@jini-ai/admin 0.4.2 → 0.4.4

package/dist/redirects/redirects.module.d.ts

@@ -0,0 +1,77 @@
+/** Existing route identity and permission are part of the host's navigation contract. */
+export declare const redirectsModule: {
+    readonly id: "redirects";
+    readonly requires: {
+        readonly redirectsApi: import("../core/module/token.js").AdminPortToken<import("./ports.js").AdminRedirectsPort, "admin.redirects.api">;
+    };
+    readonly optional: {
+        readonly redirectsEvents: import("../core/module/token.js").AdminPortToken<import("./ports.js").RedirectsEventsPort, "admin.redirects.events">;
+    };
+    readonly messages: {
+        readonly "Loading\u2026": "Loading…";
+        readonly "Load hits": "Load hits";
+        readonly "Bulk import": "Bulk import";
+        readonly "rule objects (1-500 items)": "rule objects (1-500 items)";
+        readonly "Importing\u2026": "Importing…";
+        readonly Import: "Import";
+        readonly Marketing: "Marketing";
+        readonly Redirects: "Redirects";
+        readonly "Manage URL redirects, including those created automatically when a page's address changes.": "Manage URL redirects, including those created automatically when a page's address changes.";
+        readonly "Match type": "Match type";
+        readonly "From path": "From path";
+        readonly "To target": "To target";
+        readonly "Status code": "Status code";
+        readonly "301 (permanent)": "301 (permanent)";
+        readonly "302 (temporary)": "302 (temporary)";
+        readonly "307 (temporary, method-preserving)": "307 (temporary, method-preserving)";
+        readonly "308 (permanent, method-preserving)": "308 (permanent, method-preserving)";
+        readonly "Add redirect": "Add redirect";
+        readonly "No redirect rules yet.": "No redirect rules yet.";
+        readonly From: "From";
+        readonly To: "To";
+        readonly Type: "Type";
+        readonly Code: "Code";
+        readonly Source: "Source";
+        readonly Hits: "Hits";
+        readonly "Delete redirect rule?": "Delete redirect rule?";
+        readonly "Loading redirects\u2026": "Loading redirects…";
+        readonly "Not valid JSON.": "Not valid JSON.";
+        readonly "Must be a JSON array of rule objects.": "Must be a JSON array of rule objects.";
+        readonly exact: "Exact match";
+        readonly prefix: "Starts with";
+        readonly wildcard: "Wildcard";
+        readonly Status: "Status";
+        readonly More: "More";
+        readonly Delete: "Delete";
+        readonly Disable: "Disable";
+        readonly Enable: "Enable";
+        readonly "Saving\u2026": "Saving…";
+        readonly Created: "Created";
+        readonly active: "Active";
+        readonly disabled: "Disabled";
+        readonly "{created} created, {failed} failed.": "{created} created, {failed} failed.";
+        readonly "Item {index} ({code})": "Item {index} ({code})";
+        readonly "Actions for redirect rule from \"{fromPattern}\"": "Actions for redirect rule from \"{fromPattern}\"";
+        readonly "Paste a JSON array of ": "Paste a JSON array of ";
+        readonly " rule objects (1-500 items)": " rule objects (1-500 items)";
+        readonly "Delete the redirect rule from \"": "Delete the redirect rule from \"";
+        readonly "\"?": "\"?";
+        readonly manual: "Manual";
+        readonly auto_slug_change: "URL change";
+        readonly import: "Imported";
+    };
+    readonly pages: {
+        readonly list: {
+            readonly path: "/redirects";
+            readonly label: "Redirects";
+            readonly permissions: readonly ["admin.redirects.manage"];
+            readonly agentReachable: true;
+            readonly nav: {
+                readonly group: "marketing";
+                readonly icon: "arrow-right";
+            };
+            readonly tabs: {};
+        };
+    };
+};
+//# sourceMappingURL=redirects.module.d.ts.map

package/dist/redirects/redirects.module.js

@@ -0,0 +1,13 @@
+import { defineAdminModule } from '../core/module/index.js';
+import { redirectsApiToken, redirectsEventsToken } from './ports.js';
+import { redirectsMessagesEn } from './messages.en.js';
+/** Existing route identity and permission are part of the host's navigation contract. */
+export const redirectsModule = defineAdminModule({
+    id: 'redirects',
+    requires: { redirectsApi: redirectsApiToken },
+    optional: { redirectsEvents: redirectsEventsToken },
+    messages: redirectsMessagesEn,
+    pages: { list: { path: '/redirects', label: 'Redirects', permissions: ['admin.redirects.manage'],
+            agentReachable: true, nav: { group: 'marketing', icon: 'arrow-right' }, tabs: {} } },
+});
+//# sourceMappingURL=redirects.module.js.map

