@actuate-media/cms-core 0.88.0 → 0.90.0

package/dist/redirects/recovery.js

@@ -0,0 +1,176 @@
+/**
+ * Unified 404 redirect recovery — legitimacy gate + heuristic matching.
+ * Used by the Redirects tab generator and the SEO audit pipeline.
+ */
+import { normalizeRedirectPath } from './graph.js';
+import { scorePathLegitimacy } from './legitimacy.js';
+import { resolveRedirectMatch } from './rerank.js';
+import { validateRedirectDestination } from './validate-destination.js';
+function normalizeBrokenHref(href, siteUrl) {
+    const trimmed = href.trim();
+    if (!trimmed ||
+        trimmed.startsWith('#') ||
+        trimmed.startsWith('mailto:') ||
+        trimmed.startsWith('tel:')) {
+        return null;
+    }
+    if (/^https?:\/\//i.test(trimmed)) {
+        const base = siteUrl.replace(/\/+$/, '').toLowerCase();
+        if (!base || !trimmed.toLowerCase().startsWith(base))
+            return null;
+        return normalizeRedirectPath(trimmed.slice(base.length) || '/');
+    }
+    return normalizeRedirectPath(trimmed);
+}
+/** Merge 404 hit paths and audit broken-link hrefs into one deduped map. */
+export function collectRecoveryPaths(hits, brokenLinks, siteUrl = '') {
+    const map = new Map();
+    for (const hit of hits) {
+        const path = normalizeRedirectPath(hit.path);
+        if (!path || path === '/')
+            continue;
+        const prev = map.get(path) ?? { hasInternalLink: false, hitCount: 0 };
+        prev.hitCount = Math.max(prev.hitCount, Number(hit.hits ?? 0));
+        map.set(path, prev);
+    }
+    for (const link of brokenLinks) {
+        const path = normalizeBrokenHref(link.url, siteUrl);
+        if (!path || path === '/')
+            continue;
+        const prev = map.get(path) ?? { hasInternalLink: false, hitCount: 0 };
+        prev.hasInternalLink = true;
+        map.set(path, prev);
+    }
+    return map;
+}
+/** Plan a single recovery redirect, or null when illegitimate / no match. */
+export async function planRecoveryRedirect(fromPath, signals, options) {
+    const path = normalizeRedirectPath(fromPath);
+    if (!path || path === '/')
+        return null;
+    const legitimacy = scorePathLegitimacy(path, {
+        hasInternalLink: signals.hasInternalLink,
+        hitCount: signals.hitCount,
+        pathPrefixes: options.pathPrefixes,
+    });
+    if (!legitimacy.legitimate)
+        return null;
+    const match = await resolveRedirectMatch(path, options.candidates, {
+        minConfidence: options.minConfidence ?? 30,
+        enableAiRerank: options.enableAiRerank,
+        semanticRerank: options.semanticRerank,
+    });
+    if (!match)
+        return null;
+    return {
+        fromPath: path,
+        toPath: match.toPath,
+        confidence: match.confidence,
+        reason: match.reason,
+        legitimacyScore: legitimacy.score,
+        legitimacyReasons: legitimacy.reasons,
+        matchSource: match.matchSource,
+    };
+}
+/** Plan recovery redirects for all collected paths. */
+export async function planRecoveryRedirects(pathMap, options) {
+    const plans = [];
+    for (const [path, signals] of pathMap) {
+        const plan = await planRecoveryRedirect(path, signals, options);
+        if (plan)
+            plans.push(plan);
+    }
+    return plans;
+}
+/** Create a 301 redirect from a recovery plan (shared by auto-apply and audit fixes). */
+export async function createRecoveryRedirect(db, plan, userId) {
+    if (!db.redirect?.upsert)
+        return;
+    const destErr = validateRedirectDestination(plan.toPath, 301);
+    if (destErr) {
+        throw new Error(`Recovery redirect rejected: ${destErr}`);
+    }
+    await db.redirect.upsert({
+        where: { source: plan.fromPath },
+        create: {
+            source: plan.fromPath,
+            destination: plan.toPath,
+            statusCode: 301,
+            enabled: true,
+            source_kind: 'ai-404-recovery',
+            createdById: userId || undefined,
+        },
+        update: {
+            destination: plan.toPath,
+            statusCode: 301,
+            enabled: true,
+            source_kind: 'ai-404-recovery',
+        },
+    });
+    if (db.redirect404Hit?.updateMany) {
+        await db.redirect404Hit
+            .updateMany({
+            where: { path: plan.fromPath },
+            data: { resolvedAt: new Date() },
+        })
+            .catch(() => { });
+    }
+}
+/** Persist open redirect suggestions; skips paths that already have one. */
+export async function upsertRedirectSuggestions(db, plans) {
+    if (!db.redirectSuggestion?.create)
+        return 0;
+    let created = 0;
+    for (const plan of plans) {
+        const existing = await db.redirectSuggestion.findFirst({
+            where: { fromPath: plan.fromPath, status: 'open' },
+        });
+        if (existing)
+            continue;
+        await db.redirectSuggestion.create({
+            data: {
+                fromPath: plan.fromPath,
+                toPath: plan.toPath,
+                confidence: Math.round(plan.confidence),
+                reason: plan.reason,
+                status: 'open',
+                source: 'ai-404-recovery',
+                metadata: {
+                    legitimacyScore: plan.legitimacyScore,
+                    legitimacyReasons: plan.legitimacyReasons,
+                    ...(plan.matchSource ? { matchSource: plan.matchSource } : {}),
+                },
+            },
+        });
+        created++;
+    }
+    return created;
+}
+/** Full pipeline: collect paths, plan matches, persist suggestions. */
+export async function generateRecoverySuggestions(db, options) {
+    const hits = options.include404Hits !== false && db.redirect404Hit?.findMany
+        ? await db.redirect404Hit.findMany({ where: { resolvedAt: null }, take: 5000 })
+        : [];
+    const pathMap = collectRecoveryPaths(hits, options.brokenLinks ?? [], options.siteUrl ?? '');
+    const plans = await planRecoveryRedirects(pathMap, {
+        candidates: options.candidates,
+        pathPrefixes: options.pathPrefixes,
+        enableAiRerank: options.enableAiRerank,
+        semanticRerank: options.semanticRerank,
+    });
+    const autoMin = options.autoApplyMinConfidence ?? 85;
+    let created = 0;
+    let autoApplied = 0;
+    const pending = [];
+    for (const plan of plans) {
+        if (options.autoApply && plan.confidence >= autoMin) {
+            await createRecoveryRedirect(db, plan, options.autoApplyUserId);
+            autoApplied++;
+            continue;
+        }
+        pending.push(plan);
+    }
+    created = await upsertRedirectSuggestions(db, pending);
+    return { created, planned: plans.length, autoApplied };
+}
+//# sourceMappingURL=recovery.js.map

