@jini-ai/cms 0.5.5 → 0.5.6

package/dist/media/image-transformer.sharp.js

@@ -151,7 +151,10 @@ export class SharpImageTransformer {
                     fit: input.params.fit ?? "cover",
                 });
             }
-            pipeline = pipeline.toFormat(input.params.format);
+            // JPEG cannot carry alpha; explicit white avoids libvips' black background for logos.
+            if (input.params.format === "jpeg")
+                pipeline = pipeline.flatten({ background: "#ffffff" });
+            pipeline = pipeline.toFormat(input.params.format, input.params.quality === undefined ? undefined : { quality: input.params.quality });
             const outBuffer = await pipeline.toBuffer();
             return {
                 bytes: new Uint8Array(outBuffer),

package/dist/media/media-service.d.ts

@@ -27,6 +27,10 @@ export declare const DEFAULT_MAX_UPLOAD_BYTES: number;
  * `routes/site/media-rendition.ts`). This widens the SAME advisory,
  * client-declared-string check item 4 above already discloses as untrusted —
  * no new ingress hardening was added for video.
+ *
+ * Audio (owner-approved mediawidget, 2026-10-10/11) follows that same original-byte
+ * lifecycle. Only formats recognized by the shared sniffer are allowed; no image
+ * transform is requested for them.
  */
 export declare const DEFAULT_ALLOWED_MIME_TYPES: ReadonlySet<string>;
 /**

package/dist/media/media-service.js

@@ -100,6 +100,10 @@ function formatMaxUploadBytesAsMb(bytes) {
  * `routes/site/media-rendition.ts`). This widens the SAME advisory,
  * client-declared-string check item 4 above already discloses as untrusted —
  * no new ingress hardening was added for video.
+ *
+ * Audio (owner-approved mediawidget, 2026-10-10/11) follows that same original-byte
+ * lifecycle. Only formats recognized by the shared sniffer are allowed; no image
+ * transform is requested for them.
  */
 export const DEFAULT_ALLOWED_MIME_TYPES = new Set([
     "image/jpeg",
@@ -109,6 +113,10 @@ export const DEFAULT_ALLOWED_MIME_TYPES = new Set([
     "image/avif",
     "video/mp4",
     "video/webm",
+    "audio/wav",
+    "audio/mpeg",
+    "audio/flac",
+    "audio/mp4",
 ]);
 /**
  * Enforces the "settable-once-from-absent" write-once rule for

package/dist/media/node.d.ts

@@ -1,5 +1,5 @@
 /** Node-bound media adapters; hosts supply the filesystem and optional codecs. */
 export { LocalFsBlobStore, type LocalFsBlobStoreDeps } from "./blob-store.fs.js";
 export { SharpImageTransformer, ImageTransformUnavailableError, ImageSourceCorruptError } from "./image-transformer.sharp.js";
-export { createFfmpegVideoFrameExtractor, findVideoBinaries, runLowPriorityVideoProcess, type VideoBinaries, type VideoBinaryFinder, type VideoProcessRunner, } from './video-frames.ffmpeg.js';
+export { createFfmpegVideoFrameExtractor, createVideoExtractionLock, findVideoBinaries, runLowPriorityVideoProcess, type VideoExtractionLock, type VideoBinaries, type VideoBinaryFinder, type VideoProcessRunner, } from './video-frames.ffmpeg.js';
 //# sourceMappingURL=node.d.ts.map

package/dist/media/node.js

@@ -2,5 +2,5 @@
 export { LocalFsBlobStore } from "./blob-store.fs.js";
 export { SharpImageTransformer, ImageTransformUnavailableError, ImageSourceCorruptError } from "./image-transformer.sharp.js";
 // Video previews: policy/port plus a bounded optional-host codec adapter.
-export { createFfmpegVideoFrameExtractor, findVideoBinaries, runLowPriorityVideoProcess, } from './video-frames.ffmpeg.js';
+export { createFfmpegVideoFrameExtractor, createVideoExtractionLock, findVideoBinaries, runLowPriorityVideoProcess, } from './video-frames.ffmpeg.js';
 //# sourceMappingURL=node.js.map

package/dist/media/transform-registry.js

@@ -26,7 +26,7 @@ export async function registerTransform(required, _optional = {}) {
     const owner = input.owner.trim();
     if (!owner)
         throw new TransformValidationError({ message: "owner is required" });
-    assertValidTransformParams({ format: input.params.format }, { width: input.params.width, height: input.params.height, fit: input.params.fit });
+    assertValidTransformParams({ format: input.params.format }, { width: input.params.width, height: input.params.height, fit: input.params.fit, quality: input.params.quality });
     return withTransformRegistryLock({ key: `${input.workspaceId}:${name}`, criticalSection: async () => {
             const existingVersions = await deps.transformRepo.listByName({ workspaceId: input.workspaceId, name });
             const currentMaxVersion = existingVersions.reduce((max, row) => Math.max(max, row.version), 0);

