@jini-ai/cms 0.5.1 → 0.5.3

package/dist/redirects/ports.d.ts

@@ -0,0 +1,242 @@
+/**
+ * @file Port + seam contracts for the `redirects` Tier-2 library (ADR-033).
+ *
+ * ADR-006 accounting (rule-of-two):
+ * - `RedirectRepoPort` is a genuine port — it rides the ADR-015 seam with two
+ *   adapters built now (in-memory for tests + Drizzle/SQLite for persistence),
+ *   matching every other feature in `src/features/*`.
+ * - `RedirectMatcher` and `RedirectHitSink` are declared here as ordinary
+ *   INTERNAL SEAMS, not ADR-006 ports. Neither has a second adapter under
+ *   construction today: the matcher's plausible-second is an edge/CDN compiler
+ *   (emit an nginx `map` / Cloudflare ruleset), the hit sink's is an external
+ *   analytics store — both real, neither built now. Per ADR-006 they stay
+ *   ordinary code with a documented seam, promoted to a port the day the second
+ *   adapter is real. They are typed as interfaces purely for testability.
+ *
+ * Architectural role:
+ * INTERFACES ONLY — no feature logic.
+ *
+ * Grounding: ADR-006 (rule-of-two), ADR-015 (repo behind a port), ADR-009
+ * (typed calls / outbox / hooks), ADR-022 (chokepoint writes record a revision
+ * in the same tx; bounded matching = the totality/bounded-cost trust primitive),
+ * ADR-021 (permission strings enforced by the calling gateway, not the repo).
+ */
+import type { ISODateTime, UUID } from "@jini-ai/core/primitives";
+import type { RedirectLocationRefusalReason } from "./target-gate.js";
+import type { DomainEvent } from "../core/index.js";
+import type { ListRedirectsFilter, RedirectHitStats, RedirectRecord, RedirectRequest, RedirectResolution, RedirectRevision } from "./types.js";
+/**
+ * Persistence port for redirect rules + their revision ledger + tombstones.
+ * The single write chokepoint (ADR-022 §4a): `save` MUST persist the record and
+ * its {@link RedirectRevision} in one transaction; no other module writes the
+ * `redirects` / `redirect_revisions` tables (CI import-graph canary, ADR-027
+ * precedent).
+ */
+export interface RedirectRepoPort {
+    findById(required: {
+        workspaceId: UUID;
+        id: UUID;
+    }, optional?: Record<string, never>): Promise<RedirectRecord | null>;
+    /** Index-backed O(1) exact-path lookup (active rules only). */
+    lookupExact(required: {
+        workspaceId: UUID;
+        path: string;
+        includeOverrideOnly: boolean;
+    }, optional?: Record<string, never>): Promise<RedirectRecord | null>;
+    /** Longest-prefix match over active `prefix` rules (index/trie-backed). */
+    lookupLongestPrefix(required: {
+        workspaceId: UUID;
+        path: string;
+        includeOverrideOnly: boolean;
+    }, optional?: Record<string, never>): Promise<RedirectRecord | null>;
+    /**
+     * The bounded "dynamic" set: active `wildcard` + `regex` rules in evaluation
+     * order (specificity → priority → recency). Returned capped; callers evaluate
+     * them through {@link RedirectMatcher} only after exact/prefix miss.
+     */
+    listDynamic(required: {
+        workspaceId: UUID;
+        includeOverrideOnly: boolean;
+        limit: number;
+    }, optional?: Record<string, never>): Promise<RedirectRecord[]>;
+    list(filter: ListRedirectsFilter, optional?: Record<string, never>): Promise<RedirectRecord[]>;
+    /**
+     * Resolve where an existing rule with the given `fromPattern` already points,
+     * used at write time for cycle detection + chain collapsing (ADR-033 §6).
