@jini-ai/cms 0.5.6 → 0.5.8

package/CHANGELOG.md

@@ -1,3 +1,13 @@
+## 0.5.8 — 2026-10-13
+
+- New `./navigation/node` subpath: re-exports the full `./navigation` API with parse5 menu-HTML normalization bound into `createMenu`, `updateMenuTree`, `mergeMenuHtml` and `buildMenusRegistrations`. Node hosts writing HTML-mode menus should import those from `./navigation/node`.
+- `./navigation` no longer loads the optional peer `parse5`, so it is universal again. Every name is still exported; an HTML-mode write through it needs an injected `normalizeMenuHtml` (`normalizeHtml` for `mergeMenuHtml`) and otherwise fails before saving. Item-only writes are unchanged.
+- `./seo` no longer reaches the media transform module for rendition MIME types; `TransformFormat` and `mimeForTransformFormat` remain exported from the media entries.
+
+## 0.5.7 — 2026-10-12
+
+- New render-only leaf subpaths: `./forms/html-render`, `./forms/submission-attempts`, `./widgets/page-embed-types`, `./widgets/html/html-embeds`, `./widgets/html/gallery-render`, `./navigation/types`, `./navigation/dropdown` and `./media/slug` (the media slug rule, still re-exported from `./media`). Existing barrels are unchanged.
+
 ## 0.5.4 — 2026-10-08
 
 - Ships `dist/forms/**`: 0.5.3's `files` negation `!forms/**` also stripped `dist/forms`, so `@jini-ai/cms/forms` (and `/html`, `/sql`, `/express`) failed to resolve. The negation is removed: `files` already ships only `dist`, and the nested `forms/` package is never packed.

package/README.md

@@ -78,6 +78,13 @@ coordination.
 `taxonomy`, `workspace`, and `trash`. `settings` is now a compatibility shim, with implementation
 in `@jini-ai/core/settings`. `./core/tools` re-exports the shared core permission helpers; `./media/import` exports bounded image fetching with injected policies and ports.
 
+`./navigation` stays universal: submitted menu HTML requires an injected `normalizeMenuHtml`
+dependency (`normalizeHtml` for `mergeMenuHtml`). Item-only writes and retained markup need no
+parser. Node hosts use `./navigation/node`, which re-exports the navigation API and supplies
+parse5 normalization to create/update, merge and tool registration. The existing validation,
+raw-HTML permission checks, OCC and outbox owners remain unchanged; an unconfigured universal
+HTML write fails before saving rather than persisting markup that could escape its theme container.
+
 **Still to move:** `post`, `seo`, `comments`, `redirects`, `widgets`, `newsletter`,
 `members`. The unimplemented `./widgets` export has been removed.
 The nested forms package is maintained by its separate owner and is excluded from this parent package.

package/dist/core/transform-format.d.ts

@@ -0,0 +1,19 @@
+/** Shared rendition format metadata. Media validation and SEO use this leaf without loading
+ * either domain's runtime; media/transform-types.ts preserves its existing public exports.
+ */
+/**
+ * Output re-encode format. Matches `media-service.ts`'s
+ * `DEFAULT_ALLOWED_MIME_TYPES` image set minus SVG (never a transform output —
+ * SVG has no raster pixels to resize).
+ */
+export type TransformFormat = "jpeg" | "png" | "webp" | "gif";
+/** Maps a {@link TransformFormat} to the MIME type served on the rendition response. */
+export declare const MIME_BY_TRANSFORM_FORMAT: Record<TransformFormat, string>;
+/**
+ * @complexity O(1).
+ * @overallScore 100
+ */
+export declare function mimeForTransformFormat(requiredArgs: {
+    format: TransformFormat;
+}, optionalArgs?: Record<string, never>): string;
+//# sourceMappingURL=transform-format.d.ts.map

package/dist/core/transform-format.js

@@ -0,0 +1,19 @@
+/** Shared rendition format metadata. Media validation and SEO use this leaf without loading
+ * either domain's runtime; media/transform-types.ts preserves its existing public exports.
+ */
+/** Maps a {@link TransformFormat} to the MIME type served on the rendition response. */
+export const MIME_BY_TRANSFORM_FORMAT = {
+    jpeg: "image/jpeg",
+    png: "image/png",
+    webp: "image/webp",
+    gif: "image/gif",
+};
+/**
+ * @complexity O(1).
+ * @overallScore 100
+ */
+export function mimeForTransformFormat(requiredArgs, optionalArgs = {}) {
+    const { format } = requiredArgs;
+    return MIME_BY_TRANSFORM_FORMAT[format];
+}
+//# sourceMappingURL=transform-format.js.map

