@jini-ai/cms 0.5.7 → 0.5.9

package/CHANGELOG.md

@@ -1,3 +1,13 @@
+## 0.5.9 — 2026-10-13
+
+- `./widgets`: write, embed and region services take an optional `entryLocks` dependency, threaded into every `withEntryLock` call. New `getEntryLockState({ owner })` returns one lock state per store object, so a host that rebuilds dependency bags per request still shares one queue per store. Omitting `entryLocks` keeps the previous module-wide state.
+
+## 0.5.8 — 2026-10-13
+
+- New `./navigation/node` subpath: re-exports the full `./navigation` API with parse5 menu-HTML normalization bound into `createMenu`, `updateMenuTree`, `mergeMenuHtml` and `buildMenusRegistrations`. Node hosts writing HTML-mode menus should import those from `./navigation/node`.
+- `./navigation` no longer loads the optional peer `parse5`, so it is universal again. Every name is still exported; an HTML-mode write through it needs an injected `normalizeMenuHtml` (`normalizeHtml` for `mergeMenuHtml`) and otherwise fails before saving. Item-only writes are unchanged.
+- `./seo` no longer reaches the media transform module for rendition MIME types; `TransformFormat` and `mimeForTransformFormat` remain exported from the media entries.
+
 ## 0.5.7 — 2026-10-12
 
 - New render-only leaf subpaths: `./forms/html-render`, `./forms/submission-attempts`, `./widgets/page-embed-types`, `./widgets/html/html-embeds`, `./widgets/html/gallery-render`, `./navigation/types`, `./navigation/dropdown` and `./media/slug` (the media slug rule, still re-exported from `./media`). Existing barrels are unchanged.

package/README.md

@@ -78,6 +78,13 @@ coordination.
 `taxonomy`, `workspace`, and `trash`. `settings` is now a compatibility shim, with implementation
 in `@jini-ai/core/settings`. `./core/tools` re-exports the shared core permission helpers; `./media/import` exports bounded image fetching with injected policies and ports.
 
+`./navigation` stays universal: submitted menu HTML requires an injected `normalizeMenuHtml`
+dependency (`normalizeHtml` for `mergeMenuHtml`). Item-only writes and retained markup need no
+parser. Node hosts use `./navigation/node`, which re-exports the navigation API and supplies
+parse5 normalization to create/update, merge and tool registration. The existing validation,
+raw-HTML permission checks, OCC and outbox owners remain unchanged; an unconfigured universal
+HTML write fails before saving rather than persisting markup that could escape its theme container.
+
 **Still to move:** `post`, `seo`, `comments`, `redirects`, `widgets`, `newsletter`,
 `members`. The unimplemented `./widgets` export has been removed.
 The nested forms package is maintained by its separate owner and is excluded from this parent package.

package/dist/core/transform-format.d.ts

@@ -0,0 +1,19 @@
+/** Shared rendition format metadata. Media validation and SEO use this leaf without loading
+ * either domain's runtime; media/transform-types.ts preserves its existing public exports.
+ */
+/**
+ * Output re-encode format. Matches `media-service.ts`'s
+ * `DEFAULT_ALLOWED_MIME_TYPES` image set minus SVG (never a transform output —
+ * SVG has no raster pixels to resize).
+ */
+export type TransformFormat = "jpeg" | "png" | "webp" | "gif";
+/** Maps a {@link TransformFormat} to the MIME type served on the rendition response. */
+export declare const MIME_BY_TRANSFORM_FORMAT: Record<TransformFormat, string>;
+/**
+ * @complexity O(1).
+ * @overallScore 100
+ */
+export declare function mimeForTransformFormat(requiredArgs: {
+    format: TransformFormat;
+}, optionalArgs?: Record<string, never>): string;
+//# sourceMappingURL=transform-format.d.ts.map

package/dist/core/transform-format.js

@@ -0,0 +1,19 @@
+/** Shared rendition format metadata. Media validation and SEO use this leaf without loading
+ * either domain's runtime; media/transform-types.ts preserves its existing public exports.
+ */
+/** Maps a {@link TransformFormat} to the MIME type served on the rendition response. */
+export const MIME_BY_TRANSFORM_FORMAT = {
+    jpeg: "image/jpeg",
+    png: "image/png",
+    webp: "image/webp",
+    gif: "image/gif",
+};
+/**
+ * @complexity O(1).
+ * @overallScore 100
+ */
+export function mimeForTransformFormat(requiredArgs, optionalArgs = {}) {
+    const { format } = requiredArgs;
+    return MIME_BY_TRANSFORM_FORMAT[format];
+}
+//# sourceMappingURL=transform-format.js.map