+     */
+    findByFromPattern(required: {
+        workspaceId: UUID;
+        fromPattern: string;
+    }, optional?: Record<string, never>): Promise<RedirectRecord | null>;
+    /** Chokepoint write: upsert the record and append its revision in one tx. */
+    save(required: {
+        record: RedirectRecord;
+        revision: RedirectRevision;
+    }, optional?: Record<string, never>): Promise<void>;
+    /** Tombstone (soft-delete): flip status + append a tombstone revision in one tx. */
+    tombstone(required: {
+        workspaceId: UUID;
+        id: UUID;
+        revision: RedirectRevision;
+    }, optional?: Record<string, never>): Promise<void>;
+}
+/**
+ * INTERNAL SEAM (not an ADR-006 port). Pure, bounded matching of a request
+ * against the dynamic rule set. Implementations MUST be total and
+ * bounded-cost — linear-time / RE2 semantics, an anchored pattern, and a
+ * per-request evaluation cap — because this is the request-hot-path expression
+ * evaluator ADR-022's amendment designates a trust-boundary primitive. No
+ * backtracking regex engine may back this.
+ */
+export interface RedirectMatcher {
+    /**
+     * Return the first matching rule with captures interpolated into `location`,
+     * or `{ matched: false }`. `rules` is the already-ordered, already-capped
+     * dynamic set from {@link RedirectRepoPort.listDynamic}.
+     */
+    match(required: {
+        request: RedirectRequest;
+        rules: RedirectRecord[];
+    }, optional?: Record<string, never>): RedirectResolution;
+    /**
+     * Compile-time validation of a single pattern (called at the write
+     * chokepoint): rejects unbounded/backtracking constructs before a rule is
+     * ever stored, so an unsafe pattern cannot reach the hot path.
+     */
+    validatePattern(required: {
+        matchType: RedirectRecord["matchType"];
+        fromPattern: string;
+    }, optional?: Record<string, never>): {
+        ok: true;
+    } | {
+        ok: false;
+        reason: string;
+    };
+}
+/**
+ * INTERNAL SEAM (not an ADR-006 port). Best-effort, off-hot-path hit
+ * aggregation. The resolver emits a {@link RedirectHitEvent} via the outbox
+ * (ADR-009 async lane); an idempotent handler folds it into the
+ * `redirect_hits` sidecar through this sink. A dropped increment loses a
+ * statistic, never a redirect.
+ */
+export interface RedirectHitSink {
+    record(required: {
+        workspaceId: UUID;
+        redirectId: UUID;
+        at: ISODateTime;
+    }, optional?: Record<string, never>): Promise<void>;
+    getStats(required: {
+        workspaceId: UUID;
+        redirectId: UUID;
+    }, optional?: Record<string, never>): Promise<RedirectHitStats | null>;
+    listStats(required: {
+        workspaceId: UUID;
+    }, optional?: Record<string, never>): Promise<RedirectHitStats[]>;
+}
+/**
+ * Application service consulted by the routing resolution chain. It is invoked
+ * twice per request lifecycle: `pre_content` (override rules only) and
+ * `post_content` (the 404-fill pass). The exact registration contract with the
+ * (not-yet-designed) `routing` library is OWED by the future routing ADR —
+ * ADR-033 §4 specifies the redirects side and flags the seam as co-dependent.
+ */
+export interface RedirectResolver {
+    resolve(request: RedirectRequest, optional?: Record<string, never>): Promise<RedirectResolution>;
+}
+export interface RedirectMutatedEventPayload {
+    workspaceId: UUID;
+    redirectId: UUID;
+    change: "created" | "updated" | "tombstoned";
+}
+export type RedirectMutatedEvent = DomainEvent<RedirectMutatedEventPayload>;
+export interface RedirectHitEventPayload {
+    workspaceId: UUID;
+    redirectId: UUID;
+    at: ISODateTime;
+}
+export type RedirectHitEvent = DomainEvent<RedirectHitEventPayload>;
+/**
+ * Sync filter hook (ADR-009 lane 3): lets a plugin transform or short-circuit a
+ * resolution — e.g. an i18n plugin rewriting the target per locale, or an SEO
+ * plugin adding canonicalization. Declared-before-attached; ordered by explicit
+ * priority. Conditional (geo/device/auth) redirects are the named v1-deferred
+ * feature that lands ON this hook, not in core.