package/dist/redirects/rules.d.ts

@@ -0,0 +1,131 @@
+import type { AdminRedirect, AdminRedirectCreateInput } from '../core/ports/redirects.js';
+import type { RedirectsRowAction, RedirectsTranslate, RedirectsWriteState } from './models.js';
+/**
+ * @file Pure logic for the `redirects` feature — everything that computes a value rather than
+ * rendering one. Follows the convention `features/posts/rules.ts` establishes: no React, no
+ * hooks, importable and directly testable.
+ *
+ * `KEYS` lives here rather than inside a hook file because three separate hook files
+ * (`use-redirects`, `use-hit-count-cell`, `use-import-redirects-form`) each need one branch of it.
+ * A cache-identity constant copied per hook is exactly the drift `@jini-ai/ui/fetch-query`'s own
+ * `QueryKey` doc warns about — a hand-typed second `["redirects"]` silently stops matching the
+ * first the moment one of them is edited.
+ */
+/** One cache identity per resource, defined once so a write's `invalidates` and a read's `key`
+ *  cannot drift apart — the failure mode being an invalidation that silently matches nothing and a
+ *  list that never refreshes. */
+export declare const KEYS: {
+    list: readonly ["redirects"];
+    hits: ({ redirectId }: {
+        redirectId: string;
+    }, _optional?: {}) => string[];
+};
+/** This screen's name on the host refresh bus — see `taxonomy/rules.ts`'s `TAXONOMY_RESOURCE`
+ *  for why this is a plain colocated constant rather than a shared registry. Agent-writable via
+ *  `redirects_create`/`redirects_update`/`redirects_tombstone` (`apps/website/src/features/redirects/
+ *  agent-tools.ts`) — `redirects_import` is excluded from that catalog entirely, but the three wired
+ *  single-row writes are enough to make this list go stale the same way Posts/Media did. */
+export declare const REDIRECTS_RESOURCE = "redirects";
+/**
+ * The status a "Disable"/"Enable" row action moves a rule TO — the inverse of its current status.
+ *
+ * @complexity Time/space: O(1).
+ */
+export declare function nextRedirectStatus({ currentStatus }: {
+    currentStatus: string;
+}, _optional?: {}): string;
+/**
+ * Shapes the create-redirect form's raw `FormData` into `api.createRedirect`'s input — the create
+ * mutation's payload, extracted so the shaping is testable without submitting a real form.
+ *
+ * @complexity Time/space: O(1) — four fixed field reads.
+ */
+export declare function buildCreateRedirectPayload({ form }: {
+    form: FormData;
+}, _optional?: {}): AdminRedirectCreateInput;
+/** The callbacks a redirect row menu needs. Passed in rather than imported so this module stays
+ *  free of state, mirroring `posts/rules.ts`'s `PostRowMenuHandlers`. */
+export interface RedirectRowMenuHandlers {
+    onToggleStatus: (rule: AdminRedirect) => void;
+    onRequestDelete: (rule: AdminRedirect) => void;
+}
+/**
+ * The row-action menu for one redirect rule.
+ *
+ * The label is the reason this is exported: it reads the rule's CURRENT status to decide between
+ * "Disable" and "Enable", a branch that was otherwise reachable only by rendering the table and
+ * opening a popover. "Delete" only OPENS the confirmation; the delete itself is
+ * `useRedirects().confirmDelete`, gated on `ConfirmDialog` — same split as `posts/rules.ts`'s
+ * `postRowMenuItems`.
+ *
+ * @complexity Time/space: O(1) — two fixed entries, no iteration.
+ */
+export declare function redirectRowMenuItems({ rule, handlers }: {
+    rule: AdminRedirect;
+    handlers: RedirectRowMenuHandlers;
+}, { t }?: {
+    t?: RedirectsTranslate;
+}): RedirectsRowAction[];
+/** One write's status/error — the two fields these derivations need from `useFetchMutation`'s
+ *  `MutationResult`, named locally so this module does not have to import the whole type. */
+export type WriteState = RedirectsWriteState;
+/**
+ * True while any of the screen's independent writes (create/toggle/delete) is in flight — gates
+ * the row-menu guard and the submit button's "Saving…" label.
+ *
+ * @complexity Time/space: O(w) in the number of writes (currently 3, fixed).
+ */
+export declare function isAnyWritePending({ writes }: {
+    writes: readonly WriteState[];
+}, _optional?: {}): boolean;
+/**
+ * The first still-active write failure, in WRITE-ARRAY order rather than recency.
+ *
+ * Order matters: three independent mutations each keep their own error until reset, so returning
+ * by recency would let a failed Create's banner persist on screen after a later, entirely
+ * successful Disable — blaming an operation that worked. `clearOtherWriteErrors` (in
+ * `use-redirects.hooks.ts`) is this rule's other half: it clears every write's error except the
+ * one just started, so at most one of these ever holds a stale failure at a time.
+ *
+ * @complexity Time/space: O(w) in the number of writes.
+ */
+export declare function firstWriteError({ writes }: {
+    writes: readonly WriteState[];
+}, _optional?: {}): Error | null;
+/**
+ * The error banner's source of truth: an active write's own failure takes precedence over a
+ * background list-refresh failure, and the list failure is suppressed entirely while a write is
+ * running — a failed background list refresh keeps `listError` set while the table still shows its
+ * last good data, and rendered unconditionally that error would become the banner the operator
+ * sees the instant they click Disable, reading as "your Disable failed" when the write is merely in
+ * flight and the stale message belongs to an earlier refresh. It returns afterwards if the list is
+ * genuinely still failing, which is honest rather than hidden.
+ *
+ * @complexity Time/space: O(1).
+ */
+export declare function visibleRedirectsError(params: {
+    writeError: Error | null;
+    saving: boolean;
+    listError: Error | null;
+}, _optional?: {}): Error | null;
+/** Discriminated parse result for the bulk-import textarea. */
+export type ImportPayloadParseResult = {
+    ok: true;
+    rules: AdminRedirectCreateInput[];
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Client-side shape check for the bulk-import textarea: valid JSON, and an array. Nothing deeper —
+ * the server remains the actual validator and reports per-item failures in its own `207`;
+ * duplicating that schema client-side would be a second source of truth for it (see
+ * `useImportRedirectsForm`'s `run:` comment).
+ *
+ * @complexity Time/space: O(1) beyond `JSON.parse`'s own cost in input length.
+ */
+export declare function parseImportPayload({ raw, translate }: {
+    raw: string;
+    translate: RedirectsTranslate;
+}, _optional?: {}): ImportPayloadParseResult;
+//# sourceMappingURL=rules.d.ts.map