package/dist/media/transform-types.d.ts

@@ -22,14 +22,10 @@
  * permission catalog.
  */
 import type { ISODateTime, UUID } from "@jini-ai/core/primitives";
+import { type TransformFormat } from "../core/transform-format.js";
+export { mimeForTransformFormat, type TransformFormat } from "../core/transform-format.js";
 /** Resize behavior, mirrors `sharp`'s `fit` vocabulary (a deliberately small subset). */
 export type TransformFit = "cover" | "contain" | "fill" | "inside" | "outside";
-/**
- * Output re-encode format. Matches `media-service.ts`'s
- * `DEFAULT_ALLOWED_MIME_TYPES` image set minus SVG (never a transform output —
- * SVG has no raster pixels to resize).
- */
-export type TransformFormat = "jpeg" | "png" | "webp" | "gif";
 /**
  * Declarative transform parameters (named definitions only, never
  * caller-supplied dimensions). `width`/`height` are optional so a
@@ -66,13 +62,6 @@ export declare class TransformValidationError extends Error {
         message: string;
     }, optionalArgs?: ErrorOptions);
 }
-/**
- * @complexity O(1).
- * @overallScore 100
- */
-export declare function mimeForTransformFormat(requiredArgs: {
-    format: TransformFormat;
-}, optionalArgs?: Record<string, never>): string;
 /** Upper bound on a requested resize dimension — an output-side resource-use guard (not the
  * full pixel-bomb ingest cap, which polices upload input; this polices the transform
  * definition itself so a registered definition can't ask the image transformer to allocate an

package/dist/media/transform-types.js

@@ -1,23 +1,10 @@
+import { MIME_BY_TRANSFORM_FORMAT } from "../core/transform-format.js";
+export { mimeForTransformFormat } from "../core/transform-format.js";
 export class TransformValidationError extends Error {
     constructor({ message }, optionalArgs = {}) {
         super(message, optionalArgs);
     }
 }
-/** Maps a {@link TransformFormat} to the MIME type served on the rendition response. */
-const MIME_BY_TRANSFORM_FORMAT = {
-    jpeg: "image/jpeg",
-    png: "image/png",
-    webp: "image/webp",
-    gif: "image/gif",
-};
-/**
- * @complexity O(1).
- * @overallScore 100
- */
-export function mimeForTransformFormat(requiredArgs, optionalArgs = {}) {
-    const { format } = requiredArgs;
-    return MIME_BY_TRANSFORM_FORMAT[format];
-}
 /** Upper bound on a requested resize dimension — an output-side resource-use guard (not the
  * full pixel-bomb ingest cap, which polices upload input; this polices the transform
  * definition itself so a registered definition can't ask the image transformer to allocate an

package/dist/navigation/index.d.ts

@@ -27,7 +27,7 @@ export { InMemoryMenuRepo, InMemoryNavLocationBindingRepo, menuVersionConflictEr
  */
 export { createMenu, updateMenuTree, assignLocation, deleteMenu, validateAndCloneTree, isAllowedHref, ALLOWED_HREF_SHAPES_DESCRIPTION, MenuNotFoundError, MenuValidationError, MenuConflictError, MenuVersionConflictError, MenuLocationBoundError, DEFAULT_MAX_TREE_DEPTH, DEFAULT_MAX_ITEM_COUNT, type TreeValidationLimits, type CreateMenuDeps, type CreateMenuServiceInput, type CreateMenuRequired, type CreateMenuOptional, type UpdateMenuTreeDeps, type UpdateMenuTreeServiceInput, type UpdateMenuTreeRequired, type UpdateMenuTreeOptional, type AssignLocationDeps, type AssignLocationServiceInput, type AssignLocationRequired, type AssignLocationOptional, type DeleteMenuDeps, type DeleteMenuServiceInput, type DeleteMenuRequired, type DeleteMenuOptional, } from "./menu-service.js";
 /** HTML mode (2026-10-08): validation/normalization for a menu's author-written markup. */
-export { MAX_MENU_HTML_LENGTH, isMenuHtmlAuthoring, menuHtmlInputProblem, mergeMenuHtml, type MenuHtmlAuthoring, } from "./menu-html.js";
+export { MAX_MENU_HTML_LENGTH, isMenuHtmlAuthoring, menuHtmlInputProblem, mergeMenuHtml, type MenuHtmlAuthoring, type MenuHtmlNormalizer, type MenuHtmlOptions, } from "./menu-html.js";
 export { resolveForLocation, resolveMenuDoc, type ResolveTargetHrefFn, type ResolvedTargetHref, type ResolveForLocationDeps, type ResolveForLocationServiceInput, type ResolveForLocationRequired, type ResolveForLocationOptional, } from "./resolver.js";
 export { rebuildNavLocationBindings, type RebuildNavLocationBindingsDeps, type RebuildNavLocationBindingsResult, } from "./reconcile.js";
 /** Dropdown menus (2026-10-11): toggle markup + the inline keyboard/touch script (see `dropdown.ts`). */