package/dist/media/transform-types.d.ts

@@ -41,6 +41,8 @@ export interface TransformParams {
     height?: number | undefined;
     fit?: TransformFit | undefined;
     format: TransformFormat;
+    /** Encoder quality, 1–100; omitted preserves the codec default. */
+    quality?: number | undefined;
 }
 /**
  * `transform_registry` sidecar row. Identity is

package/dist/media/transform-types.js

@@ -45,6 +45,9 @@ export function assertValidTransformParams(required, optional = {}) {
             throw new TransformValidationError({ message: `transform params.${key} must be an integer between 1 and ${MAX_TRANSFORM_DIMENSION_PX}` });
         }
     }
+    if (params.quality !== undefined && (!Number.isInteger(params.quality) || params.quality < 1 || params.quality > 100)) {
+        throw new TransformValidationError({ message: "transform params.quality must be an integer between 1 and 100" });
+    }
     if (params.fit !== undefined && !(params.width && params.height)) {
         throw new TransformValidationError({ message: "transform params.fit requires both width and height" });
     }

package/dist/media/video-frames.ffmpeg.d.ts

@@ -5,7 +5,10 @@ export interface VideoBinaries {
     readonly ffmpeg: string;
     readonly ffprobe: string;
 }
-export type VideoBinaryFinder = (required: Record<string, never>, optional: Record<string, never>) => Promise<VideoBinaries | undefined>;
+export type VideoBinaryFinder = (required: Record<string, never>, optional: {
+    env?: NodeJS.ProcessEnv;
+    platform?: NodeJS.Platform;
+}) => Promise<VideoBinaries | undefined>;
 export type VideoProcessRunner = (required: {
     command: string;
     args: readonly string[];
@@ -31,7 +34,17 @@ export declare const runLowPriorityVideoProcess: ({ command, args, spawnProcess,
     maxOutputBytes: number;
     signal?: AbortSignal;
 }) => Promise<Uint8Array>;
-export declare function createFfmpegVideoFrameExtractor({ findBinaries, runProcess, nowMs }: {
+export interface VideoExtractionLock {
+    /** Synchronous acquisition prevents races before the first awaited probe. */
+    tryAcquire(required: Record<string, never>, optional: Record<string, never>): (() => void) | undefined;
+}
+/** A host may share this lock across its adapters to enforce a decoder budget.
+ * Returns a synchronous try-acquire port; release follows decoder cleanup. @complexity O(1). */
+export declare function createVideoExtractionLock(_required: Record<string, never>, _optional?: Record<string, never>): VideoExtractionLock;
+export declare function createFfmpegVideoFrameExtractor({ findBinaries, runProcess, nowMs, lock, env, platform }: {
+    lock?: VideoExtractionLock;
+    env?: NodeJS.ProcessEnv;
+    platform?: NodeJS.Platform;
     findBinaries?: VideoBinaryFinder;
     runProcess?: VideoProcessRunner;
     nowMs?: (required: Record<string, never>, optional: Record<string, never>) => number;