package/dist/redirects/rules.js

@@ -0,0 +1,134 @@
+/**
+ * @file Pure logic for the `redirects` feature — everything that computes a value rather than
+ * rendering one. Follows the convention `features/posts/rules.ts` establishes: no React, no
+ * hooks, importable and directly testable.
+ *
+ * `KEYS` lives here rather than inside a hook file because three separate hook files
+ * (`use-redirects`, `use-hit-count-cell`, `use-import-redirects-form`) each need one branch of it.
+ * A cache-identity constant copied per hook is exactly the drift `@jini-ai/ui/fetch-query`'s own
+ * `QueryKey` doc warns about — a hand-typed second `["redirects"]` silently stops matching the
+ * first the moment one of them is edited.
+ */
+/** One cache identity per resource, defined once so a write's `invalidates` and a read's `key`
+ *  cannot drift apart — the failure mode being an invalidation that silently matches nothing and a
+ *  list that never refreshes. */
+export const KEYS = {
+    list: ["redirects"],
+    hits: ({ redirectId }, _optional = {}) => ["redirects", redirectId, "hits"],
+};
+/** This screen's name on the host refresh bus — see `taxonomy/rules.ts`'s `TAXONOMY_RESOURCE`
+ *  for why this is a plain colocated constant rather than a shared registry. Agent-writable via
+ *  `redirects_create`/`redirects_update`/`redirects_tombstone` (`apps/website/src/features/redirects/
+ *  agent-tools.ts`) — `redirects_import` is excluded from that catalog entirely, but the three wired
+ *  single-row writes are enough to make this list go stale the same way Posts/Media did. */
+export const REDIRECTS_RESOURCE = "redirects";
+/**
+ * The status a "Disable"/"Enable" row action moves a rule TO — the inverse of its current status.
+ *
+ * @complexity Time/space: O(1).
+ */
+export function nextRedirectStatus({ currentStatus }, _optional = {}) {
+    return currentStatus === "active" ? "disabled" : "active";
+}
+/**
+ * Shapes the create-redirect form's raw `FormData` into `api.createRedirect`'s input — the create
+ * mutation's payload, extracted so the shaping is testable without submitting a real form.
+ *
+ * @complexity Time/space: O(1) — four fixed field reads.
+ */
+export function buildCreateRedirectPayload({ form }, _optional = {}) {
+    return {
+        matchType: String(form.get("matchType") ?? "exact"),
+        fromPattern: String(form.get("fromPattern") ?? ""),
+        toTarget: String(form.get("toTarget") ?? ""),
+        statusCode: Number(form.get("statusCode") ?? 301),
+    };
+}
+/**
+ * The row-action menu for one redirect rule.
+ *
+ * The label is the reason this is exported: it reads the rule's CURRENT status to decide between
+ * "Disable" and "Enable", a branch that was otherwise reachable only by rendering the table and
+ * opening a popover. "Delete" only OPENS the confirmation; the delete itself is
+ * `useRedirects().confirmDelete`, gated on `ConfirmDialog` — same split as `posts/rules.ts`'s
+ * `postRowMenuItems`.
+ *
+ * @complexity Time/space: O(1) — two fixed entries, no iteration.
+ */
+export function redirectRowMenuItems({ rule, handlers }, { t = (key) => key } = {}) {
+    return [
+        {
+            key: "toggle",
+            label: rule.status === "active" ? t("Disable") : t("Enable"),
+            onSelect: () => handlers.onToggleStatus(rule),
+        },
+        {
+            key: "delete",
+            label: t("Delete"),
+            destructive: true,
+            onSelect: () => handlers.onRequestDelete(rule),
+        },
+    ];
+}
+/**
+ * True while any of the screen's independent writes (create/toggle/delete) is in flight — gates
+ * the row-menu guard and the submit button's "Saving…" label.
+ *
+ * @complexity Time/space: O(w) in the number of writes (currently 3, fixed).
+ */
+export function isAnyWritePending({ writes }, _optional = {}) {
+    return writes.some((write) => write.status === "pending");
+}
+/**
+ * The first still-active write failure, in WRITE-ARRAY order rather than recency.
+ *
+ * Order matters: three independent mutations each keep their own error until reset, so returning
+ * by recency would let a failed Create's banner persist on screen after a later, entirely
+ * successful Disable — blaming an operation that worked. `clearOtherWriteErrors` (in
+ * `use-redirects.hooks.ts`) is this rule's other half: it clears every write's error except the
+ * one just started, so at most one of these ever holds a stale failure at a time.
+ *
+ * @complexity Time/space: O(w) in the number of writes.
+ */
+export function firstWriteError({ writes }, _optional = {}) {
+    return writes.find((write) => write.error)?.error ?? null;
+}
+/**
+ * The error banner's source of truth: an active write's own failure takes precedence over a
+ * background list-refresh failure, and the list failure is suppressed entirely while a write is
+ * running — a failed background list refresh keeps `listError` set while the table still shows its
+ * last good data, and rendered unconditionally that error would become the banner the operator
+ * sees the instant they click Disable, reading as "your Disable failed" when the write is merely in
+ * flight and the stale message belongs to an earlier refresh. It returns afterwards if the list is
+ * genuinely still failing, which is honest rather than hidden.
+ *
+ * @complexity Time/space: O(1).
+ */
+export function visibleRedirectsError(params, _optional = {}) {
+    return params.writeError ?? (params.saving ? null : params.listError);
+}
+/**
+ * Client-side shape check for the bulk-import textarea: valid JSON, and an array. Nothing deeper —
+ * the server remains the actual validator and reports per-item failures in its own `207`;
+ * duplicating that schema client-side would be a second source of truth for it (see
+ * `useImportRedirectsForm`'s `run:` comment).
+ *
+ * @complexity Time/space: O(1) beyond `JSON.parse`'s own cost in input length.
+ */
+export function parseImportPayload({ raw, translate }, _optional = {}) {
+    let rules;
+    try {
+        rules = JSON.parse(raw);
+    }
+    catch {
+        return { ok: false, error: translate("Not valid JSON.") };
+    }
+    if (!Array.isArray(rules)) {
+        return { ok: false, error: translate("Must be a JSON array of rule objects.") };
+    }
+    // Unchecked by design (see `useImportRedirectsForm`'s `run:` comment). `Array.isArray` narrows
+    // `unknown` to `any[]`, which the mutation's input type accepted silently before this
+    // extraction; this states it instead.
+    return { ok: true, rules: rules };
+}
+//# sourceMappingURL=rules.js.map