package/dist/navigation/menu-html.d.ts

@@ -1,3 +1,17 @@
+/**
+ * @file HTML mode for a menu (2026-10-08): the author writes the menu's markup by hand instead of
+ * building an item tree, so it can be styled however they want.
+ *
+ * Same trust model as HTML-mode forms (`forms/html/html-authoring.ts`) and HTML Pages: the markup is
+ * admin/owner-trusted and NOT sanitized. Hosts gate it behind their raw-HTML permission (Tovu binds
+ * `pages.edit_html`, the one forms use); this module only validates and merges. The injected
+ * normalizer balances the fragment so a stray `</nav>` or an unclosed `<div>` cannot close or
+ * swallow the theme element the menu renders inside. The Node adapter supplies parse5; the
+ * universal entry never loads a parser or assumes a browser DOM.
+ *
+ * Both modes' data live side by side in the doc: switching mode never deletes the other one, so an
+ * author can flip back and find their items (or their HTML) still there.
+ */
 import type { NavMenuDoc, NavMenuMode } from "./types.js";
 /** Same ceiling HTML-mode forms use. */
 export declare const MAX_MENU_HTML_LENGTH = 200000;
@@ -12,6 +26,14 @@ export interface MenuHtmlAuthoring {
  * @complexity O(1).
  */
 export declare function isMenuHtmlAuthoring({ mode, html }: MenuHtmlAuthoring, _optional?: Record<string, never>): boolean;
+/** Balance a trusted HTML fragment while preserving scripts and authored styling. */
+export type MenuHtmlNormalizer = (required: {
+    html: string;
+}, optional?: Record<string, never>) => string;
+/** A host supplies its environment's fragment parser; omitted is valid for item-only writes. */
+export interface MenuHtmlOptions {
+    normalizeHtml?: MenuHtmlNormalizer | undefined;
+}
 /**
  * Why a write's `mode`/`html` is invalid, or `null` when it is fine. A message rather than a throw so
  * `menu-service.ts` raises its own `MenuValidationError` without this file importing it back.
@@ -22,10 +44,12 @@ export declare function menuHtmlInputProblem({ mode, html }: MenuHtmlAuthoring,
  * The doc's `mode`/`html` after a valid write: submitted values win, omitted ones keep what is
  * stored, and a menu that never used HTML mode gets neither key, so its stored doc (and publish
  * hash) is unchanged. Call {@link menuHtmlInputProblem} first.
+ * @param optional Host fragment normalizer, required when input.html is supplied.
+ * @throws {Error} Submitted markup has no configured normalizer; never saves unbalanced HTML.
  * @complexity O(h) in the submitted html length (one parse + serialize).
  */
 export declare function mergeMenuHtml({ input, existing }: {
     input: MenuHtmlAuthoring;
     existing?: Pick<NavMenuDoc, "mode" | "html"> | undefined;
-}, _optional?: Record<string, never>): Pick<NavMenuDoc, "mode" | "html">;
+}, optional?: MenuHtmlOptions): Pick<NavMenuDoc, "mode" | "html">;
 //# sourceMappingURL=menu-html.d.ts.map