package/dist/media/media-service.d.ts

@@ -1,3 +1,4 @@
+export { isValidMediaSlugFormat } from "./slug.js";
 import type { Clock, IdGenerator, UUID } from "@jini-ai/core/primitives";
 import { MediaConflictError, MediaNotFoundError, MediaSourceImmutableError, MediaStillReferencedError, MediaValidationError, type MediaRecord, type MediaSource } from "./types.js";
 import type { AssetBlobRepoPort, AssetRenditionRepoPort, BlobStorePort, MediaRepoPort } from "./ports.js";
@@ -53,9 +54,6 @@ export declare function resolveWriteOnceSource(required: {
     existing: MediaSource | undefined;
     requestedSha256: string;
 }, _optional?: Record<string, never>): MediaSource;
-export declare function isValidMediaSlugFormat(requiredArgs: {
-    slug: string;
-}, optionalArgs?: Record<string, never>): boolean;
 export interface UploadMediaInput {
     workspaceId: UUID;
     bytes: Uint8Array;

package/dist/media/media-service.js

@@ -1,3 +1,5 @@
+import { isValidMediaSlugFormat } from "./slug.js";
+export { isValidMediaSlugFormat } from "./slug.js";
 import { createSystemClock } from "@jini-ai/core/primitives";
 import { nowIso as kernelNowIso } from "@jini-ai/core/primitives";
 /**
@@ -145,28 +147,6 @@ function deriveTitleFromFilename(filename) {
     const base = filename.trim().replace(/\.[^./\\]+$/, "");
     return base.trim() || "Untitled";
 }
-/** Shared slug-format rule (2026-09-07) — same shape as `post`'s `SLUG_FORMAT_PATTERN`: lowercase
- *  letters, digits, and dashes only. Media slugs have no reserved-word list (`post`'s `admin`/`api`
- *  exclusions exist because a post slug can become a literal URL path segment a route dispatches
- *  on; a media slug is only ever a lookup key, never a route itself, so that hazard doesn't apply). */
-const MEDIA_SLUG_FORMAT_PATTERN = /^[a-z0-9-]+$/;
-/**
- * Slugs that spell a UUID are refused outright (2026-09-07 fix).
- *
- * A lowercase UUID is `[a-z0-9-]+` character for character, so {@link MEDIA_SLUG_FORMAT_PATTERN}
- * happily accepted one — and {@link findMediaByIdOrSlug} used to resolve SLUG FIRST, so pointing one
- * asset's slug at another asset's `id` silently took over every reference already authored against
- * that id (every `/m/{id}/…` URL a host's renderer has ever emitted for the victim). That resolution
- * order is now id-first, which closes the hijack for rows that already carry such a slug; this rule
- * is the write-path half — a slug that can only ever shadow an id is not a slug anyone wants, so it
- * is refused where a human can still see why rather than silently shadowed at read time.
- *
- * Shape-based, not a lookup: it rejects EVERY UUID-shaped value, not only ones that currently
- * collide, so a slug cannot become a hijack later when some future upload happens to mint that id.
- * Ordinary hex-and-dash slugs (`abc-123-def`, `2026-09-07-launch-clip`) are unaffected — nothing but
- * the exact 8-4-4-4-12 hex grouping matches.
- */
-const MEDIA_SLUG_UUID_SHAPE_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 /** Shared slug max-length rule (2026-09-07) — same bound as `post.ts`'s `MAX_SLUG_LENGTH`, reused
  *  rather than inventing a second number. `post.ts` only enforces this on its EXPLICIT/caller-
  *  supplied slug path (`resolveExplicitSlug`, reject-with-error); its own title-derived path is
@@ -177,10 +157,6 @@ const MEDIA_SLUG_UUID_SHAPE_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9
  *  human for a shorter value — silently truncating an internally-derived value is the same
  *  "coerce, don't fail" convention `deriveTitleFromFilename`/`slugifyMediaTitle` already use. */
 const MEDIA_MAX_SLUG_LENGTH = 120;
-export function isValidMediaSlugFormat(requiredArgs, optionalArgs = {}) {
-    const { slug } = requiredArgs;
-    return MEDIA_SLUG_FORMAT_PATTERN.test(slug) && !MEDIA_SLUG_UUID_SHAPE_PATTERN.test(slug);
-}
 /** Truncates a slug candidate to `maxLength`, stripping a trailing dash the cut can introduce (so a
  *  truncation never leaves a slug ending mid-word with a dangling "-"), falling back to `"untitled"`
  *  if nothing legible survives (only reachable when `maxLength` itself is tiny, e.g. while reserving

package/dist/media/slug.d.ts

@@ -0,0 +1,8 @@
+/** Return whether a media lookup slug has the accepted shape, without I/O.
+ * @complexity O(n) time in the slug length, O(1) space.
+ * @example isValidMediaSlugFormat({ slug: "summer-photo" }); // true
+ */
+export declare function isValidMediaSlugFormat(requiredArgs: {
+    slug: string;
+}, optionalArgs?: Record<string, never>): boolean;
+//# sourceMappingURL=slug.d.ts.map

