignment. Mirrors the host's `post`
- * feature style (required/optional param objects, typed errors, OCC via
- * `version`).
- *
- * How it relates to the project:
- * - Storage is `MenuRepoPort` (`repo.memory.ts`) — a self-contained repo, not
- *   the generic entries repo (see `repo.memory.ts`'s file header for why).
- * - Location assignment additionally writes `NavLocationBindingRepoPort`
- *   (`ports.ts`), the one real port this library declares.
- * - In production this whole module runs inside the command
- *   gateway/write chokepoint (same-transaction revision, attribution,
- *   `entry_refs` extraction). That gateway is not implemented as running code
- *   yet, so these functions are the chokepoint's future *contents*, called
- *   directly for now.
- *
- * Architectural role:
- * Feature logic only. No Express/route code, no direct SQL — everything goes
- * through the injected repo ports (`deps`).
- */
 import type { ClockPort, IdGeneratorPort, OutboxPort, UUID } from "../core/ports.js";
 import type { MenuRepoPort } from "./repo.memory.js";
 import type { NavLocationBindingRepoPort } from "./ports.js";

package/dist/navigation/menu-service.js

@@ -1,3 +1,28 @@
+/**
+ * @file Write-service for the `navigation` library.
+ *
+ * Purpose:
+ * Implements the menu mutation slice: create, whole-tree update (OCC), soft
+ * delete → hard purge, and location assignment. Mirrors the host's `post`
+ * feature style (required/optional param objects, typed errors, OCC via
+ * `version`).
+ *
+ * How it relates to the project:
+ * - Storage is `MenuRepoPort` (`repo.memory.ts`) — a self-contained repo, not
+ *   the generic entries repo (see `repo.memory.ts`'s file header for why).
+ * - Location assignment additionally writes `NavLocationBindingRepoPort`
+ *   (`ports.ts`), the one real port this library declares.
+ * - In production this whole module runs inside the command
+ *   gateway/write chokepoint (same-transaction revision, attribution,
+ *   `entry_refs` extraction). That gateway is not implemented as running code
+ *   yet, so these functions are the chokepoint's future *contents*, called
+ *   directly for now.
+ *
+ * Architectural role:
+ * Feature logic only. No Express/route code, no direct SQL — everything goes
+ * through the injected repo ports (`deps`).
+ */
+import { assertEntityLive } from "../core/entity-liveness.js";
 import { NAV_DOC_TYPE, } from "./types.js";
 // ---------------------------------------------------------------------------
 // Outbox event publication — each mutating function below
@@ -293,6 +318,7 @@ export async function updateMenuTree(required, optional = {}) {
     const existing = await deps.repo.findById({ workspaceId: input.workspaceId, id: input.id });
     if (!existing)
         throw new MenuNotFoundError(`menu '${input.id}' was not found`);
+    assertEntityLive({ entityType: "menu", entityId: input.id, state: existing.status === "trash" ? "trashed" : "live" });
     if (existing.version !== input.expectedVersion) {
         throw new MenuConflictError(`menu '${input.id}' was modified concurrently (expected version ${input.expectedVersion}, found ${existing.version})`);
     }
@@ -360,6 +386,7 @@ export async function assignLocation(required, _optional = {}) {
     const menu = await deps.repo.findById({ workspaceId: input.workspaceId, id: input.menuId });
     if (!menu)
         throw new MenuNotFoundError(`menu '${input.menuId}' was not found`);
+    assertEntityLive({ entityType: "menu", entityId: input.menuId, state: menu.status === "trash" ? "trashed" : "live" });
     const now = deps.clock.nowIso();
     const existingBinding = await deps.bindingRepo.findByLocation({
         workspaceId: input.workspaceId,

package/dist/navigation/tool-registrations.d.ts

@@ -1,14 +1,3 @@
-/**
- * @file Navigation's (Menus') half of the agent-tool authorization wiring: maps `agent-tools.ts`'s five
- * catalog entries onto `menu-service.ts`'s read/create/update/assign operations, as
- * `ToolRegistration`s. The entire catalog is wired — `deleteMenu` is deliberately absent from the
- * catalog rather than present-but-unwired; see `navigation/agent-tools.ts`'s own header.
- *
- * Authorization shape: like Media and unlike Forms/Identity/Widgets, `menu-service.ts`'s functions
- * perform NO internal `authorize()` call of their own — every admin HTTP route a host builds gates
- * inline. Every handler here does the same via the kit's `requireToolPermission`, which is the
- * single evaluation for these tools, located where the real route locates it.
- */
 import type { AuthorizeFn } from "../core/commands/command.js";
 import type { OutboxPort } from "../core/ports.js";
 import { type DerivedRiskByToolId, type ToolRegistration } from "../core/tools/registration-kit.js";