+ */
+export interface RedirectResolveHookContext {
+    request: RedirectRequest;
+    /** The resolution core computed; the hook returns it unchanged or replaces it. */
+    resolution: RedirectResolution;
+}
+export type RedirectResolveHook = (ctx: RedirectResolveHookContext) => RedirectResolution | Promise<RedirectResolution>;
+export interface RouteResolveContext {
+    readonly workspaceId: UUID;
+    readonly siteId?: string;
+    readonly locale?: string;
+    readonly originKey?: string;
+    /**
+     * TODO(ADR-040): compose canonicalUrl from OriginRegistryPort.canonicalOrigin(ctx)
+     * once src/origin exists. Until then, a caller that knows the verified origin
+     * may pass it here; absent, canonicalUrl falls back to the relative path.
+     */
+    readonly originOverride?: string;
+}
+/** Terminal decision a phase resolver may return; anything else falls through. */
+export type RouteResolvePhaseOutcome = {
+    readonly kind: "redirect";
+    readonly location: string;
+    readonly statusCode: number;
+} | {
+    readonly kind: "resolved";
+    readonly path: string;
+} | {
+    readonly kind: "not_found";
+};
+/** Payload handed to the bound {@link SlugChangeCapture} inside the rename transaction. */
+export interface SlugChangeCaptureInput {
+    readonly workspaceId: UUID;
+    readonly entryId: UUID;
+    readonly oldPath: string;
+    readonly newPath: string;
+    readonly actor: UUID;
+    readonly changeSetId?: UUID;
+}
+/**
+ * The single named slot content's write chokepoint calls inside the rename
+ * transaction (ADR-039 §4). Declared here by routing (content knows nothing of
+ * redirects); implemented by the redirects library; wired by the composition
+ * root. **No slot implementation may be plugin-supplied** (Round-2 amendment 1
+ * — the slot is core-resident by definition).
+ *
+ * Constraints on any bound implementation (Round-2 amendment 2): idempotent by
+ * `changeSetId`, no external I/O, no in-tx publish (an outbox row may be
+ * written in-tx per the transactional-outbox pattern, but dispatch happens
+ * post-commit), and a strict lock order of content row before redirect rows.
+ *
+ * Fail-closed nuance (Round-2 amendment 3, not enforced by this library):
+ * absent binding is a no-op only before Redirects is installed, or while
+ * slug-preservation is disabled for the workspace. Once link-preservation is
+ * enabled, a slug-changing rename with no bound capture MUST fail
+ * `LINK_PRESERVATION_UNAVAILABLE` rather than silently skip the redirect. That
+ * enforcement belongs to the content write chokepoint (which knows whether
+ * preservation is enabled) and to Redirects (which doesn't exist yet in this
+ * repo) — this library only exposes the registration slot.
+ */
+export interface SlugChangeCapture {
+    onSlugChange(input: SlugChangeCaptureInput, optional?: Record<string, never>): Promise<void>;
+}
+/** Refusal evidence never exposes a redirect that bypassed the INV-03 gate. */
+export interface RedirectRefusal {
+    redirectId: UUID;
+    location: string;
+    reason: RedirectLocationRefusalReason;
+}
+export interface RedirectResolutionReport {
+    resolution: RedirectResolution;
+    refused: RedirectRefusal[];
+}
+/** The legacy resolver plus refusal evidence for adapters that must report declines. */
+export interface RedirectResolverWithRefusals extends RedirectResolver {
+    resolveWithRefusals(request: RedirectRequest, optional?: Record<string, never>): Promise<RedirectResolutionReport>;
+}
+//# sourceMappingURL=ports.d.ts.map

package/dist/redirects/ports.internal.d.ts

@@ -0,0 +1,57 @@
+/**
+ * @file Package-private shared insert helper for the `redirects` write path
+ * (ADR-PIPE-009 Decision A).
