@jini-ai/cms 0.5.4 → 0.5.6

package/dist/navigation/tool-registrations.d.ts

@@ -19,6 +19,11 @@ export interface MenusToolDeps {
     outbox: OutboxPort;
     menuRepo: MenuRepoPort;
     navLocationBindingRepo: NavLocationBindingRepoPort;
+    /**
+     * The host's raw-HTML permission (Tovu: `pages.edit_html`, the one HTML-mode forms use). A write
+     * carrying menu HTML is checked against it on top of the menu permission; unset, HTML menus are refused.
+     */
+    rawHtmlPermission?: string | undefined;
 }
 /**
  * This wiring layer's OWN risk classification, authored from what each handler below actually

package/dist/navigation/tool-registrations.js

@@ -15,6 +15,7 @@ import { buildDomainRegistrations, indexCatalogById, requireInputRecord, require
 import { requireToolPermission } from "../core/tools/index.js";
 import { menusAgentToolCatalog } from "./agent-tools.js";
 import { assignLocation, createMenu, MenuNotFoundError, MenuValidationError, updateMenuTree } from "./menu-service.js";
+import { isMenuHtmlAuthoring } from "./menu-html.js";
 const CATALOG_BY_ID = indexCatalogById({ catalog: menusAgentToolCatalog });
 /**
  * This wiring layer's OWN risk classification, authored from what each handler below actually
@@ -54,10 +55,30 @@ function toMenuToolView(menu) {
         title: menu.title,
         status: menu.status,
         items: JSON.parse(JSON.stringify(menu.doc.items)),
+        ...(menu.doc.mode !== undefined ? { mode: menu.doc.mode } : {}),
+        ...(menu.doc.html !== undefined ? { html: menu.doc.html } : {}),
         locations: [...menu.locations],
         version: menu.version,
     };
 }
+/** A write's HTML-mode fields as sent; `menu-service.ts` validates their values. */
+function htmlAuthoring(input) {
+    return {
+        ...(input.mode !== undefined ? { mode: input.mode } : {}),
+        ...(input.html !== undefined ? { html: input.html } : {}),
+    };
+}
+/**
+ * Raw HTML is the host's trust boundary (HTML Pages, HTML-mode forms), so a write that authors menu
+ * HTML also needs that permission. Checked before the write, like forms' `prepareFormAuthoring`.
+ */
+async function requireHtmlAuthoringPermission({ routeDeps, principalId, authoring, menuId }) {
+    if (!isMenuHtmlAuthoring(authoring))
+        return;
+    if (!routeDeps.rawHtmlPermission)
+        throw new ToolInputError({ message: "HTML menus are not enabled on this site" });
+    await requireToolPermission({ authorize: adaptLegacyAuthorize({ authorize: routeDeps.authorize }), workspaceId: routeDeps.workspaceId, principalId, permission: routeDeps.rawHtmlPermission }, { entityType: "menu", ...(menuId ? { entityId: menuId } : {}) });
+}
 function menusDeps(routeDeps) {
     return { repo: routeDeps.menuRepo, clock: routeDeps.clock, idGen: routeDeps.idGen, outbox: routeDeps.outbox };
 }
@@ -82,6 +103,8 @@ export function buildMenusRegistrations(routeDeps) {
             if (input.items !== undefined && !Array.isArray(input.items)) {
                 throw new ToolInputError({ message: "'items' must be an array of nav items" });
             }
+            const authoring = htmlAuthoring(input);
+            await requireHtmlAuthoringPermission({ routeDeps, principalId: ctx.principal.id, authoring });
             return withSchemaOnRejection({ toolId: "menus_create_menu", catalog: CATALOG_BY_ID, isShapeRejection: ({ error }) => isMenusShapeRejection(error), fn: async () => {
                     const { menu } = await createMenu({
                         deps: menusDeps(routeDeps),
@@ -90,6 +113,7 @@ export function buildMenusRegistrations(routeDeps) {
                             title: requireString({ input: input, key: "title" }),
                             slug: requireString({ input: input, key: "slug" }),
                             items: Array.isArray(input.items) ? input.items : undefined,
+                            ...authoring,
                         },
                     });
                     return { menu: toMenuToolView(menu) };
@@ -99,8 +123,13 @@ export function buildMenusRegistrations(routeDeps) {
             const input = requireInputRecord({ input: ctx.input });
             const menuId = requireString({ input: input, key: "menuId" });
             await requireToolPermission({ authorize: adaptLegacyAuthorize({ authorize: routeDeps.authorize }), workspaceId: routeDeps.workspaceId, principalId: ctx.principal.id, permission: "admin.menus.update" }, { entityType: "menu", entityId: menuId });
-            if (!Array.isArray(input.items))
-                throw new Error("'items' (array) is required");
+            const authoring = htmlAuthoring(input);
+            if (input.items === undefined && authoring.mode === undefined && authoring.html === undefined) {
+                throw new Error("'items' (array), 'html' or 'mode' is required");
+            }
+            if (input.items !== undefined && !Array.isArray(input.items))
+                throw new Error("'items' must be an array of nav items");
+            await requireHtmlAuthoringPermission({ routeDeps, principalId: ctx.principal.id, authoring, menuId });
             return withSchemaOnRejection({ toolId: "menus_update_menu_tree", catalog: CATALOG_BY_ID, isShapeRejection: ({ error }) => isMenusShapeRejection(error), fn: async () => {
                     const { menu } = await updateMenuTree({
                         deps: menusDeps(routeDeps),
@@ -111,6 +140,7 @@ export function buildMenusRegistrations(routeDeps) {
                             title: typeof input.title === "string" ? input.title : undefined,
                             slug: typeof input.slug === "string" ? input.slug : undefined,
                             items: input.items,
+                            ...authoring,
                         },
                     });
                     return { menu: toMenuToolView(menu) };