package/dist/security/react/hooks/AccessTokensTab.hooks.d.ts

@@ -1,4 +1,4 @@
-import type { TabViewProps } from '../../../react/bind-react.js';
+import type { TabViewProps } from '../../../core/react/bind-react.js';
 import type { CredentialSummary, OtherCredentialSummary, CredentialCategory } from '../../models.js';
 export declare function useAccessTokensTab({ permissions }: TabViewProps, _optional?: {}): {
     denied: boolean;

package/dist/security/react/hooks/AccessTokensTab.hooks.js

@@ -1,5 +1,5 @@
 import { useState } from 'react';
-import { useController } from '../../../react/use-controller.js';
+import { useController } from '../../../core/react/use-controller.js';
 import { createAccessTokensController } from '../../controllers/access-tokens.controller.js';
 import { createOtherCredentialsController } from '../../controllers/other-credentials.controller.js';
 import { CATEGORIES, credentialLabel, filterCredentials, filterOtherCredentials, otherWritePermission, writePermission } from '../../rules.js';

package/dist/security/react/hooks/RootKeyTab.hooks.d.ts

@@ -1,4 +1,4 @@
-import type { TabViewProps } from '../../../react/bind-react.js';
+import type { TabViewProps } from '../../../core/react/bind-react.js';
 export declare function useRootKeyTab({ permissions, params }: TabViewProps, _optional?: {}): {
     denied: boolean;
     loading: boolean;

package/dist/security/react/hooks/RootKeyTab.hooks.js

@@ -1,4 +1,4 @@
-import { useController } from '../../../react/use-controller.js';
+import { useController } from '../../../core/react/use-controller.js';
 import { createRootKeyController } from '../../controllers/root-key.controller.js';
 import { ROOT_KEY_PERMISSION, START_FRESH_CONFIRMATION, isRootKeyLocked } from '../../rules.js';
 import { unavailableRootKey, useSecurityPorts } from './SecurityPorts.hooks.js';

package/dist/security/react/hooks/SecurityPage.hooks.d.ts

@@ -1,4 +1,4 @@
-import type { ModulePageProps } from '../../../react/bind-react.js';
+import type { ModulePageProps } from '../../../core/react/bind-react.js';
 export declare function useSecurityPage(props: ModulePageProps, _optional?: {}): {
     denied: boolean;
     active: string;

package/dist/security/react/index.js

@@ -1,4 +1,4 @@
-import { bindReact } from '../../react/bind-react.js';
+import { bindReact } from '../../core/react/bind-react.js';
 import { securityModule } from '../security.module.js';
 import { SecurityPortsContext } from './hooks/SecurityPorts.hooks.js';
 export { useSecurityPorts } from './hooks/SecurityPorts.hooks.js';

package/dist/security/react/pages/SecurityPage.d.ts

@@ -1,4 +1,4 @@
-import type { ModulePageProps } from '../../../react/bind-react.js';
+import type { ModulePageProps } from '../../../core/react/bind-react.js';
 export declare function SecurityPage(props: ModulePageProps, _optional?: {}): import("react").JSX.Element;
 export default SecurityPage;
 //# sourceMappingURL=SecurityPage.d.ts.map

package/dist/security/react/tabs/AccessTokensTab.d.ts

@@ -1,4 +1,4 @@
-import type { TabViewProps } from '../../../react/bind-react.js';
+import type { TabViewProps } from '../../../core/react/bind-react.js';
 export declare function AccessTokensTab(props: TabViewProps, _optional?: {}): import("react").JSX.Element;
 export default AccessTokensTab;
 //# sourceMappingURL=AccessTokensTab.d.ts.map