package/dist/media/video-frames.ffmpeg.js

@@ -13,9 +13,9 @@ class VideoProcessError extends Error {
         this.reason = reason;
     }
 }
-async function executable(required, { configured } = {}) {
+async function executable(required, { configured, env = process.env } = {}) {
     const candidates = configured ? [configured] : [
-        ...(process.env['PATH'] ?? '').split(delimiter).filter(isAbsolute).map(directory => join(directory, required.name)),
+        ...(env['PATH'] ?? '').split(delimiter).filter(isAbsolute).map(directory => join(directory, required.name)),
         join('/opt/homebrew/bin', required.name), join('/usr/local/bin', required.name), join('/usr/bin', required.name),
     ];
     for (const candidate of candidates) {
@@ -32,12 +32,12 @@ async function executable(required, { configured } = {}) {
 }
 /** Discovery never executes a version/probe command. Configured paths are host configuration,
  * never tool arguments, and all subprocesses (including ffprobe) still go through nice. */
-export const findVideoBinaries = async (_required, _optional) => {
-    if (process.platform === 'win32')
+export const findVideoBinaries = async (_required, { env = process.env, platform = process.platform } = {}) => {
+    if (platform === 'win32')
         return undefined; // Never silently omit the low-priority guarantee.
-    const nice = await executable({ name: 'nice' }, {});
-    const ffmpeg = await executable({ name: 'ffmpeg' }, { configured: process.env['FFMPEG_PATH'] });
-    const ffprobe = await executable({ name: 'ffprobe' }, { configured: process.env['FFPROBE_PATH'] });
+    const nice = await executable({ name: 'nice' }, { env });
+    const ffmpeg = await executable({ name: 'ffmpeg' }, { configured: env['FFMPEG_PATH'], env });
+    const ffprobe = await executable({ name: 'ffprobe' }, { configured: env['FFPROBE_PATH'], env });
     return nice && ffmpeg && ffprobe ? { nice, ffmpeg, ffprobe } : undefined;
 };
 /** detached creates a group including nice and its eventual executable; killing the group prevents
@@ -99,25 +99,40 @@ export const runLowPriorityVideoProcess = async ({ command, args, spawnProcess =
             abort();
     });
 };
+/** A host may share this lock across its adapters to enforce a decoder budget.
+ * Returns a synchronous try-acquire port; release follows decoder cleanup. @complexity O(1). */
+export function createVideoExtractionLock(_required, _optional = {}) {
+    let extracting = false;
+    return { tryAcquire() {
+            if (extracting)
+                return undefined;
+            extracting = true;
+            let released = false;
+            return () => { if (!released) {
+                released = true;
+                extracting = false;
+            } };
+        } };
+}
 // Shared across ALL adapter instances: a second catalog/tenant cannot run a second ffmpeg in this
 // process. Fail busy instead of holding arbitrary numbers of uploaded videos in a pending queue.
-let extracting = false;
+const defaultExtractionLock = createVideoExtractionLock({});
 const UNAVAILABLE = 'video preview unavailable on this host (nice, ffmpeg and ffprobe are required).';
 // Eight amortizes process/seek overhead while bounding expensive source decoders to
 // one eighth of the 64-frame maximum. Thread caps alone do not bound decoder memory.
 // This is a decoder-count limit, not a measured host RSS guarantee.
 const SOURCE_BATCH_SIZE = 8;
 const localInputFlags = ['-threads', '1', '-protocol_whitelist', 'file', '-format_whitelist', 'mov,matroska,webm'];
-export function createFfmpegVideoFrameExtractor({ findBinaries = findVideoBinaries, runProcess = runLowPriorityVideoProcess, nowMs = () => performance.now() }, _optional = {}) {
+export function createFfmpegVideoFrameExtractor({ findBinaries = findVideoBinaries, runProcess = runLowPriorityVideoProcess, nowMs = () => performance.now(), lock = defaultExtractionLock, env, platform }, _optional = {}) {
     return { extract: async ({ bytes }, options) => {
             if (bytes.byteLength > VIDEO_MAX_INPUT_BYTES)
                 return { ok: false, reason: 'too-large', message: `Video preview input exceeds ${VIDEO_MAX_INPUT_BYTES} bytes.` };
             const type = sniffContentType({ bytes });
             if (type !== 'video/mp4' && type !== 'video/webm')
                 return { ok: false, reason: 'invalid', message: 'Video preview requires stored MP4 or WebM bytes.' };
-            if (extracting)
+            const release = lock.tryAcquire({}, {});
+            if (!release)
                 return { ok: false, reason: 'busy', message: 'Video preview is busy. Try again after the current extraction finishes.' };
-            extracting = true;
             const deadline = nowMs({}, {}) + VIDEO_EXTRACTION_TIMEOUT_MS;
             let directory;
             try {
@@ -125,7 +140,7 @@ export function createFfmpegVideoFrameExtractor({ findBinaries = findVideoBinari
                     throw new VideoProcessError('canceled', 'Video preview canceled.');
                 if (options.layout !== undefined && options.layout !== 'frames' && options.layout !== 'sheet')
                     throw new VideoProcessError('invalid', 'Video layout must be frames or sheet.');
-                const binaries = await findBinaries({}, {});
+                const binaries = await findBinaries({}, { ...(env ? { env } : {}), ...(platform ? { platform } : {}) });
                 if (!binaries)
                     return { ok: false, reason: 'unavailable', message: UNAVAILABLE };
                 directory = await mkdtemp(join(tmpdir(), 'video-preview-'));
@@ -253,7 +268,7 @@ export function createFfmpegVideoFrameExtractor({ findBinaries = findVideoBinari
                     return { ok: false, reason: 'invalid', message: 'Video preview temporary files could not be removed.' };
                 }
                 finally {
-                    extracting = false;
+                    release();
                 }
             }
         } };