package/dist/navigation/types.d.ts

@@ -123,7 +123,13 @@ export interface NavMenuDoc {
     /** Doc-schema version, so the validator can migrate shapes later. */
     readonly version: number;
     readonly items: readonly NavItemNode[];
+    /** What renders at the menu's marker; absent means `"items"`. See `menu-html.ts`. */
+    readonly mode?: NavMenuMode | undefined;
+    /** Author-written HTML for `"html"` mode, kept even while the menu renders its items. */
+    readonly html?: string | undefined;
 }
+/** `"items"` renders the item tree; `"html"` renders the author's own markup (`menu-html.ts`). */
+export type NavMenuMode = "items" | "html";
 export type MenuStatus = "draft" | "published" | "trash";
 /**
  * A typed read model over a `type='menu'` entries row (universal

package/dist/redirects/capture.d.ts

@@ -55,6 +55,8 @@ export interface RedirectSlugChangeCaptureReadDeps {
     }, optional?: Record<string, never>): Promise<RedirectRecord | null>;
 }
 export interface RedirectSlugChangeCaptureDeps {
+    /** Optional for existing hosts; route-owning hosts supply their reserved segment policy. */
+    reservedSegments?: ReadonlySet<string>;
     repo: RedirectSlugChangeCaptureReadDeps;
     db: RedirectDbHandle;
     clock: ClockPort;

package/dist/redirects/capture.js

@@ -1,4 +1,5 @@
 import { nowIso as clockNowIso } from "@jini-ai/core/primitives";
+import { assertRedirectSourceAllowed } from "./redirects.js";
 import { insertRedirectAndRevision } from "./ports.internal.js";
 /** Default priority/statusCode/override for an auto-captured rule (behavior.spec.md §3 analog). */
 const AUTO_CAPTURE_STATUS_CODE = 301;
@@ -21,6 +22,9 @@ export class RedirectSlugChangeCapture {
      * @complexity O(1) — one read (idempotency check) + two writes.
      */
     async onSlugChange(input, _optional = {}) {
+        if (this.deps.reservedSegments) {
+            assertRedirectSourceAllowed({ fromPattern: input.oldPath, reservedSegments: this.deps.reservedSegments });
+        }
         const existing = await this.deps.repo.lookupExact({
             workspaceId: input.workspaceId,
             path: input.oldPath,