package/dist/security/react/tabs/RootKeyTab.d.ts

@@ -1,4 +1,4 @@
-import type { TabViewProps } from '../../../react/bind-react.js';
+import type { TabViewProps } from '../../../core/react/bind-react.js';
 export declare function RootKeyTab(props: TabViewProps, _optional?: {}): import("react").JSX.Element;
 export default RootKeyTab;
 //# sourceMappingURL=RootKeyTab.d.ts.map

package/dist/seo/adapters/http.d.ts

@@ -0,0 +1,31 @@
+import type { AdminSeoPort } from '../ports.js';
+/** Host owns authentication, workspace addressing, retries, JSON and API error decoding. */
+export interface SeoTransportPort {
+    request<T>(required: {
+        path: string;
+        method: 'GET' | 'PUT' | 'POST';
+        body?: unknown;
+    }, optional?: {
+        signal?: AbortSignal;
+    }): Promise<T>;
+    url(required: {
+        path: string;
+    }, optional?: Record<string, never>): string;
+}
+/** Public XML uses the host's raw transport, since the admin JSON transport cannot decode XML. */
+export interface SeoSitemapTransportPort {
+    get(required: {
+        path: '/sitemap.xml';
+        credentials: 'same-origin';
+    }, optional?: {
+        signal?: AbortSignal;
+    }): Promise<Pick<Response, 'ok' | 'status' | 'headers' | 'text'>>;
+}
+/** Preserves every existing SEO request path and body; basePath is the host workspace path. */
+export declare function createHttpSeoApi({ transport, basePath }: {
+    transport: SeoTransportPort;
+    basePath: string;
+}, { sitemapTransport }?: {
+    sitemapTransport?: SeoSitemapTransportPort;
+}): AdminSeoPort;
+//# sourceMappingURL=http.d.ts.map

package/dist/seo/adapters/http.js

@@ -0,0 +1,37 @@
+/** Preserves every existing SEO request path and body; basePath is the host workspace path. */
+export function createHttpSeoApi({ transport, basePath }, { sitemapTransport } = {}) {
+    const base = basePath.replace(/\/$/, '');
+    const entryPath = (entryId) => `${base}/seo/entries/${encodeURIComponent(entryId)}`;
+    async function data(path, method, body) {
+        const response = await transport.request({ path, method, ...(body === undefined ? {} : { body }) });
+        return response.data;
+    }
+    async function choices(kind) {
+        const response = await transport.request({ path: `${base}/${kind}`, method: 'GET' });
+        return response.posts.map(({ post }) => post);
+    }
+    return {
+        getSeoSettings: () => data(`${base}/seo/settings`, 'GET'),
+        putSeoSettings: (_required, patch = {}) => data(`${base}/seo/settings`, 'PUT', patch),
+        regenerateSeoSitemap: () => data(`${base}/seo/sitemap/regenerate`, 'POST'),
+        getSeoEntry: ({ entryId }) => data(entryPath(entryId), 'GET'),
+        putSeoEntry: ({ entryId }, patch = {}) => data(entryPath(entryId), 'PUT', patch),
+        analyzeSeoEntry: ({ entryId }) => data(`${entryPath(entryId)}/analyze`, 'GET'),
+        listSeoPosts: () => choices('posts'),
+        listSeoPages: () => choices('pages'),
+        mediaOriginalUrl: ({ id }) => transport.url({ path: `${base}/media/${encodeURIComponent(id)}/original` }),
+        async fetchSitemapXml(_required, options = {}) {
+            if (!sitemapTransport)
+                throw new Error('SEO sitemap transport unavailable');
+            options.signal?.throwIfAborted();
+            const response = await sitemapTransport.get({ path: '/sitemap.xml', credentials: 'same-origin' }, options);
+            // Non-XML often means a dev proxy, stale build or captive portal answered instead. Do not
+            // silently parse an HTML error page as a sitemap with zero URLs (source defensive guard).
+            const contentType = response.headers.get('content-type') ?? '';
+            if (!response.ok || !contentType.includes('xml'))
+                throw new Error(`Could not load the sitemap (HTTP ${response.status}).`);
+            return { text: await response.text() };
+        },
+    };
+}
+//# sourceMappingURL=http.js.map