package/dist/navigation/dropdown.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Dropdown navigation (`"variant":"dropdown"` menus), following the APG disclosure-navigation
+ * pattern: a branch item carries a server-rendered `<button class="jini-menu-toggle" aria-expanded
+ * aria-controls>` pointing at its child `<ul id>`, and the root `<ul>` carries `data-jini-dropdown`.
+ * No `role="menu"` and no `aria-haspopup` — those make screen readers announce a menu and expect
+ * menubar keys, which site nav should not imitate.
+ *
+ * The toggles are real buttons in the markup (not injected by JS), so without JS Tab still reaches
+ * them and a theme's `:focus-within` CSS opens the panel. {@link MENU_DROPDOWN_SCRIPT} adds
+ * `jini-menu-js` to each root so a theme can switch that fallback off once JS owns the open state
+ * (otherwise Escape could not close a panel while focus sits on its toggle).
+ */
+/** A branch item's toggle. Split form (default): an empty button labelled "`label` submenu" that sits
+ *  after the item's link. `asLabel`: the button IS the item's label (a link-less parent), and carries
+ *  `menu-item-label` so theme scripts that read `.menu-item-label` treat it as an inert parent.
+ *  @complexity O(n) over `label`. */
+export declare function renderMenuToggle({ controlsId, label }: {
+    controlsId: string;
+    label: string;
+}, { asLabel }?: {
+    asLabel?: boolean;
+}): string;
+/**
+ * The inline script behind every `[data-jini-dropdown]` menu ({@link injectMenuDropdownScript} adds it
+ * once per page). State lives in `li.jini-menu-open` and the toggle's `aria-expanded`.
+ * - click on a toggle opens/closes its item (mouse, touch tap, Enter/Space); any click or focus
+ *   elsewhere closes every open item that does not contain the target (siblings, click-outside,
+ *   tabbing out). Closing an item closes its open descendants too.
+ * - Escape closes the nearest open item around the focus and returns focus to its toggle.
+ * - ArrowDown on a toggle opens it and focuses the submenu's first link/button; ArrowDown/ArrowUp
+ *   inside a submenu move between sibling items; ArrowLeft/ArrowRight on a top-level item move between
+ *   top-level items. No wrap at either end. Handled arrows `preventDefault` so the page does not scroll.
+ * Hover stays pure theme CSS and never touches `aria-expanded`.
+ */
+export declare const MENU_DROPDOWN_SCRIPT = "(function(){\n  var roots=document.querySelectorAll('[data-jini-dropdown]');\n  for(var i=0;i<roots.length;i++)roots[i].classList.add('jini-menu-js');\n  function inMenu(el){return el&&el.closest&&el.closest('[data-jini-dropdown]')?el:null;}\n  function toggleOf(li){return li.querySelector(':scope > .jini-menu-toggle');}\n  function panelOf(li){var b=toggleOf(li);return b?document.getElementById(b.getAttribute('aria-controls')):null;}\n  function first(li){return li?li.querySelector('a[href], button'):null;}\n  function setOpen(li,open){\n  var items=open?[li]:[li].concat(Array.prototype.slice.call(li.querySelectorAll('li.jini-menu-open')));\n  for(var i=0;i<items.length;i++){items[i].classList[open?'add':'remove']('jini-menu-open');var b=toggleOf(items[i]);if(b)b.setAttribute('aria-expanded',open?'true':'false');}\n  }\n  function closeAll(keep){\n  var open=document.querySelectorAll('[data-jini-dropdown] li.jini-menu-open');\n  for(var i=0;i<open.length;i++)if(!(keep&&keep.nodeType===1&&open[i].contains(keep)))setOpen(open[i],false);\n  }\n  document.addEventListener('focusin',function(e){closeAll(e.target);});\n  document.addEventListener('click',function(e){\n  closeAll(e.target);\n  var b=inMenu(e.target)?e.target.closest('.jini-menu-toggle'):null;\n  if(b)setOpen(b.parentNode,b.getAttribute('aria-expanded')!=='true');\n  });\n  document.addEventListener('keydown',function(e){\n  var t=inMenu(e.target);if(!t)return;\n  if(e.key==='Escape'){var o=t.closest('li.jini-menu-open');if(o){setOpen(o,false);toggleOf(o).focus();}return;}\n  var li=t.closest('li'),next=null;if(!li)return;\n  var top=li.parentNode.hasAttribute('data-jini-dropdown');\n  if(e.key==='ArrowDown'&&t.classList.contains('jini-menu-toggle')){closeAll(li);setOpen(li,true);var p=panelOf(li);next=p?first(p):null;}\n  else if(!top&&e.key==='ArrowDown')next=first(li.nextElementSibling);\n  else if(!top&&e.key==='ArrowUp')next=first(li.previousElementSibling);\n  else if(top&&e.key==='ArrowRight')next=first(li.nextElementSibling);\n  else if(top&&e.key==='ArrowLeft')next=first(li.previousElementSibling);\n  else return;\n  e.preventDefault();\n  if(next)next.focus();\n  });\n  })();";
+/** Adds the one inline dropdown script before `</body>` when the page carries a `data-jini-dropdown`
+ *  menu and does not already have the script. @complexity O(n). */
+export declare function injectMenuDropdownScript({ html }: {
+    html: string;
+}, _optional?: Record<string, never>): string;
+//# sourceMappingURL=dropdown.d.ts.map