package/dist/redirects/recovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery.js","sourceRoot":"","sources":["../../src/redirects/recovery.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAClD,OAAO,EAAE,mBAAmB,EAA0B,MAAM,iBAAiB,CAAA;AAE7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAA;AAkCvE,SAAS,mBAAmB,CAAC,IAAY,EAAE,OAAe;IACxD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IACE,CAAC,OAAO;QACR,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QACvB,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC;QAC7B,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAC1B,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QACtD,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACjE,OAAO,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAA;AACvC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,oBAAoB,CAClC,IAA4C,EAC5C,WAA4B,EAC5B,OAAO,GAAG,EAAE;IAEZ,MAAM,GAAG,GAAG,IAAI,GAAG,EAA+B,CAAA;IAElD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG;YAAE,SAAQ;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAA;QACrE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAA;QAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACrB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QACnD,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG;YAAE,SAAQ;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAA;QACrE,IAAI,CAAC,eAAe,GAAG,IAAI,CAAA;QAC3B,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACrB,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAAgB,EAChB,OAA4B,EAC5B,OAA4B;IAE5B,MAAM,IAAI,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAA;IAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAEtC,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,EAAE;QAC3C,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAA;IACF,IAAI,CAAC,UAAU,CAAC,UAAU;QAAE,OAAO,IAAI,CAAA;IAEvC,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE;QACjE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE;QAC1C,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAA;IACF,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAEvB,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,eAAe,EAAE,UAAU,CAAC,KAAK;QACjC,iBAAiB,EAAE,UAAU,CAAC,OAAO;QACrC,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAA;AACH,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAyC,EACzC,OAA4B;IAE5B,MAAM,KAAK,GAAmB,EAAE,CAAA;IAChC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,OAAO,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QAC/D,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5B,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAkBD,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,EAAwB,EACxB,IAA+C,EAC/C,MAAe;IAEf,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM;QAAE,OAAM;IAChC,MAAM,OAAO,GAAG,2BAA2B,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC7D,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,+BAA+B,OAAO,EAAE,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;QACvB,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE;QAChC,MAAM,EAAE;YACN,MAAM,EAAE,IAAI,CAAC,QAAQ;YACrB,WAAW,EAAE,IAAI,CAAC,MAAM;YACxB,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,iBAAiB;YAC9B,WAAW,EAAE,MAAM,IAAI,SAAS;SACjC;QACD,MAAM,EAAE;YACN,WAAW,EAAE,IAAI,CAAC,MAAM;YACxB,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,iBAAiB;SAC/B;KACF,CAAC,CAAA;IACF,IAAI,EAAE,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC;QAClC,MAAM,EAAE,CAAC,cAAc;aACpB,UAAU,CAAC;YACV,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YAC9B,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE;SACjC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACpB,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,EAAwB,EACxB,KAAqB;IAErB,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,MAAM;QAAE,OAAO,CAAC,CAAA;IAC5C,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC,SAAS,CAAC;YACrD,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;SACnD,CAAC,CAAA;QACF,IAAI,QAAQ;YAAE,SAAQ;QACtB,MAAM,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;YACjC,IAAI,EAAE;gBACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;gBACvC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,iBAAiB;gBACzB,QAAQ,EAAE;oBACR,eAAe,EAAE,IAAI,CAAC,eAAe;oBACrC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;oBACzC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC/D;aACF;SACF,CAAC,CAAA;QACF,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,EAAwB,EACxB,OAWC;IAED,MAAM,IAAI,GACR,OAAO,CAAC,cAAc,KAAK,KAAK,IAAI,EAAE,CAAC,cAAc,EAAE,QAAQ;QAC7D,CAAC,CAAC,MAAM,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC/E,CAAC,CAAC,EAAE,CAAA;IAER,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,IAAI,EAAE,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;IAC5F,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE;QACjD,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAA;IAEF,MAAM,OAAO,GAAG,OAAO,CAAC,sBAAsB,IAAI,EAAE,CAAA;IACpD,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,MAAM,OAAO,GAAmB,EAAE,CAAA;IAElC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,IAAI,OAAO,EAAE,CAAC;YACpD,MAAM,sBAAsB,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,eAAe,CAAC,CAAA;YAC/D,WAAW,EAAE,CAAA;YACb,SAAQ;QACV,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpB,CAAC;IAED,OAAO,GAAG,MAAM,yBAAyB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IACtD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,CAAA;AACxD,CAAC"}