package/dist/navigation/menu-html.js

@@ -1,17 +1,3 @@
-/**
- * @file HTML mode for a menu (2026-10-08): the author writes the menu's markup by hand instead of
- * building an item tree, so it can be styled however they want.
- *
- * Same trust model as HTML-mode forms (`forms/html/html-authoring.ts`) and HTML Pages: the markup is
- * admin/owner-trusted and NOT sanitized. Hosts gate it behind their raw-HTML permission (Tovu binds
- * `pages.edit_html`, the one forms use); this module only validates and normalizes. parse5 balances
- * the fragment so a stray `</nav>` or an unclosed `<div>` cannot close or swallow the theme element
- * the menu renders inside.
- *
- * Both modes' data live side by side in the doc: switching mode never deletes the other one, so an
- * author can flip back and find their items (or their HTML) still there.
- */
-import { parseFragment, serialize } from "parse5";
 /** Same ceiling HTML-mode forms use. */
 export const MAX_MENU_HTML_LENGTH = 200_000;
 /**
@@ -22,10 +8,6 @@ export const MAX_MENU_HTML_LENGTH = 200_000;
 export function isMenuHtmlAuthoring({ mode, html }, _optional = {}) {
     return html !== undefined || mode === "html";
 }
-/** Balance the fragment; scripts and authored styling stay as written (trusted markup). */
-function normalizeMenuHtml(html) {
-    return serialize(parseFragment(html));
-}
 /**
  * Why a write's `mode`/`html` is invalid, or `null` when it is fine. A message rather than a throw so
  * `menu-service.ts` raises its own `MenuValidationError` without this file importing it back.
@@ -43,11 +25,18 @@ export function menuHtmlInputProblem({ mode, html }, _optional = {}) {
  * The doc's `mode`/`html` after a valid write: submitted values win, omitted ones keep what is
  * stored, and a menu that never used HTML mode gets neither key, so its stored doc (and publish
  * hash) is unchanged. Call {@link menuHtmlInputProblem} first.
+ * @param optional Host fragment normalizer, required when input.html is supplied.
+ * @throws {Error} Submitted markup has no configured normalizer; never saves unbalanced HTML.
  * @complexity O(h) in the submitted html length (one parse + serialize).
  */
-export function mergeMenuHtml({ input, existing }, _optional = {}) {
+export function mergeMenuHtml({ input, existing }, optional = {}) {
     const mode = input.mode ?? existing?.mode;
-    const html = input.html !== undefined ? normalizeMenuHtml(input.html) : existing?.html;
+    let html = existing?.html;
+    if (input.html !== undefined) {
+        if (!optional.normalizeHtml)
+            throw new Error("Menu HTML normalization is not configured");
+        html = optional.normalizeHtml({ html: input.html });
+    }
     return { ...(mode !== undefined ? { mode } : {}), ...(html !== undefined ? { html } : {}) };
 }
 //# sourceMappingURL=menu-html.js.map

package/dist/navigation/menu-service.d.ts

@@ -2,6 +2,7 @@ import type { Clock, IdGenerator, UUID } from "@jini-ai/core/primitives";
 import type { OutboxPort } from "../core/ports.js";
 import type { MenuRepoPort } from "./repo.memory.js";
 import type { NavLocationBindingRepoPort } from "./ports.js";
+import { type MenuHtmlNormalizer } from "./menu-html.js";
 import { type NavItemNode, type NavLocationBindingRow, type NavLocationKey, type NavMenuEntry, type NavMenuMode } from "./types.js";
 export declare class MenuNotFoundError extends Error {
     constructor({ message }: {
@@ -135,6 +136,8 @@ export declare function validateAndCloneTree({ items }: {
     items: readonly NavItemNode[];
 }, limits?: TreeValidationLimits): NavItemNode[];
 export interface CreateMenuDeps {
+    /** Required for submitted HTML; Node hosts can use the navigation/node adapter. */
+    normalizeMenuHtml?: MenuHtmlNormalizer | undefined;
     repo: MenuRepoPort;
     clock: Clock;
     idGen: IdGenerator;
@@ -177,6 +180,8 @@ export declare function createMenu(required: CreateMenuRequired, optional?: Crea
     menu: NavMenuEntry;
 }>;
 export interface UpdateMenuTreeDeps {
+    /** Required for submitted HTML; omitted markup retains the already-normalized stored value. */
+    normalizeMenuHtml?: MenuHtmlNormalizer | undefined;
     repo: MenuRepoPort;
     clock: Clock;
     /** Not previously present on this deps bag — needed to mint the outbox event's id. */

package/dist/navigation/menu-service.js

@@ -283,11 +283,11 @@ function assertValidTitleAndSlug(title, slug) {
     }
 }
 /** Validated, merged HTML-mode doc fields — `menu-html.ts`'s problem check raised as this file's own error. */
-function menuHtmlFields({ input, existing }) {
+function menuHtmlFields({ input, existing, normalizeHtml }) {
     const problem = menuHtmlInputProblem(input);
     if (problem)
         throw new MenuValidationError({ message: problem });
-    return mergeMenuHtml({ input, existing });
+    return mergeMenuHtml({ input, existing }, { normalizeHtml });
 }
 /**
  * Creates a new `menu` entry in `published` status with no location
@@ -313,7 +313,7 @@ export async function createMenu(required, optional = {}) {
     if (duplicate)
         throw new MenuConflictError({ message: `slug '${slug}' already exists` });
     const items = validateAndCloneTree({ items: input.items ?? [] }, optional.limits);
-    const htmlFields = menuHtmlFields({ input });
+    const htmlFields = menuHtmlFields({ input, normalizeHtml: deps.normalizeMenuHtml });
     const menu = {
         id: deps.idGen.newId(),
         workspaceId: input.workspaceId,
@@ -422,7 +422,7 @@ export async function updateMenuTree(required, optional = {}) {
     });
     // Every writer (admin, agent tool, publish repoint, reverters) comes through here, so the stored
     // HTML-mode fields are carried forward unless this write sets them — an items-only save never drops them.
-    const htmlFields = menuHtmlFields({ input, existing: existing.doc });
+    const htmlFields = menuHtmlFields({ input, existing: existing.doc, normalizeHtml: deps.normalizeMenuHtml });
     const menu = {
         ...existing,
         title,