package/dist/navigation/dropdown.js

@@ -0,0 +1,85 @@
+/**
+ * Dropdown navigation (`"variant":"dropdown"` menus), following the APG disclosure-navigation
+ * pattern: a branch item carries a server-rendered `<button class="jini-menu-toggle" aria-expanded
+ * aria-controls>` pointing at its child `<ul id>`, and the root `<ul>` carries `data-jini-dropdown`.
+ * No `role="menu"` and no `aria-haspopup` — those make screen readers announce a menu and expect
+ * menubar keys, which site nav should not imitate.
+ *
+ * The toggles are real buttons in the markup (not injected by JS), so without JS Tab still reaches
+ * them and a theme's `:focus-within` CSS opens the panel. {@link MENU_DROPDOWN_SCRIPT} adds
+ * `jini-menu-js` to each root so a theme can switch that fallback off once JS owns the open state
+ * (otherwise Escape could not close a panel while focus sits on its toggle).
+ */
+const SCRIPT_MARKER = 'data-jini-menu-dropdown-script';
+function escapeAttribute(value) {
+    return value.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+/** A branch item's toggle. Split form (default): an empty button labelled "`label` submenu" that sits
+ *  after the item's link. `asLabel`: the button IS the item's label (a link-less parent), and carries
+ *  `menu-item-label` so theme scripts that read `.menu-item-label` treat it as an inert parent.
+ *  @complexity O(n) over `label`. */
+export function renderMenuToggle({ controlsId, label }, { asLabel = false } = {}) {
+    const id = escapeAttribute(controlsId);
+    const text = escapeAttribute(label);
+    return asLabel
+        ? `<button type="button" class="menu-item-label jini-menu-toggle" aria-expanded="false" aria-controls="${id}">${text}</button>`
+        : `<button type="button" class="jini-menu-toggle" aria-expanded="false" aria-controls="${id}" aria-label="${text} submenu"></button>`;
+}
+/**
+ * The inline script behind every `[data-jini-dropdown]` menu ({@link injectMenuDropdownScript} adds it
+ * once per page). State lives in `li.jini-menu-open` and the toggle's `aria-expanded`.
+ * - click on a toggle opens/closes its item (mouse, touch tap, Enter/Space); any click or focus
+ *   elsewhere closes every open item that does not contain the target (siblings, click-outside,
+ *   tabbing out). Closing an item closes its open descendants too.
+ * - Escape closes the nearest open item around the focus and returns focus to its toggle.
+ * - ArrowDown on a toggle opens it and focuses the submenu's first link/button; ArrowDown/ArrowUp
+ *   inside a submenu move between sibling items; ArrowLeft/ArrowRight on a top-level item move between
+ *   top-level items. No wrap at either end. Handled arrows `preventDefault` so the page does not scroll.
+ * Hover stays pure theme CSS and never touches `aria-expanded`.
+ */
+export const MENU_DROPDOWN_SCRIPT = `(function(){
+  var roots=document.querySelectorAll('[data-jini-dropdown]');
+  for(var i=0;i<roots.length;i++)roots[i].classList.add('jini-menu-js');
+  function inMenu(el){return el&&el.closest&&el.closest('[data-jini-dropdown]')?el:null;}
+  function toggleOf(li){return li.querySelector(':scope > .jini-menu-toggle');}
+  function panelOf(li){var b=toggleOf(li);return b?document.getElementById(b.getAttribute('aria-controls')):null;}
+  function first(li){return li?li.querySelector('a[href], button'):null;}
+  function setOpen(li,open){
+  var items=open?[li]:[li].concat(Array.prototype.slice.call(li.querySelectorAll('li.jini-menu-open')));
+  for(var i=0;i<items.length;i++){items[i].classList[open?'add':'remove']('jini-menu-open');var b=toggleOf(items[i]);if(b)b.setAttribute('aria-expanded',open?'true':'false');}
+  }
+  function closeAll(keep){
+  var open=document.querySelectorAll('[data-jini-dropdown] li.jini-menu-open');
+  for(var i=0;i<open.length;i++)if(!(keep&&keep.nodeType===1&&open[i].contains(keep)))setOpen(open[i],false);
+  }
+  document.addEventListener('focusin',function(e){closeAll(e.target);});
+  document.addEventListener('click',function(e){
+  closeAll(e.target);
+  var b=inMenu(e.target)?e.target.closest('.jini-menu-toggle'):null;
+  if(b)setOpen(b.parentNode,b.getAttribute('aria-expanded')!=='true');
+  });
+  document.addEventListener('keydown',function(e){
+  var t=inMenu(e.target);if(!t)return;
+  if(e.key==='Escape'){var o=t.closest('li.jini-menu-open');if(o){setOpen(o,false);toggleOf(o).focus();}return;}
+  var li=t.closest('li'),next=null;if(!li)return;
+  var top=li.parentNode.hasAttribute('data-jini-dropdown');
+  if(e.key==='ArrowDown'&&t.classList.contains('jini-menu-toggle')){closeAll(li);setOpen(li,true);var p=panelOf(li);next=p?first(p):null;}
+  else if(!top&&e.key==='ArrowDown')next=first(li.nextElementSibling);
+  else if(!top&&e.key==='ArrowUp')next=first(li.previousElementSibling);
+  else if(top&&e.key==='ArrowRight')next=first(li.nextElementSibling);
+  else if(top&&e.key==='ArrowLeft')next=first(li.previousElementSibling);
+  else return;
+  e.preventDefault();
+  if(next)next.focus();
+  });
+  })();`;
+/** Adds the one inline dropdown script before `</body>` when the page carries a `data-jini-dropdown`
+ *  menu and does not already have the script. @complexity O(n). */
+export function injectMenuDropdownScript({ html }, _optional = {}) {
+    if (!html.includes('data-jini-dropdown') || html.includes(SCRIPT_MARKER))
+        return html;
+    const script = `<script ${SCRIPT_MARKER}>${MENU_DROPDOWN_SCRIPT}</script>`;
+    const bodyClose = html.lastIndexOf('</body>');
+    return bodyClose === -1 ? html + script : html.slice(0, bodyClose) + script + html.slice(bodyClose);
+}
+//# sourceMappingURL=dropdown.js.map