+ *
+ * Purpose:
+ * `insertRedirectAndRevision` is the sole path INV-01 depends on: exactly one
+ * `redirects` row write + one `redirect_revisions` row write, in call order,
+ * against whatever `RedirectDbHandle` the caller passes in. It performs NO
+ * transaction control of its own (no `BEGIN`/`COMMIT`) — atomicity is the
+ * CALLER's responsibility: `redirects.ts`'s chokepoint wraps a call to this
+ * function in its own `BEGIN IMMEDIATE`/`COMMIT`; `capture.ts` calls it
+ * directly, relying on the (future) content chokepoint's already-open ambient
+ * transaction on the same single-connection `better-sqlite3` handle
+ * (ADR-PIPE-009 Decision A, EC-05).
+ *
+ * Import-graph note: the domain-logic callers of this function are
+ * `redirects.ts` and `capture.ts` only (ADR-PIPE-009/tasks.md T012) — no route
+ * handler or UI code may import it. `repo.memory.ts`/`repo.sqlite.ts` import
+ * only the `RedirectDbHandle` TYPE (not this function) to declare the shape
+ * their own storage satisfies; they do not call `insertRedirectAndRevision`
+ * themselves (each adapter's own `save`/`tombstone` port methods write via
+ * their own direct storage calls, independently testable by the
+ * `RedirectRepoPort` contract suite, T007). This keeps the chokepoint
+ * boundary (INV-07) at {`redirects.ts`, `capture.ts`, `ports.internal.ts`},
+ * matching the Enforcement section's review-time check.
+ *
+ * Architectural role:
+ * Package-private. NOT exported from `index.ts` (ADR-PIPE-009 Migration
+ * Safety / File Map).
+ */
+import type { RedirectRecord, RedirectRevision } from "./types.js";
+/**
+ * The minimal storage seam `insertRedirectAndRevision` writes through.
+ * Deliberately narrower than `RedirectRepoPort` (no reads, no transaction
+ * control) — both `repo.memory.ts` and `repo.sqlite.ts` (or a small internal
+ * handle each of them owns) satisfy this shape so `redirects.ts`/`capture.ts`
+ * can share one write path regardless of which adapter is active.
+ */
+export interface RedirectDbHandle {
+    insertRedirect(record: RedirectRecord, optional?: Record<string, never>): void | Promise<void>;
+    insertRevision(revision: RedirectRevision, optional?: Record<string, never>): void | Promise<void>;
+}
+export interface InsertRedirectAndRevisionRequired {
+    db: RedirectDbHandle;
+    record: RedirectRecord;
+    revision: RedirectRevision;
+}
+/**
+ * Insert a `redirects` row and its paired `redirect_revisions` row, in that
+ * order, against `db`. Never opens or closes a transaction; any error from
+ * `db` propagates uncaught so the caller's own transaction (or lack thereof)
+ * decides the outcome.
+ *
+ * @complexity O(1) — two writes, no I/O beyond what `db` itself performs.
+ */
+export declare function insertRedirectAndRevision(required: InsertRedirectAndRevisionRequired, _optional?: Record<string, never>): Promise<void>;
+//# sourceMappingURL=ports.internal.d.ts.map

package/dist/redirects/ports.internal.js

@@ -0,0 +1,14 @@
+/**
+ * Insert a `redirects` row and its paired `redirect_revisions` row, in that
+ * order, against `db`. Never opens or closes a transaction; any error from
+ * `db` propagates uncaught so the caller's own transaction (or lack thereof)
+ * decides the outcome.
+ *
+ * @complexity O(1) — two writes, no I/O beyond what `db` itself performs.