package/dist/navigation/tool-registrations.js

@@ -1,3 +1,15 @@
+/**
+ * @file Navigation's (Menus') half of the agent-tool authorization wiring: maps `agent-tools.ts`'s five
+ * catalog entries onto `menu-service.ts`'s read/create/update/assign operations, as
+ * `ToolRegistration`s. The entire catalog is wired — `deleteMenu` is deliberately absent from the
+ * catalog rather than present-but-unwired; see `navigation/agent-tools.ts`'s own header.
+ *
+ * Authorization shape: like Media and unlike Forms/Identity/Widgets, `menu-service.ts`'s functions
+ * perform NO internal `authorize()` call of their own — every admin HTTP route a host builds gates
+ * inline. Every handler here does the same via the kit's `requireToolPermission`, which is the
+ * single evaluation for these tools, located where the real route locates it.
+ */
+import { ToolInputError } from "@jini-ai/core";
 import { buildDomainRegistrations, indexCatalogById, requireInputRecord, requireNumber, requireString, requireToolPermission, withSchemaOnRejection, } from "../core/tools/registration-kit.js";
 import { menusAgentToolCatalog } from "./agent-tools.js";
 import { assignLocation, createMenu, MenuNotFoundError, MenuValidationError, updateMenuTree } from "./menu-service.js";
@@ -65,6 +77,9 @@ export function buildMenusRegistrations(routeDeps) {
         menus_create_menu: async (ctx) => {
             const input = requireInputRecord(ctx.input);
             await requireToolPermission(routeDeps, { principalId: ctx.principal.id, permission: "admin.menus.create", entityType: "menu" });
+            if (input.items !== undefined && !Array.isArray(input.items)) {
+                throw new ToolInputError("'items' must be an array of nav items");
+            }
             return withSchemaOnRejection({ toolId: "menus_create_menu", catalog: CATALOG_BY_ID, isShapeRejection: isMenusShapeRejection }, async () => {
                 const { menu } = await createMenu({
                     deps: menusDeps(routeDeps),

package/dist/taxonomy/content-lookup.d.ts

@@ -36,8 +36,14 @@ export interface ContentRecordLookupPort {
     }): Promise<{
         workspaceId: string;
         kind: string;
+        deletedAt?: string | null;
     } | null>;
 }
+/**
+ * Row 63 (web-high fix plan, 2026-09-24): a trashed post/page must refuse a term assign/unassign,
+ * not silently accept one — `assertEntityLive` throws `EntityNotLiveError` the moment `deletedAt`
+ * is set, before this ever returns a resolvable target to `write-service.ts`'s join guards.
+ */
 export declare function createPostBackedContentLookup(deps: {
     postRepo: ContentRecordLookupPort;
     workspaceId: string;

package/dist/taxonomy/content-lookup.js

@@ -1,9 +1,19 @@
+import { assertEntityLive } from "../core/entity-liveness.js";
 import { isContentTypeOnAllowList } from "./write-service.js";
+/**
+ * Row 63 (web-high fix plan, 2026-09-24): a trashed post/page must refuse a term assign/unassign,
+ * not silently accept one — `assertEntityLive` throws `EntityNotLiveError` the moment `deletedAt`
+ * is set, before this ever returns a resolvable target to `write-service.ts`'s join guards.
+ */
 export function createPostBackedContentLookup(deps) {
     return {
         async resolve({ contentId }) {
             const post = await deps.postRepo.findById({ workspaceId: deps.workspaceId, id: contentId });
-            return post ? { workspaceId: post.workspaceId, kind: post.kind } : null;
+            if (!post)
+                return null;
+            if (post.deletedAt)
+                assertEntityLive({ entityType: post.kind, entityId: contentId, state: "trashed" });
+            return { workspaceId: post.workspaceId, kind: post.kind };
         },
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/cms",
-  "version": "0.3.8",
+  "version": "0.3.9",
   "description": "Content-model capability for Jini-hosted products: framework-free contracts, ports, and domain services in `/core` and per-domain subpaths; Node-bound persistence adapters in `/server`.",
   "license": "Apache-2.0",
   "repository": {