package/dist/navigation/index.d.ts

@@ -30,6 +30,8 @@ export { createMenu, updateMenuTree, assignLocation, deleteMenu, validateAndClon
 export { MAX_MENU_HTML_LENGTH, isMenuHtmlAuthoring, menuHtmlInputProblem, mergeMenuHtml, type MenuHtmlAuthoring, } from "./menu-html.js";
 export { resolveForLocation, resolveMenuDoc, type ResolveTargetHrefFn, type ResolvedTargetHref, type ResolveForLocationDeps, type ResolveForLocationServiceInput, type ResolveForLocationRequired, type ResolveForLocationOptional, } from "./resolver.js";
 export { rebuildNavLocationBindings, type RebuildNavLocationBindingsDeps, type RebuildNavLocationBindingsResult, } from "./reconcile.js";
+/** Dropdown menus (2026-10-11): toggle markup + the inline keyboard/touch script (see `dropdown.ts`). */
+export { renderMenuToggle, injectMenuDropdownScript, MENU_DROPDOWN_SCRIPT } from "./dropdown.js";
 /** The agent-tool surface for this domain (see `agent-tools.ts` for what is deliberately omitted). */
 export { menusAgentToolCatalog, } from "./agent-tools.js";
 /**

package/dist/navigation/index.js

@@ -21,6 +21,8 @@ export { createMenu, updateMenuTree, assignLocation, deleteMenu, validateAndClon
 export { MAX_MENU_HTML_LENGTH, isMenuHtmlAuthoring, menuHtmlInputProblem, mergeMenuHtml, } from "./menu-html.js";
 export { resolveForLocation, resolveMenuDoc, } from "./resolver.js";
 export { rebuildNavLocationBindings, } from "./reconcile.js";
+/** Dropdown menus (2026-10-11): toggle markup + the inline keyboard/touch script (see `dropdown.ts`). */
+export { renderMenuToggle, injectMenuDropdownScript, MENU_DROPDOWN_SCRIPT } from "./dropdown.js";
 /** The agent-tool surface for this domain (see `agent-tools.ts` for what is deliberately omitted). */
 export { menusAgentToolCatalog, } from "./agent-tools.js";
 /**