package/dist/navigation/node/index.d.ts

@@ -0,0 +1,30 @@
+import { mergeMenuHtml as mergeUniversalMenuHtml, type MenuHtmlOptions } from "../menu-html.js";
+import { createMenu as createUniversalMenu, updateMenuTree as updateUniversalMenuTree, type CreateMenuRequired, type CreateMenuOptional, type UpdateMenuTreeRequired, type UpdateMenuTreeOptional } from "../menu-service.js";
+import { buildMenusRegistrations as buildUniversalMenusRegistrations, type MenusToolDeps } from "../tool-registrations.js";
+export * from "../index.js";
+/** Balance the fragment; scripts and authored styling stay as written (trusted markup).
+ * @param required Trusted authored markup; the service enforces the length cap before calling.
+ * @returns Balanced fragment, without dangling outer closers.
+ * @complexity O(h) time and space in submitted HTML length.
+ */
+export declare function normalizeMenuHtml({ html }: {
+    html: string;
+}, _optional?: Record<string, never>): string;
+/** Supply Node normalization to the universal create owner; validation, errors, writes and
+ * outbox publication are unchanged. Caller-provided normalization takes precedence.
+ * @complexity Same tree/slug scans as the universal owner, plus O(h) HTML time and space.
+ */
+export declare function createMenu(required: CreateMenuRequired, optional?: CreateMenuOptional): ReturnType<typeof createUniversalMenu>;
+/** Supply Node normalization to the universal update owner, retaining its OCC and event contract.
+ * @complexity Same tree/slug scans as the universal owner, plus O(h) HTML time and space.
+ */
+export declare function updateMenuTree(required: UpdateMenuTreeRequired, optional?: UpdateMenuTreeOptional): ReturnType<typeof updateUniversalMenuTree>;
+/** Preserve the merge API for Node consumers, balancing only submitted HTML.
+ * @complexity O(h) time and space in submitted HTML length; omitted HTML is O(1).
+ */
+export declare function mergeMenuHtml(required: Parameters<typeof mergeUniversalMenuHtml>[0], optional?: MenuHtmlOptions): ReturnType<typeof mergeUniversalMenuHtml>;
+/** Bind Node normalization once for the existing tool builder; permission checks and saves
+ * remain in their universal owners. Construction is O(1) time and space (fixed catalog).
+ */
+export declare function buildMenusRegistrations(required: MenusToolDeps, _optional?: Record<string, never>): ReturnType<typeof buildUniversalMenusRegistrations>;
+//# sourceMappingURL=index.d.ts.map

package/dist/navigation/node/index.js

@@ -0,0 +1,43 @@
+/** Node navigation adapter: the public barrel stays compatible, while HTML writes receive
+ * parse5 normalization. Item services and all persistence/permission policy stay universal.
+ * @example import { createMenu } from "@jini-ai/cms/navigation/node";
+ */
+import { parseFragment, serialize } from "parse5";
+import { mergeMenuHtml as mergeUniversalMenuHtml } from "../menu-html.js";
+import { createMenu as createUniversalMenu, updateMenuTree as updateUniversalMenuTree, } from "../menu-service.js";
+import { buildMenusRegistrations as buildUniversalMenusRegistrations } from "../tool-registrations.js";
+export * from "../index.js";
+/** Balance the fragment; scripts and authored styling stay as written (trusted markup).
+ * @param required Trusted authored markup; the service enforces the length cap before calling.
+ * @returns Balanced fragment, without dangling outer closers.
+ * @complexity O(h) time and space in submitted HTML length.
+ */
+export function normalizeMenuHtml({ html }, _optional = {}) {
+    return serialize(parseFragment(html));
+}
+/** Supply Node normalization to the universal create owner; validation, errors, writes and
+ * outbox publication are unchanged. Caller-provided normalization takes precedence.
+ * @complexity Same tree/slug scans as the universal owner, plus O(h) HTML time and space.
+ */
+export function createMenu(required, optional = {}) {
+    return createUniversalMenu({ ...required, deps: { ...required.deps, normalizeMenuHtml: required.deps.normalizeMenuHtml ?? normalizeMenuHtml } }, optional);
+}
+/** Supply Node normalization to the universal update owner, retaining its OCC and event contract.
+ * @complexity Same tree/slug scans as the universal owner, plus O(h) HTML time and space.
+ */
+export function updateMenuTree(required, optional = {}) {
+    return updateUniversalMenuTree({ ...required, deps: { ...required.deps, normalizeMenuHtml: required.deps.normalizeMenuHtml ?? normalizeMenuHtml } }, optional);
+}
+/** Preserve the merge API for Node consumers, balancing only submitted HTML.
+ * @complexity O(h) time and space in submitted HTML length; omitted HTML is O(1).
+ */
+export function mergeMenuHtml(required, optional = {}) {
+    return mergeUniversalMenuHtml(required, { ...optional, normalizeHtml: optional.normalizeHtml ?? normalizeMenuHtml });
+}
+/** Bind Node normalization once for the existing tool builder; permission checks and saves
+ * remain in their universal owners. Construction is O(1) time and space (fixed catalog).
+ */
+export function buildMenusRegistrations(required, _optional = {}) {
+    return buildUniversalMenusRegistrations({ ...required, normalizeMenuHtml: required.normalizeMenuHtml ?? normalizeMenuHtml });
+}
+//# sourceMappingURL=index.js.map