package/dist/media/slug.js

@@ -0,0 +1,32 @@
+/** @file Pure media slug policy; writes and public URL rendering share the same format and UUID-shadowing rule. */
+/** Shared slug-format rule (2026-09-07) — same shape as `post`'s `SLUG_FORMAT_PATTERN`: lowercase
+ *  letters, digits, and dashes only. Media slugs have no reserved-word list (`post`'s `admin`/`api`
+ *  exclusions exist because a post slug can become a literal URL path segment a route dispatches
+ *  on; a media slug is only ever a lookup key, never a route itself, so that hazard doesn't apply). */
+const MEDIA_SLUG_FORMAT_PATTERN = /^[a-z0-9-]+$/;
+/**
+ * Slugs that spell a UUID are refused outright (2026-09-07 fix).
+ *
+ * A lowercase UUID is `[a-z0-9-]+` character for character, so {@link MEDIA_SLUG_FORMAT_PATTERN}
+ * happily accepted one — and {@link findMediaByIdOrSlug} used to resolve SLUG FIRST, so pointing one
+ * asset's slug at another asset's `id` silently took over every reference already authored against
+ * that id (every `/m/{id}/…` URL a host's renderer has ever emitted for the victim). That resolution
+ * order is now id-first, which closes the hijack for rows that already carry such a slug; this rule
+ * is the write-path half — a slug that can only ever shadow an id is not a slug anyone wants, so it
+ * is refused where a human can still see why rather than silently shadowed at read time.
+ *
+ * Shape-based, not a lookup: it rejects EVERY UUID-shaped value, not only ones that currently
+ * collide, so a slug cannot become a hijack later when some future upload happens to mint that id.
+ * Ordinary hex-and-dash slugs (`abc-123-def`, `2026-09-07-launch-clip`) are unaffected — nothing but
+ * the exact 8-4-4-4-12 hex grouping matches.
+ */
+const MEDIA_SLUG_UUID_SHAPE_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+/** Return whether a media lookup slug has the accepted shape, without I/O.
+ * @complexity O(n) time in the slug length, O(1) space.
+ * @example isValidMediaSlugFormat({ slug: "summer-photo" }); // true
+ */
+export function isValidMediaSlugFormat(requiredArgs, optionalArgs = {}) {
+    const { slug } = requiredArgs;
+    return MEDIA_SLUG_FORMAT_PATTERN.test(slug) && !MEDIA_SLUG_UUID_SHAPE_PATTERN.test(slug);
+}
+//# sourceMappingURL=slug.js.map

package/dist/media/transform-types.d.ts

@@ -22,14 +22,10 @@
  * permission catalog.
  */
 import type { ISODateTime, UUID } from "@jini-ai/core/primitives";
+import { type TransformFormat } from "../core/transform-format.js";
+export { mimeForTransformFormat, type TransformFormat } from "../core/transform-format.js";
 /** Resize behavior, mirrors `sharp`'s `fit` vocabulary (a deliberately small subset). */
 export type TransformFit = "cover" | "contain" | "fill" | "inside" | "outside";
-/**
- * Output re-encode format. Matches `media-service.ts`'s
- * `DEFAULT_ALLOWED_MIME_TYPES` image set minus SVG (never a transform output —
- * SVG has no raster pixels to resize).
- */
-export type TransformFormat = "jpeg" | "png" | "webp" | "gif";
 /**
  * Declarative transform parameters (named definitions only, never
  * caller-supplied dimensions). `width`/`height` are optional so a
@@ -66,13 +62,6 @@ export declare class TransformValidationError extends Error {
         message: string;
     }, optionalArgs?: ErrorOptions);
 }
-/**
- * @complexity O(1).
- * @overallScore 100
- */
-export declare function mimeForTransformFormat(requiredArgs: {
-    format: TransformFormat;
-}, optionalArgs?: Record<string, never>): string;
 /** Upper bound on a requested resize dimension — an output-side resource-use guard (not the
  * full pixel-bomb ingest cap, which polices upload input; this polices the transform
  * definition itself so a registered definition can't ask the image transformer to allocate an