package/dist/redirects/capture.d.ts

@@ -55,6 +55,8 @@ export interface RedirectSlugChangeCaptureReadDeps {
     }, optional?: Record<string, never>): Promise<RedirectRecord | null>;
 }
 export interface RedirectSlugChangeCaptureDeps {
+    /** Optional for existing hosts; route-owning hosts supply their reserved segment policy. */
+    reservedSegments?: ReadonlySet<string>;
     repo: RedirectSlugChangeCaptureReadDeps;
     db: RedirectDbHandle;
     clock: ClockPort;

package/dist/redirects/capture.js

@@ -1,4 +1,5 @@
 import { nowIso as clockNowIso } from "@jini-ai/core/primitives";
+import { assertRedirectSourceAllowed } from "./redirects.js";
 import { insertRedirectAndRevision } from "./ports.internal.js";
 /** Default priority/statusCode/override for an auto-captured rule (behavior.spec.md §3 analog). */
 const AUTO_CAPTURE_STATUS_CODE = 301;
@@ -21,6 +22,9 @@ export class RedirectSlugChangeCapture {
      * @complexity O(1) — one read (idempotency check) + two writes.
      */
     async onSlugChange(input, _optional = {}) {
+        if (this.deps.reservedSegments) {
+            assertRedirectSourceAllowed({ fromPattern: input.oldPath, reservedSegments: this.deps.reservedSegments });
+        }
         const existing = await this.deps.repo.lookupExact({
             workspaceId: input.workspaceId,
             path: input.oldPath,

package/dist/redirects/redirects.d.ts

@@ -100,6 +100,14 @@ export interface RedirectsWriteDeps {
     idGen: IdGeneratorPort;
     outbox: OutboxPort;
 }
+/** Refuse source patterns whose decoded first segment belongs to a host route.
+ * Uses the same decoding and case folding as the target gate; wildcard tails remain patterns.
+ * @throws RedirectValidationError before any write. @complexity O(n) in the pattern length.
+ */
+export declare function assertRedirectSourceAllowed({ fromPattern, reservedSegments }: {
+    fromPattern: string;
+    reservedSegments: ReadonlySet<string>;
+}, _optional?: Record<string, never>): void;
 /**
  * The site-relative half of the write gate: routing's structural + reserved-path verdict, then the
  * redirect oracle's own raw-character rule. The read path hands a relative location to that oracle

package/dist/redirects/redirects.js

@@ -144,6 +144,16 @@ function siteRelativeRefusalReason(check) {
             return "it contains, or decodes to, a backslash or a control character";
     }
 }
+/** Refuse source patterns whose decoded first segment belongs to a host route.
+ * Uses the same decoding and case folding as the target gate; wildcard tails remain patterns.
+ * @throws RedirectValidationError before any write. @complexity O(n) in the pattern length.
+ */
+export function assertRedirectSourceAllowed({ fromPattern, reservedSegments }, _optional = {}) {
+    const verdict = checkSiteRelativeTarget({ raw: fromPattern, reservedSegments }, {});
+    if (verdict.kind === "reserved") {
+        throw new RedirectValidationError(`fromPattern '${fromPattern}' is reserved for the '${verdict.surface}' surface`);
+    }
+}
 /**
  * The site-relative half of the write gate: routing's structural + reserved-path verdict, then the
  * redirect oracle's own raw-character rule. The read path hands a relative location to that oracle
@@ -257,6 +267,7 @@ export async function checkRedirectFieldsWouldWrite({ deps, fields }, { excludeI
         validateToTargetLength(fields.toTarget);
         validateStatusCode(fields.statusCode);
         validatePriority(fields.priority);
+        assertRedirectSourceAllowed({ fromPattern: fields.fromPattern, reservedSegments: deps.reservedSegments });
         await assertTargetAllowed(deps.originRegistry, fields.workspaceId, fields.toTarget, deps.reservedSegments);
         const finalTarget = await resolveCollapsedTarget(deps.repo, fields.workspaceId, fields.fromPattern, fields.toTarget);
         if (finalTarget !== fields.toTarget) {
@@ -300,6 +311,7 @@ export async function createRedirect(required, _optional = {}) {
     validateStatusCode(input.statusCode);
     const priority = input.priority ?? DEFAULT_PRIORITY;
     validatePriority(priority);
+    assertRedirectSourceAllowed({ fromPattern: input.fromPattern, reservedSegments: deps.reservedSegments });
     await assertTargetAllowed(deps.originRegistry, input.workspaceId, input.toTarget, deps.reservedSegments);
     const finalTarget = await resolveCollapsedTarget(deps.repo, input.workspaceId, input.fromPattern, input.toTarget);
     if (finalTarget !== input.toTarget) {
@@ -411,6 +423,7 @@ async function validateUpdateFields(deps, workspaceId, fields, existingId) {
     validateStatusCode(fields.statusCode);
     validateStatus(fields.status);
     validatePriority(fields.priority);
+    assertRedirectSourceAllowed({ fromPattern: fields.fromPattern, reservedSegments: deps.reservedSegments });
     await assertTargetAllowed(deps.originRegistry, workspaceId, fields.toTarget, deps.reservedSegments);
     const finalTarget = await resolveCollapsedTarget(deps.repo, workspaceId, fields.fromPattern, fields.toTarget);
     if (finalTarget !== fields.toTarget) {
@@ -442,6 +455,7 @@ export async function updateRedirect(required, _optional = {}) {
         if (!isRestoreOnlyUpdate(input)) {
             assertEntityLive({ entityType: "redirect", entityId: input.id, state: "trashed" });
         }
+        assertRedirectSourceAllowed({ fromPattern: existing.fromPattern, reservedSegments: deps.reservedSegments });
         const outcome = await deps.restore({
             workspaceId: input.workspaceId,
             id: input.id,