+ */
+export async function insertRedirectAndRevision(required, _optional = {}) {
+    const { db, record, revision } = required;
+    await db.insertRedirect(record);
+    await db.insertRevision(revision);
+}
+//# sourceMappingURL=ports.internal.js.map

package/dist/redirects/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/redirects/redirects.d.ts

@@ -0,0 +1,226 @@
+/**
+ * @file THE `redirects` write chokepoint (SPEC-009 REQ-01/04/05/06/07/08/13/
+ * 14/22/26; ADR-PIPE-009 C-001..C-004).
+ *
+ * Purpose:
+ * `createRedirect`/`updateRedirect`/`tombstoneRedirect`/`importRedirects` —
+ * the single manual-write entry point for redirect rules. Validates the
+ * pattern (via `RedirectMatcher.validatePattern`), rejects unsafe targets —
+ * absolute ones against the origin allowlist and site-relative ones against
+ * the admin application's own URL space (write-path open-redirect oracle,
+ * REQ-08; see `assertTargetAllowed`) — collapses/rejects
+ * one-hop chains (INV-04), enforces the exact-match dedup rule
+ * (behavior.spec.md §5.1), and writes the record + its revision in one
+ * transaction via `ports.internal.ts`'s shared `insertRedirectAndRevision`
+ * (INV-01/INV-07 — no other file writes `redirects`/`redirect_revisions`).
+ *
+ * Architectural role:
+ * Feature logic. No Express/route code — route handlers (Phase 2) call these
+ * functions directly and map thrown typed errors to HTTP codes per
+ * errors.spec.md.
+ */
+import { type Clock as ClockPort, type IdGenerator as IdGeneratorPort } from "@jini-ai/core/primitives";
+import { type OutboxPort } from "../core/index.js";
+import type { OriginRegistryPort } from "@jini-ai/http-kit/verified-origin";
+import { type RedirectDbHandle } from "./ports.internal.js";
+import type { RedirectMatcher, RedirectRepoPort } from "./ports.js";
+import type { CreateRedirectInput, RedirectMatchType, RedirectRecord, RedirectStatusCode, UpdateRedirectInput } from "./types.js";
+export declare const MIN_TARGET_LENGTH = 1;
+export declare const MAX_TARGET_LENGTH = 2048;
+export declare const MIN_PRIORITY = 0;
+export declare const MAX_PRIORITY = 1000;
+export declare const VALID_STATUS_CODES: readonly RedirectStatusCode[];
+export declare const MAX_IMPORT_BATCH_SIZE = 500;
+/**
+ * The removal primitive this domain is handed, rather than one it implements.
+ *
+ * Structurally typed ON PURPOSE — `features/redirects` imports nothing from `features/trash`, and
+ * must not. The composition root binds the real implementation (marker flip AND Trash index row, in
+ * one transaction) pre-bound to this domain's entity type. `display` is required so the two strings
+ * the Trash screen shows come from columns the caller already holds.
+ */
+export type RemoveRedirectFn = (required: {
+    workspaceId: string;
+    id: string;
+    display: {
+        title: string;
+        subtitle?: string | null;
+    };
+    at: string;
+    expectedVersion: number | null;
+    actor: {
+        principalId: string;
+        pluginId?: string | null;
+    };
+}) => Promise<{
+    ok: true;
+    version: number | null;
+} | {
+    ok: false;
+    reason: "not-found" | "version-changed";
+}>;
+export interface RedirectsWriteDeps {
+    repo: RedirectRepoPort;
+    /** See {@link RemoveRedirectFn}. Replaces `tombstoneRedirect`'s own `status` write. */
+    remove: RemoveRedirectFn;
+    /**
+     * Whether this rule has a Trash index row (S7, web-high fix plan 2026-09-24) — the thing
+     * `tombstoneRedirect` creates and Trash restore/purge match on, and NOT the same thing as
+     * `status === "disabled"` (an ordinary toggle-off has no Trash row at all). Structurally typed,
+     * same discipline as {@link RemoveRedirectFn}: this domain imports nothing from `features/trash`.