package/dist/redirects/rerank.d.ts

@@ -0,0 +1,24 @@
+/**
+ * AI semantic re-ranking for ambiguous redirect matches (40–84% heuristic).
+ * Constrained to published candidate URLs only — the model never invents paths.
+ */
+import { type RedirectSuggestionResult, type SuggestCandidate } from './suggest.js';
+export type RedirectMatchSource = 'heuristic' | 'semantic';
+export type RedirectMatchResult = RedirectSuggestionResult & {
+    matchSource: RedirectMatchSource;
+};
+export interface ResolveRedirectMatchOptions {
+    minConfidence?: number;
+    /** Run semantic re-rank for heuristic scores in [ambiguousLow, ambiguousHigh]. */
+    enableAiRerank?: boolean;
+    ambiguousLow?: number;
+    ambiguousHigh?: number;
+    /** Injected semantic ranker (for tests). When omitted, loads plugin-ai dynamically. */
+    semanticRerank?: SemanticRerankFn | null;
+}
+export type SemanticRerankFn = (fromPath: string, shortlist: SuggestCandidate[]) => Promise<RedirectSuggestionResult | null>;
+/**
+ * Resolve the best redirect target — heuristic first, semantic re-rank when ambiguous.
+ */
+export declare function resolveRedirectMatch(fromPath: string, candidates: SuggestCandidate[], options?: ResolveRedirectMatchOptions): Promise<RedirectMatchResult | null>;
+//# sourceMappingURL=rerank.d.ts.map

package/dist/redirects/rerank.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rerank.d.ts","sourceRoot":"","sources":["../../src/redirects/rerank.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGL,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACtB,MAAM,cAAc,CAAA;AAErB,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,UAAU,CAAA;AAE1D,MAAM,MAAM,mBAAmB,GAAG,wBAAwB,GAAG;IAC3D,WAAW,EAAE,mBAAmB,CAAA;CACjC,CAAA;AAED,MAAM,WAAW,2BAA2B;IAC1C,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,kFAAkF;IAClF,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,uFAAuF;IACvF,cAAc,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAA;CACzC;AAED,MAAM,MAAM,gBAAgB,GAAG,CAC7B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,gBAAgB,EAAE,KAC1B,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAA;AA6D7C;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,gBAAgB,EAAE,EAC9B,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAuCrC"}

package/dist/redirects/rerank.js

@@ -0,0 +1,82 @@
+/**
+ * AI semantic re-ranking for ambiguous redirect matches (40–84% heuristic).
+ * Constrained to published candidate URLs only — the model never invents paths.
+ */
+import { rankRedirectCandidates, suggestRedirectTarget, } from './suggest.js';
+const CLEAR_MATCH = 85;
+async function loadSemanticRerank() {
+    try {
+        const mod = '@actuate-media/' + 'plugin-ai';
+        const ai = (await import(mod));
+        if (typeof ai.semanticSearch !== 'function')
+            return null;
+        return async (fromPath, shortlist) => {
+            if (shortlist.length === 0)
+                return null;
+            const query = `Best replacement page for broken URL path: ${fromPath}`;
+            const corpus = shortlist.map((c) => ({
+                id: c.url,
+                collectionSlug: 'content',
+                title: c.title ?? c.url,
+                content: `${c.title ?? ''} ${c.url}`.trim(),
+            }));
+            const results = await ai.semanticSearch(query, {
+                corpus,
+                limit: 3,
+                threshold: 0.42,
+            });
+            const top = results[0];
+            if (!top)
+                return null;
+            const matched = shortlist.find((c) => c.url === top.id);
+            if (!matched)
+                return null;
+            const confidence = Math.round(Math.min(1, Math.max(0, top.score)) * 100);
+            return {
+                toPath: matched.url,
+                confidence,
+                reason: `Semantic match to "${matched.title ?? matched.url}"`,
+            };
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function withSource(match, matchSource) {
+    return { ...match, matchSource };
+}
+/**
+ * Resolve the best redirect target — heuristic first, semantic re-rank when ambiguous.
+ */
+export async function resolveRedirectMatch(fromPath, candidates, options = {}) {
+    const minConfidence = options.minConfidence ?? 30;
+    const ambiguousLow = options.ambiguousLow ?? 40;
+    const ambiguousHigh = options.ambiguousHigh ?? 84;
+    const heuristic = suggestRedirectTarget(fromPath, candidates, minConfidence);
+    const needsRerank = options.enableAiRerank !== false &&
+        (!heuristic || (heuristic.confidence >= ambiguousLow && heuristic.confidence <= ambiguousHigh));
+    if (!needsRerank) {
+        return heuristic ? withSource(heuristic, 'heuristic') : null;
+    }
+    if (heuristic && heuristic.confidence >= CLEAR_MATCH) {
+        return withSource(heuristic, 'heuristic');
+    }
+    const rerank = options.semanticRerank ?? (await loadSemanticRerank());
+    if (!rerank) {
+        return heuristic ? withSource(heuristic, 'heuristic') : null;
+    }
+    const ranked = rankRedirectCandidates(fromPath, candidates, 8);
+    const shortlist = ranked.map((r) => {
+        const c = candidates.find((x) => x.url === r.toPath);
+        return { url: r.toPath, title: c?.title };
+    });
+    const semantic = await rerank(fromPath, shortlist).catch(() => null);
+    if (semantic && semantic.confidence >= minConfidence) {
+        if (!heuristic || semantic.confidence >= heuristic.confidence) {
+            return withSource(semantic, 'semantic');
+        }
+    }
+    return heuristic ? withSource(heuristic, 'heuristic') : null;
+}
+//# sourceMappingURL=rerank.js.map