package/dist/navigation/tool-registrations.d.ts

@@ -3,6 +3,7 @@ import type { Clock } from "@jini-ai/core/primitives";
 import type { AuthorizeFn } from "../core/commands/command.js";
 import type { OutboxPort } from "../core/ports.js";
 import { type DerivedRiskByToolId, type ToolRegistration } from "@jini-ai/core";
+import { type MenuHtmlNormalizer } from "./menu-html.js";
 import type { NavLocationBindingRepoPort } from "./ports.js";
 import type { MenuRepoPort } from "./repo.memory.js";
 /**
@@ -12,6 +13,8 @@ import type { MenuRepoPort } from "./repo.memory.js";
  * route-deps object after binding the kernel clock/ID contracts.
  */
 export interface MenusToolDeps {
+    /** Environment-owned fragment normalizer, forwarded to the audited menu write services. */
+    normalizeMenuHtml?: MenuHtmlNormalizer | undefined;
     authorize: AuthorizeFn;
     workspaceId: string;
     clock: Clock;

package/dist/navigation/tool-registrations.js

@@ -80,7 +80,7 @@ async function requireHtmlAuthoringPermission({ routeDeps, principalId, authorin
     await requireToolPermission({ authorize: adaptLegacyAuthorize({ authorize: routeDeps.authorize }), workspaceId: routeDeps.workspaceId, principalId, permission: routeDeps.rawHtmlPermission }, { entityType: "menu", ...(menuId ? { entityId: menuId } : {}) });
 }
 function menusDeps(routeDeps) {
-    return { repo: routeDeps.menuRepo, clock: routeDeps.clock, idGen: routeDeps.idGen, outbox: routeDeps.outbox };
+    return { repo: routeDeps.menuRepo, clock: routeDeps.clock, idGen: routeDeps.idGen, outbox: routeDeps.outbox, normalizeMenuHtml: routeDeps.normalizeMenuHtml };
 }
 export function buildMenusRegistrations(routeDeps) {
     const handlers = {

package/dist/seo/media.js

@@ -1,4 +1,4 @@
-import { mimeForTransformFormat } from "../media/transform-types.js";
+import { mimeForTransformFormat } from "../core/transform-format.js";
 /**
  * @file `resolveSeoImageRef` (ADR-PIPE-008 Decision §6, C-013, EC-07;
  * EC-07's "never generates" clause AMENDED 2026-09-05 — see the ADR's

package/dist/widgets/concurrency.d.ts

@@ -22,6 +22,11 @@ export type EntryLockState = Map<string, Promise<void>>;
 /** A host can own this state; the compatibility adapter still serializes existing callers.
  * Idle keys are removed by withEntryLock. @complexity O(1). */
 export declare function createEntryLockState(_required: Record<string, never>, _optional?: Record<string, never>): EntryLockState;
+/** Repeated dependency composition for the same store retains one lock queue.
+ * The weak owner reference lets disposed stores and their idle state be collected. @complexity O(1). */
+export declare function getEntryLockState({ owner }: {
+    readonly owner: object;
+}, _optional?: Record<string, never>): EntryLockState;
 /**
  * Runs `fn` exclusively with respect to every other `withEntryLock` call sharing the same `key` —
  * callers queue in call order, each waiting for the previous holder to finish.