package/dist/redirects/redirects.d.ts

@@ -100,6 +100,14 @@ export interface RedirectsWriteDeps {
     idGen: IdGeneratorPort;
     outbox: OutboxPort;
 }
+/** Refuse source patterns whose decoded first segment belongs to a host route.
+ * Uses the same decoding and case folding as the target gate; wildcard tails remain patterns.
+ * @throws RedirectValidationError before any write. @complexity O(n) in the pattern length.
+ */
+export declare function assertRedirectSourceAllowed({ fromPattern, reservedSegments }: {
+    fromPattern: string;
+    reservedSegments: ReadonlySet<string>;
+}, _optional?: Record<string, never>): void;
 /**
  * The site-relative half of the write gate: routing's structural + reserved-path verdict, then the
  * redirect oracle's own raw-character rule. The read path hands a relative location to that oracle

package/dist/redirects/redirects.js

@@ -144,6 +144,16 @@ function siteRelativeRefusalReason(check) {
             return "it contains, or decodes to, a backslash or a control character";
     }
 }
+/** Refuse source patterns whose decoded first segment belongs to a host route.
+ * Uses the same decoding and case folding as the target gate; wildcard tails remain patterns.
+ * @throws RedirectValidationError before any write. @complexity O(n) in the pattern length.
+ */
+export function assertRedirectSourceAllowed({ fromPattern, reservedSegments }, _optional = {}) {
+    const verdict = checkSiteRelativeTarget({ raw: fromPattern, reservedSegments }, {});
+    if (verdict.kind === "reserved") {
+        throw new RedirectValidationError(`fromPattern '${fromPattern}' is reserved for the '${verdict.surface}' surface`);
+    }
+}
 /**
  * The site-relative half of the write gate: routing's structural + reserved-path verdict, then the
  * redirect oracle's own raw-character rule. The read path hands a relative location to that oracle
@@ -257,6 +267,7 @@ export async function checkRedirectFieldsWouldWrite({ deps, fields }, { excludeI
         validateToTargetLength(fields.toTarget);
         validateStatusCode(fields.statusCode);
         validatePriority(fields.priority);
+        assertRedirectSourceAllowed({ fromPattern: fields.fromPattern, reservedSegments: deps.reservedSegments });
         await assertTargetAllowed(deps.originRegistry, fields.workspaceId, fields.toTarget, deps.reservedSegments);
         const finalTarget = await resolveCollapsedTarget(deps.repo, fields.workspaceId, fields.fromPattern, fields.toTarget);
         if (finalTarget !== fields.toTarget) {
@@ -300,6 +311,7 @@ export async function createRedirect(required, _optional = {}) {
     validateStatusCode(input.statusCode);
     const priority = input.priority ?? DEFAULT_PRIORITY;
     validatePriority(priority);
+    assertRedirectSourceAllowed({ fromPattern: input.fromPattern, reservedSegments: deps.reservedSegments });
     await assertTargetAllowed(deps.originRegistry, input.workspaceId, input.toTarget, deps.reservedSegments);
     const finalTarget = await resolveCollapsedTarget(deps.repo, input.workspaceId, input.fromPattern, input.toTarget);
     if (finalTarget !== input.toTarget) {
@@ -411,6 +423,7 @@ async function validateUpdateFields(deps, workspaceId, fields, existingId) {
     validateStatusCode(fields.statusCode);
     validateStatus(fields.status);
     validatePriority(fields.priority);
+    assertRedirectSourceAllowed({ fromPattern: fields.fromPattern, reservedSegments: deps.reservedSegments });
     await assertTargetAllowed(deps.originRegistry, workspaceId, fields.toTarget, deps.reservedSegments);
     const finalTarget = await resolveCollapsedTarget(deps.repo, workspaceId, fields.fromPattern, fields.toTarget);
     if (finalTarget !== fields.toTarget) {
@@ -442,6 +455,7 @@ export async function updateRedirect(required, _optional = {}) {
         if (!isRestoreOnlyUpdate(input)) {
             assertEntityLive({ entityType: "redirect", entityId: input.id, state: "trashed" });
         }
+        assertRedirectSourceAllowed({ fromPattern: existing.fromPattern, reservedSegments: deps.reservedSegments });
         const outcome = await deps.restore({
             workspaceId: input.workspaceId,
             id: input.id,