package/dist/redirects/rerank.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rerank.js","sourceRoot":"","sources":["../../src/redirects/rerank.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GAGtB,MAAM,cAAc,CAAA;AAuBrB,MAAM,WAAW,GAAG,EAAE,CAAA;AAEtB,KAAK,UAAU,kBAAkB;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,iBAAiB,GAAG,WAAW,CAAA;QAC3C,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,CAc5B,CAAA;QACD,IAAI,OAAO,EAAE,CAAC,cAAc,KAAK,UAAU;YAAE,OAAO,IAAI,CAAA;QAExD,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE;YACnC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAA;YACvC,MAAM,KAAK,GAAG,8CAA8C,QAAQ,EAAE,CAAA;YACtE,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACnC,EAAE,EAAE,CAAC,CAAC,GAAG;gBACT,cAAc,EAAE,SAAS;gBACzB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG;gBACvB,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE;aAC5C,CAAC,CAAC,CAAA;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,cAAe,CAAC,KAAK,EAAE;gBAC9C,MAAM;gBACN,KAAK,EAAE,CAAC;gBACR,SAAS,EAAE,IAAI;aAChB,CAAC,CAAA;YACF,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;YACtB,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAA;YACrB,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC,CAAA;YACvD,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAA;YACzB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAA;YACxE,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,GAAG;gBACnB,UAAU;gBACV,MAAM,EAAE,sBAAsB,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,GAAG;aAC9D,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CACjB,KAA+B,EAC/B,WAAgC;IAEhC,OAAO,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,CAAA;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAAgB,EAChB,UAA8B,EAC9B,UAAuC,EAAE;IAEzC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IACjD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAA;IAC/C,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IAEjD,MAAM,SAAS,GAAG,qBAAqB,CAAC,QAAQ,EAAE,UAAU,EAAE,aAAa,CAAC,CAAA;IAE5E,MAAM,WAAW,GACf,OAAO,CAAC,cAAc,KAAK,KAAK;QAChC,CAAC,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,UAAU,IAAI,YAAY,IAAI,SAAS,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC,CAAA;IAEjG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9D,CAAC;IAED,IAAI,SAAS,IAAI,SAAS,CAAC,UAAU,IAAI,WAAW,EAAE,CAAC;QACrD,OAAO,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAC3C,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,IAAI,CAAC,MAAM,kBAAkB,EAAE,CAAC,CAAA;IACrE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9D,CAAC;IAED,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAA;IAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACjC,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,CAAA;QACpD,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;IAEpE,IAAI,QAAQ,IAAI,QAAQ,CAAC,UAAU,IAAI,aAAa,EAAE,CAAC;QACrD,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,UAAU,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;YAC9D,OAAO,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QACzC,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC9D,CAAC"}

package/dist/redirects/suggest.d.ts

@@ -18,4 +18,6 @@ export interface RedirectSuggestionResult {
  * candidate clears the minimum confidence threshold (default 30).
  */
 export declare function suggestRedirectTarget(fromPath: string, candidates: SuggestCandidate[], minConfidence?: number): RedirectSuggestionResult | null;
+/** Rank all candidates by path/title similarity (for AI re-ranking shortlists). */
+export declare function rankRedirectCandidates(fromPath: string, candidates: SuggestCandidate[], limit?: number): RedirectSuggestionResult[];
 //# sourceMappingURL=suggest.d.ts.map

package/dist/redirects/suggest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"suggest.d.ts","sourceRoot":"","sources":["../../src/redirects/suggest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;CACf;AAmBD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,gBAAgB,EAAE,EAC9B,aAAa,SAAK,GACjB,wBAAwB,GAAG,IAAI,CA0BjC"}
+{"version":3,"file":"suggest.d.ts","sourceRoot":"","sources":["../../src/redirects/suggest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;CACf;AAmBD;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,gBAAgB,EAAE,EAC9B,aAAa,SAAK,GACjB,wBAAwB,GAAG,IAAI,CA0BjC;AAED,mFAAmF;AACnF,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,gBAAgB,EAAE,EAC9B,KAAK,SAAI,GACR,wBAAwB,EAAE,CAwB5B"}

package/dist/redirects/suggest.js

@@ -52,4 +52,29 @@ export function suggestRedirectTarget(fromPath, candidates, minConfidence = 30)
         return null;
     return best;
 }
+/** Rank all candidates by path/title similarity (for AI re-ranking shortlists). */
+export function rankRedirectCandidates(fromPath, candidates, limit = 5) {
+    const fromTokens = new Set(tokens(fromPath));
+    if (fromTokens.size === 0 || candidates.length === 0)
+        return [];
+    const scored = [];
+    for (const c of candidates) {
+        const pathTokens = new Set(tokens(c.url));
+        const titleTokens = new Set(tokens(c.title ?? ''));
+        const pathSim = jaccard(fromTokens, pathTokens);
+        const titleSim = jaccard(fromTokens, titleTokens);
+        const confidence = Math.round((pathSim * 0.7 + titleSim * 0.3) * 100);
+        if (confidence <= 0)
+            continue;
+        scored.push({
+            toPath: c.url,
+            confidence,
+            reason: pathSim >= titleSim
+                ? `URL path similarity to ${c.url}`
+                : `Title similarity to "${c.title ?? c.url}"`,
+        });
+    }
+    scored.sort((a, b) => b.confidence - a.confidence);
+    return scored.slice(0, limit);
+}
 //# sourceMappingURL=suggest.js.map