package/dist/media/transform-types.js

@@ -1,23 +1,10 @@
+import { MIME_BY_TRANSFORM_FORMAT } from "../core/transform-format.js";
+export { mimeForTransformFormat } from "../core/transform-format.js";
 export class TransformValidationError extends Error {
     constructor({ message }, optionalArgs = {}) {
         super(message, optionalArgs);
     }
 }
-/** Maps a {@link TransformFormat} to the MIME type served on the rendition response. */
-const MIME_BY_TRANSFORM_FORMAT = {
-    jpeg: "image/jpeg",
-    png: "image/png",
-    webp: "image/webp",
-    gif: "image/gif",
-};
-/**
- * @complexity O(1).
- * @overallScore 100
- */
-export function mimeForTransformFormat(requiredArgs, optionalArgs = {}) {
-    const { format } = requiredArgs;
-    return MIME_BY_TRANSFORM_FORMAT[format];
-}
 /** Upper bound on a requested resize dimension — an output-side resource-use guard (not the
  * full pixel-bomb ingest cap, which polices upload input; this polices the transform
  * definition itself so a registered definition can't ask the image transformer to allocate an

package/dist/navigation/index.d.ts

@@ -27,7 +27,7 @@ export { InMemoryMenuRepo, InMemoryNavLocationBindingRepo, menuVersionConflictEr
  */
 export { createMenu, updateMenuTree, assignLocation, deleteMenu, validateAndCloneTree, isAllowedHref, ALLOWED_HREF_SHAPES_DESCRIPTION, MenuNotFoundError, MenuValidationError, MenuConflictError, MenuVersionConflictError, MenuLocationBoundError, DEFAULT_MAX_TREE_DEPTH, DEFAULT_MAX_ITEM_COUNT, type TreeValidationLimits, type CreateMenuDeps, type CreateMenuServiceInput, type CreateMenuRequired, type CreateMenuOptional, type UpdateMenuTreeDeps, type UpdateMenuTreeServiceInput, type UpdateMenuTreeRequired, type UpdateMenuTreeOptional, type AssignLocationDeps, type AssignLocationServiceInput, type AssignLocationRequired, type AssignLocationOptional, type DeleteMenuDeps, type DeleteMenuServiceInput, type DeleteMenuRequired, type DeleteMenuOptional, } from "./menu-service.js";
 /** HTML mode (2026-10-08): validation/normalization for a menu's author-written markup. */
-export { MAX_MENU_HTML_LENGTH, isMenuHtmlAuthoring, menuHtmlInputProblem, mergeMenuHtml, type MenuHtmlAuthoring, } from "./menu-html.js";
+export { MAX_MENU_HTML_LENGTH, isMenuHtmlAuthoring, menuHtmlInputProblem, mergeMenuHtml, type MenuHtmlAuthoring, type MenuHtmlNormalizer, type MenuHtmlOptions, } from "./menu-html.js";
 export { resolveForLocation, resolveMenuDoc, type ResolveTargetHrefFn, type ResolvedTargetHref, type ResolveForLocationDeps, type ResolveForLocationServiceInput, type ResolveForLocationRequired, type ResolveForLocationOptional, } from "./resolver.js";
 export { rebuildNavLocationBindings, type RebuildNavLocationBindingsDeps, type RebuildNavLocationBindingsResult, } from "./reconcile.js";
 /** Dropdown menus (2026-10-11): toggle markup + the inline keyboard/touch script (see `dropdown.ts`). */

package/dist/navigation/menu-html.d.ts

@@ -1,3 +1,17 @@
+/**
+ * @file HTML mode for a menu (2026-10-08): the author writes the menu's markup by hand instead of
+ * building an item tree, so it can be styled however they want.
+ *
+ * Same trust model as HTML-mode forms (`forms/html/html-authoring.ts`) and HTML Pages: the markup is
+ * admin/owner-trusted and NOT sanitized. Hosts gate it behind their raw-HTML permission (Tovu binds
+ * `pages.edit_html`, the one forms use); this module only validates and merges. The injected
+ * normalizer balances the fragment so a stray `</nav>` or an unclosed `<div>` cannot close or
+ * swallow the theme element the menu renders inside. The Node adapter supplies parse5; the
+ * universal entry never loads a parser or assumes a browser DOM.
+ *
+ * Both modes' data live side by side in the doc: switching mode never deletes the other one, so an
+ * author can flip back and find their items (or their HTML) still there.
+ */
 import type { NavMenuDoc, NavMenuMode } from "./types.js";
 /** Same ceiling HTML-mode forms use. */
 export declare const MAX_MENU_HTML_LENGTH = 200000;
@@ -12,6 +26,14 @@ export interface MenuHtmlAuthoring {
  * @complexity O(1).
  */
 export declare function isMenuHtmlAuthoring({ mode, html }: MenuHtmlAuthoring, _optional?: Record<string, never>): boolean;
+/** Balance a trusted HTML fragment while preserving scripts and authored styling. */
+export type MenuHtmlNormalizer = (required: {
+    html: string;
+}, optional?: Record<string, never>) => string;
+/** A host supplies its environment's fragment parser; omitted is valid for item-only writes. */
+export interface MenuHtmlOptions {
+    normalizeHtml?: MenuHtmlNormalizer | undefined;
+}
 /**
  * Why a write's `mode`/`html` is invalid, or `null` when it is fine. A message rather than a throw so
  * `menu-service.ts` raises its own `MenuValidationError` without this file importing it back.
@@ -22,10 +44,12 @@ export declare function menuHtmlInputProblem({ mode, html }: MenuHtmlAuthoring,
  * The doc's `mode`/`html` after a valid write: submitted values win, omitted ones keep what is
  * stored, and a menu that never used HTML mode gets neither key, so its stored doc (and publish
  * hash) is unchanged. Call {@link menuHtmlInputProblem} first.
+ * @param optional Host fragment normalizer, required when input.html is supplied.
+ * @throws {Error} Submitted markup has no configured normalizer; never saves unbalanced HTML.
  * @complexity O(h) in the submitted html length (one parse + serialize).
  */
 export declare function mergeMenuHtml({ input, existing }: {
     input: MenuHtmlAuthoring;
     existing?: Pick<NavMenuDoc, "mode" | "html"> | undefined;
-}, _optional?: Record<string, never>): Pick<NavMenuDoc, "mode" | "html">;
+}, optional?: MenuHtmlOptions): Pick<NavMenuDoc, "mode" | "html">;
 //# sourceMappingURL=menu-html.d.ts.map