+     */
+    isInTrash: (required: {
+        workspaceId: string;
+        id: string;
+    }) => Promise<boolean>;
+    /**
+     * Un-trashes this rule (S7). Mirrors `TrashPort.restore`'s outcome union structurally, again
+     * without importing `features/trash`. `"adapter-unavailable"` is not reachable for redirects (the
+     * composition root always registers an adapter for `REDIRECT_ENTITY_TYPE`), but is part of the
+     * union it mirrors.
+     */
+    restore: (required: {
+        workspaceId: string;
+        id: string;
+        at: string;
+        actor: {
+            principalId: string;
+            pluginId?: string | null;
+        };
+    }) => Promise<"restored" | "not-found" | "version-changed" | "adapter-unavailable">;
+    /** The shared, non-tx-opening write handle (Decision A) — used via `ports.internal.ts`. */
+    db: RedirectDbHandle;
+    /** Opens/commits/rolls back the chokepoint's own transaction around a write. */
+    transaction: <T>(fn: () => Promise<T>) => Promise<T>;
+    matcher: RedirectMatcher;
+    originRegistry: OriginRegistryPort;
+    /** First path segments reserved by the composing host; no product-policy default. */
+    reservedSegments: ReadonlySet<string>;
+    clock: ClockPort;
+    idGen: IdGeneratorPort;
+    outbox: OutboxPort;
+}
+/**
+ * The site-relative half of the write gate: routing's structural + reserved-path verdict, then the
+ * redirect oracle's own raw-character rule. The read path hands a relative location to that oracle
+ * by concatenation, so a target it refuses (a raw backslash, any whitespace) would be stored and
+ * never fire; refusing it here keeps write and read agreeing. Checked SECOND so the more specific
+ * routing reasons (off-origin, control character, reserved) keep their own wording — a bare
+ * backslash target is `ok` to `checkSiteRelativeTarget` (on this site, `\` really does resolve to
+ * `/`), so only this second check ever refuses it (t91 B2, 2026-09-16). Last, the exact target
+ * `back`, which Express serves as the visitor's `Referer` instead of a path (see
+ * `./referrer-alias.ts`; t91 review F1, 2026-09-16).
+ *
+ * Exported as THE check for any caller-chosen, site-relative `Location` (t91 open-redirect fix,
+ * 2026-09-16): `routes/site/store.ts`'s `returnTo` had its own `startsWith("/") && !startsWith("//")`
+ * copy, which `/\evil.example` walks straight through. A caller that needs a path-absolute value
+ * still checks `startsWith("/")` itself — this function also accepts relative references (`new`,
+ * `?x`), which stay on-site but resolve against the current URL.
+ *
+ * @param required.target - The untrusted reference exactly as received, before any `new URL()` parse. Anything
+ * that is not site-relative (an absolute or protocol-relative URL, `javascript:`) is refused too.
+ * @returns The reason clause, or `null` when the target is allowed.
+ * @complexity O(n) in the target length.
+ * @example siteRelativeTargetReason({ target: "/products", reservedSegments }, {}); // => null
+ * @example siteRelativeTargetReason({ target: "/\\evil.example", reservedSegments }, {}) !== null; // => true
+ */
+export declare function siteRelativeTargetReason({ target, reservedSegments }: {
+    target: string;
+    reservedSegments: ReadonlySet<string>;
+}, _optional?: Record<string, never>): string | null;
+/**
+ * Pure precondition check mirroring every validator `createRedirect`/`updateRedirect` run, with NO
+ * write — `features/redirects/publish-content.ts`'s `precheck()` reuses this so the two can never
+ * drift onto different rulesets. Returns the refusal message a create/update against these exact
+ * fields would throw, or `null` when nothing would block.