package/dist/redirects/suggest.js.map

@@ -1 +1 @@
-{"version":3,"file":"suggest.js","sourceRoot":"","sources":["../../src/redirects/suggest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,KAAK;SACT,WAAW,EAAE;SACb,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC;SACjC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAChC,CAAC;AAED,SAAS,OAAO,CAAC,CAAc,EAAE,CAAc;IAC7C,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,CAAC,CAAA;IAC1C,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,KAAK,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,KAAK,CAAA;IACrC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAA;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,UAA8B,EAC9B,aAAa,GAAG,EAAE;IAElB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC5C,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAEjE,IAAI,IAAI,GAAoC,IAAI,CAAA;IAChD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QACzC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAA;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;QAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;QACjD,+CAA+C;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,GAAG,GAAG,QAAQ,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAA;QAChE,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YACrC,IAAI,GAAG;gBACL,MAAM,EAAE,CAAC,CAAC,GAAG;gBACb,UAAU,EAAE,KAAK;gBACjB,MAAM,EACJ,OAAO,IAAI,QAAQ;oBACjB,CAAC,CAAC,0BAA0B,CAAC,CAAC,GAAG,EAAE;oBACnC,CAAC,CAAC,wBAAwB,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG;aAClD,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,GAAG,aAAa;QAAE,OAAO,IAAI,CAAA;IACzD,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"suggest.js","sourceRoot":"","sources":["../../src/redirects/suggest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,KAAK;SACT,WAAW,EAAE;SACb,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC;SACjC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAChC,CAAC;AAED,SAAS,OAAO,CAAC,CAAc,EAAE,CAAc;IAC7C,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,CAAC,CAAA;IAC1C,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,KAAK,EAAE,CAAA;IACxC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,KAAK,CAAA;IACrC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAA;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,UAA8B,EAC9B,aAAa,GAAG,EAAE;IAElB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC5C,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAEjE,IAAI,IAAI,GAAoC,IAAI,CAAA;IAChD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QACzC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAA;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;QAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;QACjD,+CAA+C;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,GAAG,GAAG,QAAQ,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAA;QAChE,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YACrC,IAAI,GAAG;gBACL,MAAM,EAAE,CAAC,CAAC,GAAG;gBACb,UAAU,EAAE,KAAK;gBACjB,MAAM,EACJ,OAAO,IAAI,QAAQ;oBACjB,CAAC,CAAC,0BAA0B,CAAC,CAAC,GAAG,EAAE;oBACnC,CAAC,CAAC,wBAAwB,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG;aAClD,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,GAAG,aAAa;QAAE,OAAO,IAAI,CAAA;IACzD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,UAA8B,EAC9B,KAAK,GAAG,CAAC;IAET,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC5C,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAE/D,MAAM,MAAM,GAA+B,EAAE,CAAA;IAC7C,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QACzC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAA;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;QAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,GAAG,GAAG,QAAQ,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAA;QACrE,IAAI,UAAU,IAAI,CAAC;YAAE,SAAQ;QAC7B,MAAM,CAAC,IAAI,CAAC;YACV,MAAM,EAAE,CAAC,CAAC,GAAG;YACb,UAAU;YACV,MAAM,EACJ,OAAO,IAAI,QAAQ;gBACjB,CAAC,CAAC,0BAA0B,CAAC,CAAC,GAAG,EAAE;gBACnC,CAAC,CAAC,wBAAwB,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG;SAClD,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAA;IAClD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;AAC/B,CAAC"}

package/dist/redirects/typo.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Detect editor typos vs slug migrations — typos should fix the source link,
+ * migrations should get a redirect.
+ */
+/**
+ * True when paths differ by a small edit — likely a typo in content, not a
+ * retired URL that needs a site-wide 301.
+ */
+export declare function isLikelyEditorTypo(fromPath: string, toPath: string): boolean;
+//# sourceMappingURL=typo.d.ts.map

package/dist/redirects/typo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"typo.d.ts","sourceRoot":"","sources":["../../src/redirects/typo.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAyBH;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAmB5E"}

package/dist/redirects/typo.js

@@ -0,0 +1,51 @@
+/**
+ * Detect editor typos vs slug migrations — typos should fix the source link,
+ * migrations should get a redirect.
+ */
+function levenshtein(a, b) {
+    if (a === b)
+        return 0;
+    if (a.length === 0)
+        return b.length;
+    if (b.length === 0)
+        return a.length;
+    const row = new Array(b.length + 1);
+    for (let j = 0; j <= b.length; j++)
+        row[j] = j;
+    for (let i = 1; i <= a.length; i++) {
+        let prev = row[0];
+        row[0] = i;
+        for (let j = 1; j <= b.length; j++) {
+            const tmp = row[j];
+            const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+            row[j] = Math.min(row[j] + 1, row[j - 1] + 1, prev + cost);
+            prev = tmp;
+        }
+    }
+    return row[b.length];
+}
+function segments(path) {
+    return path.split('/').filter(Boolean);
+}
+/**
+ * True when paths differ by a small edit — likely a typo in content, not a
+ * retired URL that needs a site-wide 301.
+ */
+export function isLikelyEditorTypo(fromPath, toPath) {
+    if (!fromPath || !toPath || fromPath === toPath)
+        return false;
+    const fromSegs = segments(fromPath);
+    const toSegs = segments(toPath);
+    if (fromSegs.length === toSegs.length && fromSegs.length > 0) {
+        const samePrefix = fromSegs.slice(0, -1).join('/') === toSegs.slice(0, -1).join('/') || fromSegs.length === 1;
+        if (samePrefix) {
+            const lastFrom = fromSegs.at(-1) ?? '';
+            const lastTo = toSegs.at(-1) ?? '';
+            const dist = levenshtein(lastFrom, lastTo);
+            return dist > 0 && dist <= 3;
+        }
+    }
+    const fullDist = levenshtein(fromPath.replace(/^\//, ''), toPath.replace(/^\//, ''));
+    return fullDist > 0 && fullDist <= 4;
+}
+//# sourceMappingURL=typo.js.map