package/dist/navigation/menu-html.js

@@ -1,17 +1,3 @@
-/**
- * @file HTML mode for a menu (2026-10-08): the author writes the menu's markup by hand instead of
- * building an item tree, so it can be styled however they want.
- *
- * Same trust model as HTML-mode forms (`forms/html/html-authoring.ts`) and HTML Pages: the markup is
- * admin/owner-trusted and NOT sanitized. Hosts gate it behind their raw-HTML permission (Tovu binds
- * `pages.edit_html`, the one forms use); this module only validates and normalizes. parse5 balances
- * the fragment so a stray `</nav>` or an unclosed `<div>` cannot close or swallow the theme element
- * the menu renders inside.
- *
- * Both modes' data live side by side in the doc: switching mode never deletes the other one, so an
- * author can flip back and find their items (or their HTML) still there.
- */
-import { parseFragment, serialize } from "parse5";
 /** Same ceiling HTML-mode forms use. */
 export const MAX_MENU_HTML_LENGTH = 200_000;
 /**
@@ -22,10 +8,6 @@ export const MAX_MENU_HTML_LENGTH = 200_000;
 export function isMenuHtmlAuthoring({ mode, html }, _optional = {}) {
     return html !== undefined || mode === "html";
 }
-/** Balance the fragment; scripts and authored styling stay as written (trusted markup). */
-function normalizeMenuHtml(html) {
-    return serialize(parseFragment(html));
-}
 /**
  * Why a write's `mode`/`html` is invalid, or `null` when it is fine. A message rather than a throw so
  * `menu-service.ts` raises its own `MenuValidationError` without this file importing it back.
@@ -43,11 +25,18 @@ export function menuHtmlInputProblem({ mode, html }, _optional = {}) {
  * The doc's `mode`/`html` after a valid write: submitted values win, omitted ones keep what is
  * stored, and a menu that never used HTML mode gets neither key, so its stored doc (and publish
  * hash) is unchanged. Call {@link menuHtmlInputProblem} first.
+ * @param optional Host fragment normalizer, required when input.html is supplied.
+ * @throws {Error} Submitted markup has no configured normalizer; never saves unbalanced HTML.
  * @complexity O(h) in the submitted html length (one parse + serialize).
  */
-export function mergeMenuHtml({ input, existing }, _optional = {}) {
+export function mergeMenuHtml({ input, existing }, optional = {}) {
     const mode = input.mode ?? existing?.mode;
-    const html = input.html !== undefined ? normalizeMenuHtml(input.html) : existing?.html;
+    let html = existing?.html;
+    if (input.html !== undefined) {
+        if (!optional.normalizeHtml)
+            throw new Error("Menu HTML normalization is not configured");
+        html = optional.normalizeHtml({ html: input.html });
+    }
     return { ...(mode !== undefined ? { mode } : {}), ...(html !== undefined ? { html } : {}) };
 }
 //# sourceMappingURL=menu-html.js.map