package/dist/widgets/concurrency.js

@@ -3,6 +3,17 @@
 export function createEntryLockState(_required, _optional = {}) {
     return new Map();
 }
+const ownedLocks = new WeakMap();
+/** Repeated dependency composition for the same store retains one lock queue.
+ * The weak owner reference lets disposed stores and their idle state be collected. @complexity O(1). */
+export function getEntryLockState({ owner }, _optional = {}) {
+    let locks = ownedLocks.get(owner);
+    if (!locks) {
+        locks = createEntryLockState({});
+        ownedLocks.set(owner, locks);
+    }
+    return locks;
+}
 const defaultLocks = createEntryLockState({});
 /**
  * Runs `fn` exclusively with respect to every other `withEntryLock` call sharing the same `key` —

package/dist/widgets/embed-service.d.ts

@@ -29,7 +29,10 @@ import type { ContentTypeRepoPort } from "../content-types/index.js";
 import type { EntryRecord, EntryRepoPort } from "../entries/index.js";
 import type { WidgetHostPorts, BeforeSaveHookPort, PostRecord, ForgetRemovedPostFn, PostRepoPort } from "./host-ports.js";
 import { type WidgetsAuthorizeFn } from "./authorize-helper.js";
+import { type EntryLockState } from "./concurrency.js";
 export interface EmbedServiceDeps {
+    /** One store-owned state shared by write, embed and region services; omission preserves compatibility. */
+    entryLocks?: EntryLockState;
     host: Pick<WidgetHostPorts, "entries" | "entryRefs" | "posts">;
     entryRepo: EntryRepoPort;
     contentTypeRepo: ContentTypeRepoPort;

package/dist/widgets/embed-service.js

@@ -381,7 +381,7 @@ export async function insertWidgetEmbed(required, _optional = {}) {
                 ? await writeHostBody(deps, input.workspaceId, input.actor, host.record, input.baseVersion, nextBodyJson)
                 : await writePostHostBody(deps, input.workspaceId, input.actor, host.record, input.baseVersion, nextBodyJson);
             return { entry, placementId };
-        } });
+        } }, deps.entryLocks ? { locks: deps.entryLocks } : {});
 }
 /** REQ-44/45: removes the `widgetEmbed` node matching `placementId` from the host entry's body —
  * the placement itself is removed (the widget instance it referenced is untouched). */
@@ -407,7 +407,7 @@ export async function removeWidgetEmbed(required, _optional = {}) {
                 ? await writeHostBody(deps, input.workspaceId, input.actor, host.record, input.baseVersion, nextBodyJson)
                 : await writePostHostBody(deps, input.workspaceId, input.actor, host.record, input.baseVersion, nextBodyJson);
             return { entry };
-        } });
+        } }, deps.entryLocks ? { locks: deps.entryLocks } : {});
 }
 export class WidgetEmbedReorderCountMismatchError extends Error {
     expectedCount;
@@ -455,6 +455,6 @@ export async function reorderWidgetEmbeds(required, _optional = {}) {
                 ? await writeHostBody(deps, input.workspaceId, input.actor, host.record, input.baseVersion, nextBodyJson)
                 : await writePostHostBody(deps, input.workspaceId, input.actor, host.record, input.baseVersion, nextBodyJson);
             return { entry };
-        } });
+        } }, deps.entryLocks ? { locks: deps.entryLocks } : {});
 }
 //# sourceMappingURL=embed-service.js.map

package/dist/widgets/region-area-service.d.ts

@@ -24,9 +24,12 @@ import type { EntryRefsRepoPort } from "./ports.js";
 import type { ContentTypeRepoPort } from "../content-types/index.js";
 import type { EntryListPort, EntryRepoPort } from "../entries/index.js";
 import { type WidgetsAuthorizeFn } from "./authorize-helper.js";
+import { type EntryLockState } from "./concurrency.js";
 import type { WidgetRegionBindingRepoPort } from "./ports.js";
 import type { WidgetAreaEntry, WidgetPlacementNode, WidgetRegionKey } from "./types.js";
 export interface RegionAreaServiceDeps {
+    /** One store-owned state shared by write, embed and region services; omission preserves compatibility. */
+    entryLocks?: EntryLockState;
     host: Pick<WidgetHostPorts, "entries" | "contentTypes" | "entryRefs">;
     entryRepo: EntryRepoPort & EntryListPort;
     contentTypeRepo: ContentTypeRepoPort;

package/dist/widgets/region-area-service.js

@@ -78,7 +78,7 @@ export async function bindWidgetArea(required, _optional = {}) {
                 updatedAt: clockNowIso({ clock: deps.clock }),
             });
             return { areaEntry: toWidgetAreaEntry({ entry: entry }) };
-        } });
+        } }, deps.entryLocks ? { locks: deps.entryLocks } : {});
 }
 /** REQ-16/AC-10: every referenced widgetEntryId must exist, be a live (non-trashed) widget instance,
  *  in this same workspace — checked before any write. Throws the first violation found. */
@@ -142,7 +142,7 @@ export async function mutateWidgetAreaPlacements(required, _optional = {}) {
                 updatedAt: clockNowIso({ clock: deps.clock }),
             });
             return { areaEntry: toWidgetAreaEntry({ entry: result.value.entry }) };
-        } });
+        } }, deps.entryLocks ? { locks: deps.entryLocks } : {});
 }
 /**
  * REQ-12/14: reconciles `widget_region_bindings` from the authoritative `widget_area` entries. The