package/dist/redirects/typo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"typo.js","sourceRoot":"","sources":["../../src/redirects/typo.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,CAAA;IACrB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,CAAA;IACnC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,MAAM,CAAA;IACnC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC,CAAE,CAAA;QAClB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAE,CAAA;YACnB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAC1C,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAE,GAAG,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,CAAA;YAC5D,IAAI,GAAG,GAAG,CAAA;QACZ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAE,CAAA;AACvB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,MAAc;IACjE,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,KAAK,CAAA;IAE7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;IAE/B,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,UAAU,GACd,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAA;QAC5F,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YACtC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;YAClC,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;YAC1C,OAAO,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;IACpF,OAAO,QAAQ,GAAG,CAAC,IAAI,QAAQ,IAAI,CAAC,CAAA;AACtC,CAAC"}

package/dist/redirects/validate-destination.d.ts

@@ -0,0 +1,13 @@
+export interface RedirectDestinationValidationOptions {
+    /** When set, used instead of `NEXT_PUBLIC_SITE_URL` for allowlist checks. */
+    siteUrl?: string | null;
+}
+/**
+ * Open-redirect defence for redirect destinations.
+ *
+ * - Relative paths must start with `/` but NOT `//` (protocol-relative URLs).
+ * - Absolute URLs must use http/https and point at an allowlisted host.
+ * - 410 Gone responses skip destination validation (destination is informational).
+ */
+export declare function validateRedirectDestination(destination: string, statusCode: number, options?: RedirectDestinationValidationOptions): string | null;
+//# sourceMappingURL=validate-destination.d.ts.map

package/dist/redirects/validate-destination.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-destination.d.ts","sourceRoot":"","sources":["../../src/redirects/validate-destination.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,oCAAoC;IACnD,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,oCAAoC,GAC7C,MAAM,GAAG,IAAI,CA4Cf"}

package/dist/redirects/validate-destination.js

@@ -0,0 +1,51 @@
+import { getActuateConfig } from '../config/runtime.js';
+/**
+ * Open-redirect defence for redirect destinations.
+ *
+ * - Relative paths must start with `/` but NOT `//` (protocol-relative URLs).
+ * - Absolute URLs must use http/https and point at an allowlisted host.
+ * - 410 Gone responses skip destination validation (destination is informational).
+ */
+export function validateRedirectDestination(destination, statusCode, options) {
+    if (statusCode === 410)
+        return null;
+    const trimmed = destination.trim();
+    if (!trimmed)
+        return 'Destination is required';
+    if (trimmed.startsWith('//')) {
+        return 'Protocol-relative destinations (//…) are not allowed — use a path starting with / or an absolute https URL';
+    }
+    if (trimmed.startsWith('http://') || trimmed.startsWith('https://')) {
+        let destUrl;
+        try {
+            destUrl = new URL(trimmed);
+        }
+        catch {
+            return 'Invalid destination URL';
+        }
+        if (!['http:', 'https:'].includes(destUrl.protocol))
+            return 'Invalid destination URL';
+        const cmsConfig = getActuateConfig();
+        const allowed = new Set(Array.isArray(cmsConfig?.redirects?.allowedExternalHosts)
+            ? cmsConfig.redirects.allowedExternalHosts.map((h) => h.toLowerCase())
+            : []);
+        const siteUrl = options?.siteUrl ?? process.env.NEXT_PUBLIC_SITE_URL;
+        if (siteUrl) {
+            try {
+                allowed.add(new URL(siteUrl).hostname.toLowerCase());
+            }
+            catch {
+                /* noop */
+            }
+        }
+        if (!allowed.has(destUrl.hostname.toLowerCase())) {
+            return 'External redirect destinations must be to an allowlisted host.';
+        }
+        return null;
+    }
+    if (!trimmed.startsWith('/')) {
+        return 'Destination must be an absolute URL or a path beginning with /';
+    }
+    return null;
+}
+//# sourceMappingURL=validate-destination.js.map

package/dist/redirects/validate-destination.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-destination.js","sourceRoot":"","sources":["../../src/redirects/validate-destination.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAOvD;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,WAAmB,EACnB,UAAkB,EAClB,OAA8C;IAE9C,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAEnC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,OAAO;QAAE,OAAO,yBAAyB,CAAA;IAE9C,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,4GAA4G,CAAA;IACrH,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACpE,IAAI,OAAY,CAAA;QAChB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAA;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,yBAAyB,CAAA;QAClC,CAAC;QACD,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,yBAAyB,CAAA;QAErF,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAA;QACpC,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,oBAAoB,CAAC;YACvD,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAC9E,CAAC,CAAC,EAAE,CACP,CAAA;QACD,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAA;QACpE,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAA;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU;YACZ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACjD,OAAO,gEAAgE,CAAA;QACzE,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,gEAAgE,CAAA;IACzE,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/script-tags/resolve.d.ts