package/dist/routing/index.d.ts

@@ -0,0 +1,5 @@
+export { createRouting, RouteResolutionError } from './routing.js';
+export type { CreateRoutingRequired, CreateRoutingOptional, EmptyOptions, Routing, IsActiveOptional, IsActiveRequired, RegisterNamedRouteInput, RegisterResolvePhaseOptions, ResolveInput, ResolveOptional, ResolveRequired, UrlForOptional, UrlForRequired } from './routing.js';
+export type { RouteResolverDeps, RoutingContentRecord, RoutingContentReadPort, RoutingPorts } from './ports.js';
+export type { EntryRefTarget, RouteRefTarget, RouteResolveContext, RouteResolvePhaseHandler, RouteResolvePhaseName, RouteResolvePhaseOutcome, RouteResolveResult, RouteTarget, RouteTargetKind, RouteUrl, SlugChangeCapture, SlugChangeCaptureInput, TermRefTarget, UrlTarget } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/routing/index.js

@@ -0,0 +1,2 @@
+export { createRouting, RouteResolutionError } from './routing.js';
+//# sourceMappingURL=index.js.map

package/dist/routing/ports.d.ts

@@ -0,0 +1,51 @@
+/**
+ * @file Dependency contracts for the Tovu `routing` Tier-2 library (ADR-039 v0).
+ *
+ * ADR-006 accounting (rule-of-two):
+ * - `routing` introduces NO new persistence port. Resolving an `entryRef`
+ *   target reuses the existing `PostRepoPort` (`src/features/post/post.ts`) —
+ *   `post` is the only content type implemented in this repo today. Inventing
+ *   a routing-owned repo for data that already has one would fail rule-of-two.
+ * - The named-route registry and the resolve-phase/`SlugChangeCapture`
+ *   registration slots are core-owned registration mechanisms (ADR-039 §1/§4),
+ *   NOT open ADR-009 plugin hooks and NOT ports — they are ordinary in-module
+ *   state with a typed register/get surface, same treatment ADR-029/ADR-032
+ *   give their single-evaluator resolvers.
+ *
+ * Architectural role:
+ * INTERFACES ONLY — no feature logic lives here.
+ */
+/** Minimal content projection; the host visibility owner evaluates publication, scheduling and Trash. */
+export interface RoutingContentRecord {
+    readonly slug: string;
+    readonly status: string;
+    readonly deletedAt?: string | null | undefined;
+    readonly publishAt?: string | null | undefined;
+}
+/** A projection of the existing content reader, not a new store or persistence owner. */
+export interface RoutingContentReadPort {
+    findById(required: {
+        workspaceId: string;
+        id: string;
+    }, optional?: Record<string, never>): Promise<RoutingContentRecord | null>;
+}
+/** Host-owned policy and operator channel. No implicit clock or console in generic routing. */
+export interface RoutingPorts {
+    isLive(required: {
+        post: RoutingContentRecord;
+    }, optional?: Record<string, never>): boolean;
+    reportPhaseError(required: {
+        message: string;
+        error: unknown;
+    }, optional?: Record<string, never>): void;
+}
+/**
+ * Dependencies `urlFor`/`isActive` need to resolve `entryRef` targets. Kept as
+ * its own named shape (rather than inlining `PostRepoPort` at each call site)
+ * so a future second content type's repo can be added here without changing
+ * every call site's required-object shape.
+ */
+export interface RouteResolverDeps {
+    readonly postRepo: RoutingContentReadPort;
+}
+//# sourceMappingURL=ports.d.ts.map