package/dist/seo/adapters/memory.d.ts

@@ -0,0 +1,28 @@
+import type { AdminSeoPort } from '../ports.js';
+import type { SeoEntryMeta, SeoEntryAnalysis, SeoEntryOverridesPatch, SeoSettings, AdminPost } from '../models.js';
+export interface SeoEntrySeed {
+    meta: SeoEntryMeta;
+    analysis: SeoEntryAnalysis;
+}
+export interface MemorySeoOptions {
+    settings?: SeoSettings;
+    entries?: Record<string, SeoEntrySeed>;
+    posts?: readonly AdminPost[];
+    pages?: readonly AdminPost[];
+    sitemapText?: string;
+    sitemapError?: string;
+    mediaOriginalUrl?: (required: {
+        id: string;
+    }, optional?: Record<string, never>) => string;
+}
+/** Isolated memory backend with seeded effective defaults; never implements a CMS repository.
+ * Clears resolve back to the seed, and prior returned snapshots never change on subsequent writes.
+ * A host with richer content derivation can supply resolveEntry rather than fork the adapter. */
+export declare function createMemorySeoApi(required?: MemorySeoOptions, { resolveEntry }?: {
+    resolveEntry?: (required: {
+        entryId: string;
+        base: SeoEntryMeta;
+        overrides: SeoEntryOverridesPatch;
+    }, optional?: Record<string, never>) => SeoEntryMeta;
+}): AdminSeoPort;
+//# sourceMappingURL=memory.d.ts.map