@@ -24,14 +24,15 @@ export declare function applyAsyncToScriptCode(code: string): string;
 /**
  * Wrap a snippet in a consent gate keyed to `@actuate-media/plugin-consent`
  * storage (`am_cookie_consent`) and its `am-consent` event. The original
- * snippet is injected only after the visitor grants full consent.
+ * snippet is injected only once the tag's category is granted.
  *
- * Interim category model: the consent plugin currently stores a binary level
- * (`all` | `essential`), so every non-`none` category requires `all`. The
- * category is preserved as a `data-consent-category` marker for CMPs and for
- * future granular gating.
+ * Grant rules (matching the plugin's storage contract):
+ * - stored `'all'` / event level `'all'` — every category granted
+ * - stored/event `categories` array containing this tag's category (the
+ *   plugin persists custom selections as `{"level":"custom","categories":[…]}`)
+ * - `'essential'` or unset — blocked
  */
-export declare function wrapCodeInConsentGate(code: string, category: string): string;
+export declare function wrapCodeInConsentGate(code: string, category: ScriptTagConsentCategory): string;
 /**
  * Resolve enabled script tags for a public URL path, grouped by placement.
  * Shared by the public API route and Next.js site layouts.

package/dist/script-tags/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/script-tags/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAEtD,eAAO,MAAM,qBAAqB,wBAAwB,CAAA;AAE1D,eAAO,MAAM,6BAA6B,0EAMhC,CAAA;AAEV,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAA;AAErF,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAID,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAGhE;AAMD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO3D;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAoB5E;AAcD;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAkD7B"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/script-tags/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAEtD,eAAO,MAAM,qBAAqB,wBAAwB,CAAA;AAE1D,eAAO,MAAM,6BAA6B,0EAMhC,CAAA;AAEV,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAA;AAErF,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAID,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAGhE;AAMD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO3D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,wBAAwB,GAAG,MAAM,CA2B9F;AAqBD;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAkD7B"}

package/dist/script-tags/resolve.js

@@ -32,12 +32,13 @@ export function applyAsyncToScriptCode(code) {
 /**
  * Wrap a snippet in a consent gate keyed to `@actuate-media/plugin-consent`
  * storage (`am_cookie_consent`) and its `am-consent` event. The original
- * snippet is injected only after the visitor grants full consent.
+ * snippet is injected only once the tag's category is granted.
  *
- * Interim category model: the consent plugin currently stores a binary level
- * (`all` | `essential`), so every non-`none` category requires `all`. The
- * category is preserved as a `data-consent-category` marker for CMPs and for
- * future granular gating.
+ * Grant rules (matching the plugin's storage contract):
+ * - stored `'all'` / event level `'all'` — every category granted
+ * - stored/event `categories` array containing this tag's category (the
+ *   plugin persists custom selections as `{"level":"custom","categories":[…]}`)
+ * - `'essential'` or unset — blocked
  */
 export function wrapCodeInConsentGate(code, category) {
     // \u003C-escape so the payload can never terminate the wrapper script early.
@@ -45,16 +46,23 @@ export function wrapCodeInConsentGate(code, category) {
     return (`<script data-consent-category="${category}">` +
         '(function(){' +
         `var p=${payload};` +
+        `var c="${category}";` +
         // currentScript is only defined during synchronous execution — capture it
         // now so deferred injection (after the am-consent event) keeps placement.
         'var s=document.currentScript;' +
-        'function g(){try{return window.localStorage.getItem("am_cookie_consent")==="all"}catch(e){return false}}' +
+        'function ok(l,a){if(l==="all")return true;return!!a&&a.indexOf(c)>-1}' +
+        'function g(){try{var r=window.localStorage.getItem("am_cookie_consent");' +
+        'if(!r)return false;' +
+        'if(r==="all")return true;' +
+        'if(r.charAt(0)!=="{")return false;' +
+        'var j=JSON.parse(r);return ok(j&&j.level,j&&j.categories)' +
+        '}catch(e){return false}}' +
         'var d=false;' +
         'function i(){if(d)return;d=true;' +
         'var f=document.createRange().createContextualFragment(p);' +
         'if(s&&s.parentNode){s.parentNode.insertBefore(f,s.nextSibling)}else{document.body.appendChild(f)}}' +
         'if(g()){i();return}' +
-        'window.addEventListener("am-consent",function(e){if((e.detail&&e.detail.level)==="all")i()});' +
+        'window.addEventListener("am-consent",function(e){var t=e.detail||{};if(ok(t.level,t.categories))i()});' +
         '})()' +
         '</script>');
 }
@@ -63,8 +71,12 @@ function deliverableCode(tag) {
     if (tag.loadAsync)
         code = applyAsyncToScriptCode(code);
     const category = tag.consentCategory ?? 'none';
-    if (category !== 'none')
+    // Categories are validated at write time; narrow defensively so an
+    // unexpected DB value ships ungated rather than with a broken gate.
+    if (category !== 'none' &&
+        SCRIPT_TAG_CONSENT_CATEGORIES.includes(category)) {
         code = wrapCodeInConsentGate(code, category);
+    }
     return code;
 }
 /**