+ *
+ * @param excludeId Mirrors {@link assertNoDuplicate}'s own parameter — the destination's own row id,
+ * when checking an update against itself.
+ * @complexity O(n) in `toTarget`'s length, plus the repo/origin reads each check makes — identical
+ * cost to `createRedirect`'s own validation pass, since this runs the exact same sequence.
+ */
+export declare function checkRedirectFieldsWouldWrite({ deps, fields }: {
+    deps: RedirectsWriteDeps;
+    fields: {
+        workspaceId: string;
+        matchType: RedirectMatchType;
+        fromPattern: string;
+        toTarget: string;
+        statusCode: RedirectStatusCode;
+        priority: number;
+    };
+}, { excludeId }?: {
+    excludeId?: string;
+}): Promise<string | null>;
+export interface CreateRedirectRequired {
+    deps: RedirectsWriteDeps;
+    input: CreateRedirectInput;
+    /**
+     * Provenance to stamp on the created record (REQ-01/26). Defaults to
+     * `'manual'`. `importRedirects` (C-004) passes `'import'` here — this is
+     * an internal parameter, not part of `CreateRedirectInput`'s public shape
+     * (an API caller never chooses their own provenance).
+     */
+    source?: "manual" | "import";
+}
+/** C-001: manual-create entry point (REQ-01). */
+export declare function createRedirect(required: CreateRedirectRequired, _optional?: Record<string, never>): Promise<{
+    record: RedirectRecord;
+}>;
+export interface UpdateRedirectRequired {
+    deps: RedirectsWriteDeps;
+    input: UpdateRedirectInput;
+}
+/**
+ * C-002: symmetric chokepoint entry for updates (REQ-04). A disable-only update
+ * ({@link isDisableOnlyUpdate}) writes the status change without re-validating the unchanged fields
+ * — it stores the existing target as-is, with no one-hop collapse.
+ *
+ * S7 (web-high fix plan 2026-09-24): a rule with a Trash index row (`deps.isInTrash`, distinct from
+ * `status === "disabled"` — see {@link RedirectsWriteDeps.isInTrash}'s own doc) refuses every update
+ * EXCEPT a pure `status: "active"` PATCH ({@link isRestoreOnlyUpdate}), which restores it instead of
+ * editing a row the caller cannot see the current shape of.
+ *
+ * @throws {EntityNotLiveError} On a non-restore update to a rule in the Trash.
+ * @throws {RedirectConflictError} If the Trash row's version moved before the restore landed.
+ */
+export declare function updateRedirect(required: UpdateRedirectRequired, _optional?: Record<string, never>): Promise<{
+    record: RedirectRecord;
+}>;
+export interface TombstoneRedirectRequired {
+    deps: RedirectsWriteDeps;
+    input: {
+        workspaceId: string;
+        id: string;
+        actorId: string;
+        pluginId?: string;
+    };
+}
+/** C-003: soft-delete (REQ-05). */
+export declare function tombstoneRedirect(required: TombstoneRedirectRequired, _optional?: Record<string, never>): Promise<{
+    record: RedirectRecord;
+}>;
+export interface ImportRedirectsRequired {
+    deps: RedirectsWriteDeps;
+    input: {
+        workspaceId: string;
+        actorId: string;
+        rules: CreateRedirectInput[];
+    };
+}
+export interface ImportRedirectsFailure {
+    index: number;
+    code: string;
+    message: string;
+}
+/**
+ * C-004: batch-create reusing the same chokepoint, no bypass (REQ-26). Each
+ * item is processed independently through `createRedirect` — NOT one shared
+ * transaction across items (EC-08); a per-item failure does not abort
+ * already-written prior items.
+ */
+export declare function importRedirects(required: ImportRedirectsRequired, _optional?: Record<string, never>): Promise<{
+    created: RedirectRecord[];
+    failed: ImportRedirectsFailure[];
+}>;
+//# sourceMappingURL=redirects.d.ts.map