package/dist/routing/routing.d.ts

@@ -0,0 +1,138 @@
+/**
+ * @file Resolution logic for the Tovu `routing` Tier-2 library (ADR-039 v0).
+ *
+ * Purpose:
+ * Implements the inverse resolver (`urlFor`/`isActive`) Menus (ADR-029) and
+ * SEO (ADR-032) consume, the forward resolution pipeline registration seam
+ * Redirects (ADR-033) will consume, the named-route registry backing `route`
+ * targets, and the `SlugChangeCapture` registration slot (ADR-039 §4).
+ *
+ * How it relates to the project:
+ * - `routing/types.ts` supplies the `RouteTarget` vocabulary and result shapes.
+ * - `routing/ports.ts` supplies `RouteResolverDeps` (reuses `PostRepoPort`).
+ * - Only `post` is a real implemented content type today, so `entryRef`
+ *   resolution goes through `PostRepoPort` directly; `termRef` is a documented
+ *   stub (taxonomy doesn't exist yet — ADR-029 Round-3 fold item 1).
+ *
+ * Architectural role:
+ * Core-owned Tier-2 library code. No Drizzle/SQLite adapter and no HTTP
+ * wiring live here (that is out of scope for this v0 build) — this file is
+ * pure resolution logic over injected ports and in-module registries.
+ */
+import type { RouteResolverDeps, RoutingContentRecord, RoutingPorts } from './ports.js';
+import type { RouteResolveContext, RouteResolvePhaseHandler, RouteResolvePhaseName, RouteResolvePhaseOutcome, RouteResolveResult, RouteTarget, RouteUrl, SlugChangeCapture } from './types.js';
+/** Raised when a `RouteTarget` carries a discriminant this library does not recognize. */
+export declare class RouteResolutionError extends Error {
+}
+export interface RegisterNamedRouteInput {
+    readonly name: string;
+    readonly path: string;
+}
+export interface UrlForRequired {
+    deps: RouteResolverDeps;
+    target: RouteTarget;
+    ctx: RouteResolveContext;
+}
+export interface UrlForOptional {
+}
+export interface IsActiveRequired {
+    deps: RouteResolverDeps;
+    target: RouteTarget;
+    currentPath: string;
+    ctx: RouteResolveContext;
+}
+export interface IsActiveOptional {
+}
+export interface RegisterResolvePhaseOptions {
+    /**
+     * The registrant's identity. Registering under an owner that already holds
+     * handlers in this phase REPLACES them rather than appending, so a registrant
+     * whose handlers close over a per-boot resource (a site's database handle, a
+     * request-scoped client) cannot leave the previous boot's closures reachable.
+     *
+     * Omit it and the registration is appended and never superseded — the v0
+     * behavior this library's own tests still use.
+     */
+    readonly owner?: unknown;
+    /**
+     * This registration's fault policy when its handler throws. `"fail"` (the default) rethrows
+     * out of the phase, so the caller's own error handling runs (the public site routes answer
+     * `500 <h1>Site error</h1>`, on BOTH phases as of 2026-09-16, t91 F4.3-A: `post_content` on
+     * `GET /:slug` used to leave a default-policy throw with no response at all — see
+     * `routes/site/pages.ts`'s `handlePostNotFoundInSlugCatch`). `"skip"` logs `[routing] a <phase>
+     * resolver failed for <path> — skipping it` and continues to the phase's remaining handlers.
+     *
+     * Choose `"skip"` only for a handler whose failure can only DECLINE an outcome — it can never
+     * fabricate one, so a swallowed failure cannot weaken any guard. Redirects opts into it for
+     * exactly that reason (INV-03: a lookup failure means "no redirect", never "gone"). A future