package/dist/routing/index.d.ts

@@ -0,0 +1,5 @@
+export { createRouting, RouteResolutionError } from './routing.js';
+export type { CreateRoutingRequired, CreateRoutingOptional, EmptyOptions, Routing, IsActiveOptional, IsActiveRequired, RegisterNamedRouteInput, RegisterResolvePhaseOptions, ResolveInput, ResolveOptional, ResolveRequired, UrlForOptional, UrlForRequired } from './routing.js';
+export type { RouteResolverDeps, RoutingContentRecord, RoutingContentReadPort, RoutingPorts } from './ports.js';
+export type { EntryRefTarget, RouteRefTarget, RouteResolveContext, RouteResolvePhaseHandler, RouteResolvePhaseName, RouteResolvePhaseOutcome, RouteResolveResult, RouteTarget, RouteTargetKind, RouteUrl, SlugChangeCapture, SlugChangeCaptureInput, TermRefTarget, UrlTarget } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/routing/index.js

@@ -0,0 +1,2 @@
+export { createRouting, RouteResolutionError } from './routing.js';
+//# sourceMappingURL=index.js.map

package/dist/routing/ports.d.ts

@@ -0,0 +1,51 @@
+/**
+ * @file Dependency contracts for the Tovu `routing` Tier-2 library (ADR-039 v0).
+ *
+ * ADR-006 accounting (rule-of-two):
+ * - `routing` introduces NO new persistence port. Resolving an `entryRef`
+ *   target reuses the existing `PostRepoPort` (`src/features/post/post.ts`) —
+ *   `post` is the only content type implemented in this repo today. Inventing
+ *   a routing-owned repo for data that already has one would fail rule-of-two.
+ * - The named-route registry and the resolve-phase/`SlugChangeCapture`
+ *   registration slots are core-owned registration mechanisms (ADR-039 §1/§4),
+ *   NOT open ADR-009 plugin hooks and NOT ports — they are ordinary in-module
+ *   state with a typed register/get surface, same treatment ADR-029/ADR-032
+ *   give their single-evaluator resolvers.
+ *
+ * Architectural role:
+ * INTERFACES ONLY — no feature logic lives here.
+ */
+/** Minimal content projection; the host visibility owner evaluates publication, scheduling and Trash. */
+export interface RoutingContentRecord {
+    readonly slug: string;
+    readonly status: string;
+    readonly deletedAt?: string | null | undefined;
+    readonly publishAt?: string | null | undefined;
+}
+/** A projection of the existing content reader, not a new store or persistence owner. */
+export interface RoutingContentReadPort {
+    findById(required: {
+        workspaceId: string;
+        id: string;
+    }, optional?: Record<string, never>): Promise<RoutingContentRecord | null>;
+}
+/** Host-owned policy and operator channel. No implicit clock or console in generic routing. */
+export interface RoutingPorts {
+    isLive(required: {
+        post: RoutingContentRecord;
+    }, optional?: Record<string, never>): boolean;
+    reportPhaseError(required: {
+        message: string;
+        error: unknown;
+    }, optional?: Record<string, never>): void;
+}
+/**
+ * Dependencies `urlFor`/`isActive` need to resolve `entryRef` targets. Kept as
+ * its own named shape (rather than inlining `PostRepoPort` at each call site)
+ * so a future second content type's repo can be added here without changing
+ * every call site's required-object shape.
+ */
+export interface RouteResolverDeps {
+    readonly postRepo: RoutingContentReadPort;
+}
+//# sourceMappingURL=ports.d.ts.map

package/dist/routing/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map