package/dist/navigation/menu-service.d.ts

@@ -2,6 +2,7 @@ import type { Clock, IdGenerator, UUID } from "@jini-ai/core/primitives";
 import type { OutboxPort } from "../core/ports.js";
 import type { MenuRepoPort } from "./repo.memory.js";
 import type { NavLocationBindingRepoPort } from "./ports.js";
+import { type MenuHtmlNormalizer } from "./menu-html.js";
 import { type NavItemNode, type NavLocationBindingRow, type NavLocationKey, type NavMenuEntry, type NavMenuMode } from "./types.js";
 export declare class MenuNotFoundError extends Error {
     constructor({ message }: {
@@ -135,6 +136,8 @@ export declare function validateAndCloneTree({ items }: {
     items: readonly NavItemNode[];
 }, limits?: TreeValidationLimits): NavItemNode[];
 export interface CreateMenuDeps {
+    /** Required for submitted HTML; Node hosts can use the navigation/node adapter. */
+    normalizeMenuHtml?: MenuHtmlNormalizer | undefined;
     repo: MenuRepoPort;
     clock: Clock;
     idGen: IdGenerator;
@@ -177,6 +180,8 @@ export declare function createMenu(required: CreateMenuRequired, optional?: Crea
     menu: NavMenuEntry;
 }>;
 export interface UpdateMenuTreeDeps {
+    /** Required for submitted HTML; omitted markup retains the already-normalized stored value. */
+    normalizeMenuHtml?: MenuHtmlNormalizer | undefined;
     repo: MenuRepoPort;
     clock: Clock;
     /** Not previously present on this deps bag — needed to mint the outbox event's id. */

package/dist/navigation/menu-service.js

@@ -283,11 +283,11 @@ function assertValidTitleAndSlug(title, slug) {
     }
 }
 /** Validated, merged HTML-mode doc fields — `menu-html.ts`'s problem check raised as this file's own error. */
-function menuHtmlFields({ input, existing }) {
+function menuHtmlFields({ input, existing, normalizeHtml }) {
     const problem = menuHtmlInputProblem(input);
     if (problem)
         throw new MenuValidationError({ message: problem });
-    return mergeMenuHtml({ input, existing });
+    return mergeMenuHtml({ input, existing }, { normalizeHtml });
 }
 /**
  * Creates a new `menu` entry in `published` status with no location
@@ -313,7 +313,7 @@ export async function createMenu(required, optional = {}) {
     if (duplicate)
         throw new MenuConflictError({ message: `slug '${slug}' already exists` });
     const items = validateAndCloneTree({ items: input.items ?? [] }, optional.limits);
-    const htmlFields = menuHtmlFields({ input });
+    const htmlFields = menuHtmlFields({ input, normalizeHtml: deps.normalizeMenuHtml });
     const menu = {
         id: deps.idGen.newId(),
         workspaceId: input.workspaceId,
@@ -422,7 +422,7 @@ export async function updateMenuTree(required, optional = {}) {
     });
     // Every writer (admin, agent tool, publish repoint, reverters) comes through here, so the stored
     // HTML-mode fields are carried forward unless this write sets them — an items-only save never drops them.
-    const htmlFields = menuHtmlFields({ input, existing: existing.doc });
+    const htmlFields = menuHtmlFields({ input, existing: existing.doc, normalizeHtml: deps.normalizeMenuHtml });
     const menu = {
         ...existing,
         title,

package/dist/navigation/node/index.d.ts

@@ -0,0 +1,30 @@
+import { mergeMenuHtml as mergeUniversalMenuHtml, type MenuHtmlOptions } from "../menu-html.js";
+import { createMenu as createUniversalMenu, updateMenuTree as updateUniversalMenuTree, type CreateMenuRequired, type CreateMenuOptional, type UpdateMenuTreeRequired, type UpdateMenuTreeOptional } from "../menu-service.js";
+import { buildMenusRegistrations as buildUniversalMenusRegistrations, type MenusToolDeps } from "../tool-registrations.js";
+export * from "../index.js";
+/** Balance the fragment; scripts and authored styling stay as written (trusted markup).
+ * @param required Trusted authored markup; the service enforces the length cap before calling.
+ * @returns Balanced fragment, without dangling outer closers.
+ * @complexity O(h) time and space in submitted HTML length.
+ */
+export declare function normalizeMenuHtml({ html }: {
+    html: string;
+}, _optional?: Record<string, never>): string;
+/** Supply Node normalization to the universal create owner; validation, errors, writes and
+ * outbox publication are unchanged. Caller-provided normalization takes precedence.
+ * @complexity Same tree/slug scans as the universal owner, plus O(h) HTML time and space.
+ */
+export declare function createMenu(required: CreateMenuRequired, optional?: CreateMenuOptional): ReturnType<typeof createUniversalMenu>;
+/** Supply Node normalization to the universal update owner, retaining its OCC and event contract.
+ * @complexity Same tree/slug scans as the universal owner, plus O(h) HTML time and space.
+ */
+export declare function updateMenuTree(required: UpdateMenuTreeRequired, optional?: UpdateMenuTreeOptional): ReturnType<typeof updateUniversalMenuTree>;
+/** Preserve the merge API for Node consumers, balancing only submitted HTML.
+ * @complexity O(h) time and space in submitted HTML length; omitted HTML is O(1).
+ */
+export declare function mergeMenuHtml(required: Parameters<typeof mergeUniversalMenuHtml>[0], optional?: MenuHtmlOptions): ReturnType<typeof mergeUniversalMenuHtml>;
+/** Bind Node normalization once for the existing tool builder; permission checks and saves
+ * remain in their universal owners. Construction is O(1) time and space (fixed catalog).
+ */
+export declare function buildMenusRegistrations(required: MenusToolDeps, _optional?: Record<string, never>): ReturnType<typeof buildUniversalMenusRegistrations>;
+//# sourceMappingURL=index.d.ts.map