package/dist/widgets/write-service.d.ts

@@ -29,10 +29,13 @@ import type { EntryRefsRepoPort } from "./ports.js";
 import type { ContentTypeRepoPort } from "../content-types/index.js";
 import type { EntryListPort, EntryRepoPort } from "../entries/index.js";
 import { type WidgetsAuthorizeFn } from "./authorize-helper.js";
+import { type EntryLockState } from "./concurrency.js";
 import type { RemoveWidgetFn } from "./ports.js";
 import type { WidgetInstanceEntry, WidgetTypeKey } from "./types.js";
 import type { WidgetHostPorts } from "./host-ports.js";
 export interface WidgetWriteServiceDeps {
+    /** One store-owned state shared by write, embed and region services; omission preserves compatibility. */
+    entryLocks?: EntryLockState;
     host: Pick<WidgetHostPorts, "entries" | "contentTypes" | "entryRefs" | "slugify">;
     entryRepo: EntryRepoPort & EntryListPort;
     contentTypeRepo: ContentTypeRepoPort;
@@ -128,7 +131,7 @@ export interface WidgetTrashDeps extends WidgetWriteServiceDeps {
     remove: RemoveWidgetFn;
 }
 export interface TrashWidgetInstanceRequired {
-    deps: Pick<WidgetTrashDeps, "entryRepo" | "clock" | "authorize" | "remove">;
+    deps: Pick<WidgetTrashDeps, "entryRepo" | "clock" | "authorize" | "remove" | "entryLocks">;
     input: TrashWidgetInstanceInput;
 }
 /**

package/dist/widgets/write-service.js

@@ -135,7 +135,7 @@ export async function updateWidgetInstance(required, _optional = {}) {
                 throw result.error;
             }
             return { instance: toWidgetInstanceEntry({ entry: result.value.entry }) };
-        } });
+        } }, deps.entryLocks ? { locks: deps.entryLocks } : {});
 }
 /**
  * Publish-content's widget write: create-or-update at a caller-given id, with the same permission,
@@ -182,7 +182,7 @@ export async function importWidgetInstance(required, _optional = {}) {
             if (!result.ok)
                 throw result.error;
             return { instance: toWidgetInstanceEntry({ entry: result.value.entry }) };
-        } });
+        } }, deps.entryLocks ? { locks: deps.entryLocks } : {});
 }
 /**
  * Deleting a widget = moving it to the Trash (the injected `remove`). UNCONDITIONAL, per ADR-047 §7
@@ -226,7 +226,7 @@ export async function trashWidgetInstance(required, _optional = {}) {
             if (!fresh)
                 throw notFound();
             throw new WidgetVersionConflictError({ message: `widget instance '${input.widgetInstanceId}' changed while it was being deleted — reload and try again`, currentVersion: fresh.version });
-        } });
+        } }, deps.entryLocks ? { locks: deps.entryLocks } : {});
 }
 /** The payload statuses the old delete ladder left behind: `trash` (step 1) and `purged` (its
  *  "delete permanently", which never removed the row). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/cms",
-  "version": "0.5.7",
+  "version": "0.5.9",
   "description": "Content-model capability for Jini-hosted products: framework-free contracts, ports, and domain services in `/core` and per-domain subpaths; Node-bound adapters in domain-specific subpaths.",
   "license": "Apache-2.0",
   "repository": {
@@ -36,6 +36,7 @@
       "./widgets/html/gallery-render": "universal",
       "./navigation/types": "universal",
       "./navigation/dropdown": "universal",
+      "./navigation/node": "node",
       "./media/slug": "universal",
       "./forms": "universal",
       "./forms/html": "node",
@@ -257,6 +258,11 @@
       "import": "./dist/navigation/dropdown.js",
       "default": "./dist/navigation/dropdown.js"
     },
+    "./navigation/node": {
+      "types": "./dist/navigation/node/index.d.ts",
+      "import": "./dist/navigation/node/index.js",
+      "default": "./dist/navigation/node/index.js"
+    },
     "./media/slug": {
       "types": "./dist/media/slug.d.ts",
       "import": "./dist/media/slug.js",
@@ -412,8 +418,8 @@
     "@types/better-sqlite3": "^7.6.13",
     "@electric-sql/pglite": "0.5.8",
     "jsdom": "^25.0.1",
-    "@jini-ai/core": "0.4.4",
     "@jini-ai/db": "0.3.3",
+    "@jini-ai/core": "0.4.4",
     "@jini-ai/http-kit": "0.4.1"
   },
   "dependencies": {