+     * guard-type handler (a takedown or reserved-path check, which must BLOCK on failure, not wave
+     * a request through) fails CLOSED by default unless it deliberately opts into `"skip"` too.
+     */
+    readonly onError?: "skip" | "fail";
+}
+export interface ResolveInput {
+    path: string;
+    ctx: RouteResolveContext;
+}
+export interface ResolveRequired {
+    input: ResolveInput;
+}
+export interface ResolveOptional {
+}
+export type EmptyOptions = Record<string, never>;
+export interface CreateRoutingRequired {
+    readonly ports: RoutingPorts;
+}
+export interface CreateRoutingOptional {
+    readonly namedRoutes?: ReadonlyArray<readonly [string, string]>;
+}
+/** Bound routing API. All methods share one instance's registrations and host ports. */
+export interface Routing {
+    entryPublicPath(required: {
+        post: RoutingContentRecord;
+        ctx: RouteResolveContext;
+    }, optional?: EmptyOptions): RouteUrl | null;
+    postPublicPath(required: {
+        slug: string;
+    }, optional?: EmptyOptions): string;
+    getNamedRoute(required: {
+        name: string;
+    }, optional?: EmptyOptions): string | null;
+    registerNamedRoute(required: RegisterNamedRouteInput, optional?: EmptyOptions): void;
+    urlFor(required: UrlForRequired, optional?: UrlForOptional): Promise<RouteUrl | null>;
+    isActive(required: IsActiveRequired, optional?: IsActiveOptional): Promise<boolean>;
+    resolve(required: ResolveRequired, optional?: ResolveOptional): Promise<RouteResolveResult>;
+    registerResolvePhase(required: {
+        phase: RouteResolvePhaseName;
+        resolver: RouteResolvePhaseHandler;
+    }, optional?: RegisterResolvePhaseOptions): () => void;
+    unregisterResolvePhaseOwner(required: {
+        owner: unknown;
+    }, optional?: EmptyOptions): void;
+    runPreContentPhase(required: {
+        path: string;
+        ctx: RouteResolveContext;
+    }, optional?: EmptyOptions): Promise<RouteResolvePhaseOutcome | null>;
+    runPostContentPhase(required: {
+        path: string;
+        ctx: RouteResolveContext;
+    }, optional?: EmptyOptions): Promise<RouteResolvePhaseOutcome | null>;
+    registerSlugChangeCapture(required: {
+        impl: SlugChangeCapture;
+    }, optional?: EmptyOptions): () => void;
+    getSlugChangeCapture(required: EmptyOptions, optional?: EmptyOptions): SlugChangeCapture | undefined;
+    /** Test-only reset of this instance; never resets another instance's registrations. */
+    resetRoutingRegistrationsForTests(required: EmptyOptions, optional?: EmptyOptions): void;
+}
+/**
+ * Create routing over host-owned content visibility and fault reporting.
+ * Each instance owns its registrations; a host that historically shared one process registry
+ * must bind one instance and reuse it across composition roots. No database or clock is constructed.
+ * @param required Host ports; visibility errors propagate unchanged.
+ * @param optional Initial named-route configuration (home/search by default).
+ * @returns Resolvers and registration lifecycles sharing this instance's state.
+ * @complexity O(r) initialization for r configured named routes.
+ * @example const routing = createRouting({ ports }, { namedRoutes: [['home', '/']] });
+ */
+export declare function createRouting(required: CreateRoutingRequired, optional?: CreateRoutingOptional): Routing;
+//# sourceMappingURL=routing.d.ts.map