package/dist/seo/adapters/memory.js

@@ -0,0 +1,129 @@
+const defaultSettings = () => ({ titleTemplate: '%s', defaultRobots: { noindex: false, nofollow: false }, sitemapEnabled: true, robotsRules: [] });
+const clone = (value) => structuredClone(value);
+/** `patch value ?? meta value`, named — {@link applySeoPatch} calls this once per field instead of
+ *  inlining `??` at each of its 13 fields: a plain function call isn't a decision point the way an
+ *  inline `??` is, so this is what keeps that merge under the complexity ceiling (same fix this
+ *  codebase's `orEmpty` established elsewhere for the same class of violation — a flat run of
+ *  independent fallbacks, not real branching logic).
+ *
+ *  `null` (the patch's CLEAR sentinel) falls through to the meta value by the same `??`, which is
+ *  the right model for this fake: the server drops the override and re-resolves, and the seeded
+ *  `meta` is the closest thing this fake has to that resolved value. It is only an approximation —
+ *  a test that needs to prove a clear actually reached the wire must assert on the PUT body, not on
+ *  what comes back. */
+function orMeta(patchValue, metaValue) {
+    return patchValue ?? metaValue;
+}
+/** Applies a {@link SeoEntryOverridesPatch} onto a resolved {@link SeoEntryMeta} — only the fields
+ *  a fake's own tests plausibly touch are merged (title/description/canonical directly, robots and
+ *  the OG/Twitter card objects field-by-field); this mirrors the server's `SeoExtFields` -> `SeoMeta`
+ *  merge closely enough for hook-level tests without re-implementing the real resolution rules. */
+// Optional read fields are absent when unresolved; write-only null never reaches the read shape.
+function optionalString(key, value) {
+    return value === undefined ? {} : { [key]: value };
+}
+function applySeoPatch(meta, patch) {
+    return {
+        ...meta,
+        title: orMeta(patch.title, meta.title),
+        ...optionalString('description', orMeta(patch.description, meta.description)),
+        canonical: orMeta(patch.canonical, meta.canonical),
+        robots: {
+            noindex: orMeta(patch.noindex, meta.robots.noindex),
+            nofollow: orMeta(patch.nofollow, meta.robots.nofollow),
+        },
+        openGraph: {
+            ...meta.openGraph,
+            title: orMeta(patch.ogTitle, meta.openGraph.title),
+            ...optionalString('description', orMeta(patch.ogDescription, meta.openGraph.description)),
+            ...optionalString('image', orMeta(patch.ogImage, meta.openGraph.image)),
+            type: orMeta(patch.ogType, meta.openGraph.type),
+        },
+        twitter: {
+            ...meta.twitter,
+            card: orMeta(patch.twitterCard, meta.twitter.card),
+            title: orMeta(patch.twitterTitle, meta.twitter.title),
+            ...optionalString('description', orMeta(patch.twitterDescription, meta.twitter.description)),
+            ...optionalString('image', orMeta(patch.twitterImage, meta.twitter.image)),
+        },
+    };
+}
+/** One of the three site-wide scalars the server registers as `nullable: true` (`SEO_DEFINITIONS`,
+ *  `apps/website/src/features/seo/settings.ts`), under the real write's own rule: an omitted key
+ *  (`undefined`) keeps the current value, `null` clears it, and a string overwrites. */
+function settingOrCleared(patchValue, currentValue) {
+    if (patchValue === undefined)
+        return currentValue;
+    return patchValue ?? undefined;
+}
+/** Applies a {@link SeoSettingsPatch} the way the real `setSeoSettings` does: an omitted key leaves
+ *  the current value alone (it is a MERGE — `buildScalarWrites` skips every `undefined`), and a
+ *  `null` on one of the three nullable scalars clears it back to absent, which `getSeoSettings`