package/dist/navigation/node/index.js

@@ -0,0 +1,43 @@
+/** Node navigation adapter: the public barrel stays compatible, while HTML writes receive
+ * parse5 normalization. Item services and all persistence/permission policy stay universal.
+ * @example import { createMenu } from "@jini-ai/cms/navigation/node";
+ */
+import { parseFragment, serialize } from "parse5";
+import { mergeMenuHtml as mergeUniversalMenuHtml } from "../menu-html.js";
+import { createMenu as createUniversalMenu, updateMenuTree as updateUniversalMenuTree, } from "../menu-service.js";
+import { buildMenusRegistrations as buildUniversalMenusRegistrations } from "../tool-registrations.js";
+export * from "../index.js";
+/** Balance the fragment; scripts and authored styling stay as written (trusted markup).
+ * @param required Trusted authored markup; the service enforces the length cap before calling.
+ * @returns Balanced fragment, without dangling outer closers.
+ * @complexity O(h) time and space in submitted HTML length.
+ */
+export function normalizeMenuHtml({ html }, _optional = {}) {
+    return serialize(parseFragment(html));
+}
+/** Supply Node normalization to the universal create owner; validation, errors, writes and
+ * outbox publication are unchanged. Caller-provided normalization takes precedence.
+ * @complexity Same tree/slug scans as the universal owner, plus O(h) HTML time and space.
+ */
+export function createMenu(required, optional = {}) {
+    return createUniversalMenu({ ...required, deps: { ...required.deps, normalizeMenuHtml: required.deps.normalizeMenuHtml ?? normalizeMenuHtml } }, optional);
+}
+/** Supply Node normalization to the universal update owner, retaining its OCC and event contract.
+ * @complexity Same tree/slug scans as the universal owner, plus O(h) HTML time and space.
+ */
+export function updateMenuTree(required, optional = {}) {
+    return updateUniversalMenuTree({ ...required, deps: { ...required.deps, normalizeMenuHtml: required.deps.normalizeMenuHtml ?? normalizeMenuHtml } }, optional);
+}
+/** Preserve the merge API for Node consumers, balancing only submitted HTML.
+ * @complexity O(h) time and space in submitted HTML length; omitted HTML is O(1).
+ */
+export function mergeMenuHtml(required, optional = {}) {
+    return mergeUniversalMenuHtml(required, { ...optional, normalizeHtml: optional.normalizeHtml ?? normalizeMenuHtml });
+}
+/** Bind Node normalization once for the existing tool builder; permission checks and saves
+ * remain in their universal owners. Construction is O(1) time and space (fixed catalog).
+ */
+export function buildMenusRegistrations(required, _optional = {}) {
+    return buildUniversalMenusRegistrations({ ...required, normalizeMenuHtml: required.normalizeMenuHtml ?? normalizeMenuHtml });
+}
+//# sourceMappingURL=index.js.map

package/dist/navigation/tool-registrations.d.ts

@@ -3,6 +3,7 @@ import type { Clock } from "@jini-ai/core/primitives";
 import type { AuthorizeFn } from "../core/commands/command.js";
 import type { OutboxPort } from "../core/ports.js";
 import { type DerivedRiskByToolId, type ToolRegistration } from "@jini-ai/core";
+import { type MenuHtmlNormalizer } from "./menu-html.js";
 import type { NavLocationBindingRepoPort } from "./ports.js";
 import type { MenuRepoPort } from "./repo.memory.js";
 /**
@@ -12,6 +13,8 @@ import type { MenuRepoPort } from "./repo.memory.js";
  * route-deps object after binding the kernel clock/ID contracts.
  */
 export interface MenusToolDeps {
+    /** Environment-owned fragment normalizer, forwarded to the audited menu write services. */
+    normalizeMenuHtml?: MenuHtmlNormalizer | undefined;
     authorize: AuthorizeFn;
     workspaceId: string;
     clock: Clock;