package/dist/script-tags/resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/script-tags/resolve.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAA;AAE1D,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,MAAM;IACN,WAAW;IACX,WAAW;IACX,YAAY;IACZ,aAAa;CACL,CAAA;AAkBV,MAAM,KAAK,GAAuB,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAA;AAE7E,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,CAAA;IACvC,OAAO,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,iBAAiB,CAAC,EAAa;IACtC,OAAO,OAAO,EAAE,CAAC,SAAS,EAAE,QAAQ,KAAK,UAAU,CAAA;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,KAAyB,EAAE,EAAE;QAC/E,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE,CAAA;QAC5B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAA;QAC9C,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAA;QAC5E,OAAO,gBAAgB,QAAQ,GAAG,CAAA;IACpC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,QAAgB;IAClE,6EAA6E;IAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IAC7D,OAAO,CACL,kCAAkC,QAAQ,IAAI;QAC9C,cAAc;QACd,SAAS,OAAO,GAAG;QACnB,0EAA0E;QAC1E,0EAA0E;QAC1E,+BAA+B;QAC/B,0GAA0G;QAC1G,cAAc;QACd,kCAAkC;QAClC,2DAA2D;QAC3D,oGAAoG;QACpG,qBAAqB;QACrB,+FAA+F;QAC/F,MAAM;QACN,WAAW,CACZ,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAIxB;IACC,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACnB,IAAI,GAAG,CAAC,SAAS;QAAE,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;IACtD,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,IAAI,MAAM,CAAA;IAC9C,IAAI,QAAQ,KAAK,MAAM;QAAE,IAAI,GAAG,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACrE,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAa,EACb,SAAiB,EACjB,UAAoC,EAAE;IAEtC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAA;IAExC,MAAM,cAAc,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAA;IAExD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC;QACvC,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QACxB,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;KAC7B,CAAC,CAAA;IAEF,MAAM,OAAO,GAKR,EAAE,CAAA;IACP,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,CAAC,OAAO,IAAI,GAAG,CAAC,gBAAgB,KAAK,KAAK;YAAE,SAAQ;QAC/D,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACjB,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9D,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;gBAC3C,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;oBACrE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;oBACjB,MAAK;gBACP,CAAC;YACH,CAAC;YACD,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3D,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;gBAC3C,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;oBAC5B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;oBACjB,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAuB,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAA;IAC/E,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,SAAqC,CAAC,CAAA;QACjE,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAA;IAC/C,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/script-tags/resolve.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAA;AAE1D,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,MAAM;IACN,WAAW;IACX,WAAW;IACX,YAAY;IACZ,aAAa;CACL,CAAA;AAkBV,MAAM,KAAK,GAAuB,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAA;AAE7E,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,CAAA;IACvC,OAAO,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,iBAAiB,CAAC,EAAa;IACtC,OAAO,OAAO,EAAE,CAAC,SAAS,EAAE,QAAQ,KAAK,UAAU,CAAA;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC,KAAK,EAAE,KAAyB,EAAE,EAAE;QAC/E,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE,CAAA;QAC5B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAA;QAC9C,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAA;QAC5E,OAAO,gBAAgB,QAAQ,GAAG,CAAA;IACpC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,QAAkC;IACpF,6EAA6E;IAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;IAC7D,OAAO,CACL,kCAAkC,QAAQ,IAAI;QAC9C,cAAc;QACd,SAAS,OAAO,GAAG;QACnB,UAAU,QAAQ,IAAI;QACtB,0EAA0E;QAC1E,0EAA0E;QAC1E,+BAA+B;QAC/B,uEAAuE;QACvE,0EAA0E;QAC1E,qBAAqB;QACrB,2BAA2B;QAC3B,oCAAoC;QACpC,2DAA2D;QAC3D,0BAA0B;QAC1B,cAAc;QACd,kCAAkC;QAClC,2DAA2D;QAC3D,oGAAoG;QACpG,qBAAqB;QACrB,wGAAwG;QACxG,MAAM;QACN,WAAW,CACZ,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAIxB;IACC,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;IACnB,IAAI,GAAG,CAAC,SAAS;QAAE,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;IACtD,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,IAAI,MAAM,CAAA;IAC9C,mEAAmE;IACnE,oEAAoE;IACpE,IACE,QAAQ,KAAK,MAAM;QAClB,6BAAmD,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACvE,CAAC;QACD,IAAI,GAAG,qBAAqB,CAAC,IAAI,EAAE,QAAoC,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAa,EACb,SAAiB,EACjB,UAAoC,EAAE;IAEtC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAA;IAExC,MAAM,cAAc,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAA;IAExD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC;QACvC,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;QACxB,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;KAC7B,CAAC,CAAA;IAEF,MAAM,OAAO,GAKR,EAAE,CAAA;IACP,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,CAAC,OAAO,IAAI,GAAG,CAAC,gBAAgB,KAAK,KAAK;YAAE,SAAQ;QAC/D,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACjB,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9D,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;gBAC3C,IAAI,cAAc,KAAK,IAAI,IAAI,cAAc,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;oBACrE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;oBACjB,MAAK;gBACP,CAAC;YACH,CAAC;YACD,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3D,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAA;gBAC3C,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;oBAC5B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;oBACjB,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAuB,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAA;IAC/E,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,SAAqC,CAAC,CAAA;QACjE,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAA;IAC/C,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/sections/validate.d.ts

@@ -1,4 +1,6 @@
 import type { SectionSettings, SectionValidationResult } from './types.js';
+/** Heuristic: URLs that look like static /public assets rather than library uploads. */
+export declare function isLikelyOutsideMediaLibrary(url: string): boolean;
 /**
  * Validate one section's content + settings against its type schema.
  *