+ *  reads back as `undefined` (via its `undefinedIfEmpty`). Naming those three explicitly rather
+ *  than spreading the patch verbatim is what stops a `null` from surviving into a `SeoSettings`
+ *  the fake hands back — no real response can contain one.
+ *
+ *  @complexity O(1) — three fixed field reads, no iteration. */
+function applySettingsPatch(current, patch) {
+    const { defaultDescription, defaultOgImage, twitterSite, ...rest } = patch;
+    const { defaultDescription: _description, defaultOgImage: _image, twitterSite: _site, ...retained } = current;
+    return {
+        ...retained,
+        ...rest,
+        ...optionalString('defaultDescription', settingOrCleared(defaultDescription, current.defaultDescription)),
+        ...optionalString('defaultOgImage', settingOrCleared(defaultOgImage, current.defaultOgImage)),
+        ...optionalString('twitterSite', settingOrCleared(twitterSite, current.twitterSite)),
+    };
+}
+/** Isolated memory backend with seeded effective defaults; never implements a CMS repository.
+ * Clears resolve back to the seed, and prior returned snapshots never change on subsequent writes.
+ * A host with richer content derivation can supply resolveEntry rather than fork the adapter. */
+export function createMemorySeoApi(required = {}, { resolveEntry } = {}) {
+    let settings = clone(required.settings ?? defaultSettings());
+    const entries = clone(required.entries ?? {});
+    const posts = clone(required.posts ?? []);
+    const pages = clone(required.pages ?? []);
+    const overrides = {};
+    const lookup = (entryId) => {
+        const found = entries[entryId];
+        if (!found)
+            throw new Error(`fake seo port: unknown entry ${entryId}`);
+        return found;
+    };
+    const resolved = (entryId) => {
+        const base = lookup(entryId).meta;
+        const patch = overrides[entryId] ?? {};
+        return resolveEntry ? resolveEntry({ entryId, base: clone(base), overrides: clone(patch) }) : applySeoPatch(base, patch);
+    };
+    return {
+        async getSeoSettings() { return clone(settings); },
+        async putSeoSettings(_required, patch = {}) { settings = applySettingsPatch(settings, patch); return clone(settings); },
+        async regenerateSeoSitemap() { return { accepted: true }; },
+        async getSeoEntry({ entryId }) { return clone(resolved(entryId)); },
+        async putSeoEntry({ entryId }, patch = {}) {
+            lookup(entryId);
+            const current = { ...overrides[entryId] };
+            // O(k) in patch keys; null removes only touched overrides, omission preserves other edits.
+            for (const key of Object.keys(patch)) {
+                const value = patch[key];
+                if (value === null)
+                    delete current[key];
+                else if (value !== undefined)
+                    Object.assign(current, { [key]: value });
+            }
+            overrides[entryId] = current;
+            return clone(resolved(entryId));
+        },
+        async analyzeSeoEntry({ entryId }) { return clone(lookup(entryId).analysis); },
+        async listSeoPosts() { return clone(posts); },
+        async listSeoPages() { return clone(pages); },
+        async fetchSitemapXml(_required, { signal } = {}) {
+            signal?.throwIfAborted();
+            if (required.sitemapError !== undefined)
+                throw new Error(required.sitemapError);
+            return { text: required.sitemapText ?? '<?xml version="1.0" encoding="UTF-8"?>\n<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">\n</urlset>\n' };
+        },
+        mediaOriginalUrl({ id }) { return required.mediaOriginalUrl?.({ id }) ?? `memory://media/${encodeURIComponent(id)}/original`; },
+    };
+}
+//# sourceMappingURL=memory.js.map