package/dist/navigation/tool-registrations.js

@@ -80,7 +80,7 @@ async function requireHtmlAuthoringPermission({ routeDeps, principalId, authorin
     await requireToolPermission({ authorize: adaptLegacyAuthorize({ authorize: routeDeps.authorize }), workspaceId: routeDeps.workspaceId, principalId, permission: routeDeps.rawHtmlPermission }, { entityType: "menu", ...(menuId ? { entityId: menuId } : {}) });
 }
 function menusDeps(routeDeps) {
-    return { repo: routeDeps.menuRepo, clock: routeDeps.clock, idGen: routeDeps.idGen, outbox: routeDeps.outbox };
+    return { repo: routeDeps.menuRepo, clock: routeDeps.clock, idGen: routeDeps.idGen, outbox: routeDeps.outbox, normalizeMenuHtml: routeDeps.normalizeMenuHtml };
 }
 export function buildMenusRegistrations(routeDeps) {
     const handlers = {

package/dist/seo/media.js

@@ -1,4 +1,4 @@
-import { mimeForTransformFormat } from "../media/transform-types.js";
+import { mimeForTransformFormat } from "../core/transform-format.js";
 /**
  * @file `resolveSeoImageRef` (ADR-PIPE-008 Decision §6, C-013, EC-07;
  * EC-07's "never generates" clause AMENDED 2026-09-05 — see the ADR's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/cms",
-  "version": "0.5.6",
+  "version": "0.5.8",
   "description": "Content-model capability for Jini-hosted products: framework-free contracts, ports, and domain services in `/core` and per-domain subpaths; Node-bound adapters in domain-specific subpaths.",
   "license": "Apache-2.0",
   "repository": {
@@ -29,6 +29,15 @@
       "./trash": "universal",
       "./settings/express": "node",
       "./media/node": "node",
+      "./forms/html-render": "universal",
+      "./forms/submission-attempts": "universal",
+      "./widgets/page-embed-types": "universal",
+      "./widgets/html/html-embeds": "node",
+      "./widgets/html/gallery-render": "universal",
+      "./navigation/types": "universal",
+      "./navigation/dropdown": "universal",
+      "./navigation/node": "node",
+      "./media/slug": "universal",
       "./forms": "universal",
       "./forms/html": "node",
       "./forms/sql": "node",
@@ -214,6 +223,51 @@
       "import": "./dist/media/node.js",
       "default": "./dist/media/node.js"
     },
+    "./forms/html-render": {
+      "types": "./dist/forms/html-render.d.ts",
+      "import": "./dist/forms/html-render.js",
+      "default": "./dist/forms/html-render.js"
+    },
+    "./forms/submission-attempts": {
+      "types": "./dist/forms/submission-attempts.d.ts",
+      "import": "./dist/forms/submission-attempts.js",
+      "default": "./dist/forms/submission-attempts.js"
+    },
+    "./widgets/page-embed-types": {
+      "types": "./dist/widgets/page-embed-types.d.ts",
+      "import": "./dist/widgets/page-embed-types.js",
+      "default": "./dist/widgets/page-embed-types.js"
+    },
+    "./widgets/html/html-embeds": {
+      "types": "./dist/widgets/html/html-embeds.d.ts",
+      "import": "./dist/widgets/html/html-embeds.js",
+      "default": "./dist/widgets/html/html-embeds.js"
+    },
+    "./widgets/html/gallery-render": {
+      "types": "./dist/widgets/html/gallery-render.d.ts",
+      "import": "./dist/widgets/html/gallery-render.js",
+      "default": "./dist/widgets/html/gallery-render.js"
+    },
+    "./navigation/types": {
+      "types": "./dist/navigation/types.d.ts",
+      "import": "./dist/navigation/types.js",
+      "default": "./dist/navigation/types.js"
+    },
+    "./navigation/dropdown": {
+      "types": "./dist/navigation/dropdown.d.ts",
+      "import": "./dist/navigation/dropdown.js",
+      "default": "./dist/navigation/dropdown.js"
+    },
+    "./navigation/node": {
+      "types": "./dist/navigation/node/index.d.ts",
+      "import": "./dist/navigation/node/index.js",
+      "default": "./dist/navigation/node/index.js"
+    },
+    "./media/slug": {
+      "types": "./dist/media/slug.d.ts",
+      "import": "./dist/media/slug.js",
+      "default": "./dist/media/slug.js"
+    },
     "./forms": {
       "types": "./dist/forms/index.d.ts",
       "import": "./dist/forms/index.js",
@@ -364,12 +418,12 @@
     "@types/better-sqlite3": "^7.6.13",
     "@electric-sql/pglite": "0.5.8",
     "jsdom": "^25.0.1",
+    "@jini-ai/core": "0.4.4",
     "@jini-ai/http-kit": "0.4.1",
-    "@jini-ai/db": "0.3.2",
-    "@jini-ai/core": "0.4.3"
+    "@jini-ai/db": "0.3.3"
   },
   "dependencies": {
-    "@jini-ai/core": "^0.4.3"
+    "@jini-ai/core": "^0.4.4"
   },
   "peerDependencies": {
     "sharp": "^0.35.3",