@jini-ai/cms 0.5.2 → 0.5.3

package/dist/redirects/sql/repo.js

@@ -0,0 +1,143 @@
+import { compareLongestFirst, compareSamePatternExactFirst, compareTieBreak } from "../order.js";
+import { toRecord, toRevision, toRevisionRow, toRow, updatableColumns } from "./repo.rows.js";
+import { RedirectNotFoundError } from "../types.js";
+export class SqlRedirectRepo {
+    kernel;
+    tables;
+    constructor({ kernel, tables }, _optional = {}) {
+        this.kernel = kernel;
+        this.tables = tables;
+    }
+    /** Every row of a workspace, optionally narrowed to active rows of one match type (and override-only). */
+    async rowsOf(workspaceId, narrow = {}) {
+        const rows = await this.kernel.run((db) => {
+            // Host-owned table names need an explicit column schema, as in the comments adapter.
+            let query = db.withTables().selectFrom(this.tables.redirects).selectAll().where("workspace_id", "=", workspaceId);
+            if (narrow.activeOnly)
+                query = query.where("status", "=", "active");
+            if (narrow.matchType !== undefined)
+                query = query.where("match_type", "=", narrow.matchType);
+            if (narrow.overrideOnly)
+                query = query.where("override", "=", 1);
+            return query.execute();
+        });
+        return rows.map((row) => toRecord({ row }, {}));
+    }
+    async findById(required, _optional = {}) {
+        const row = await this.kernel.run((db) => db
+            .withTables()
+            .selectFrom(this.tables.redirects)
+            .selectAll()
+            .where("workspace_id", "=", required.workspaceId)
+            .where("id", "=", required.id)
+            .limit(1)
+            .executeTakeFirst());
+        return row ? toRecord({ row }, {}) : null;
+    }
+    async lookupExact(required, _optional = {}) {
+        const candidates = (await this.rowsOf(required.workspaceId, {
+            activeOnly: true,
+            matchType: "exact",
+            overrideOnly: required.includeOverrideOnly,
+        })).filter((r) => r.fromPattern === required.path);
+        candidates.sort((a, b) => compareTieBreak({ a, b }, {}));
+        return candidates[0] ?? null;
+    }
+    async lookupLongestPrefix(required, _optional = {}) {
+        const candidates = (await this.rowsOf(required.workspaceId, {
+            activeOnly: true,
+            matchType: "prefix",
+            overrideOnly: required.includeOverrideOnly,
+        })).filter((r) => {
+            const pattern = r.fromPattern;
+            if (required.path === pattern)
+                return true;
+            return required.path.startsWith(pattern.endsWith("/") ? pattern : `${pattern}/`);
+        });
+        candidates.sort((a, b) => compareLongestFirst({ a, b }, {}));
+        return candidates[0] ?? null;
+    }
+    async listDynamic(required, _optional = {}) {
+        const candidates = await this.rowsOf(required.workspaceId, {
+            activeOnly: true,
+            matchType: "wildcard",
+            overrideOnly: required.includeOverrideOnly,
+        });
+        candidates.sort((a, b) => compareLongestFirst({ a, b }, {}));
+        return candidates.slice(0, required.limit);
+    }
+    async list(filter, _optional = {}) {
+        return (await this.rowsOf(filter.workspaceId))
+            .filter((r) => filter.status === undefined || r.status === filter.status)
+            .filter((r) => filter.source === undefined || r.source === filter.source)
+            .filter((r) => filter.matchType === undefined || r.matchType === filter.matchType);
+    }
+    async findByFromPattern(required, _optional = {}) {
+        const candidates = (await this.rowsOf(required.workspaceId, { activeOnly: true })).filter((r) => r.fromPattern === required.fromPattern);
+        if (candidates.length === 0)
+            return null;
+        candidates.sort((a, b) => compareSamePatternExactFirst({ a, b }, {}));
+        return candidates[0];
+    }
+    async save(required, _optional = {}) {
+        await this.kernel.transaction(async () => {
+            await this.kernel.lockKey(`redirects:${required.record.workspaceId}`);
+            await this.insertRedirect(required.record);
+            await this.insertRevision(required.revision);
+        });
+    }
+    async tombstone(required, _optional = {}) {
+        await this.kernel.transaction(async () => {
+            await this.kernel.lockKey(`redirects:${required.workspaceId}`);
+            const existing = await this.findById({ workspaceId: required.workspaceId, id: required.id });
+            if (!existing)
+                throw new RedirectNotFoundError(`redirect '${required.id}' was not found`);
+            await this.insertRedirect(required.revision.state);
+            await this.insertRevision(required.revision);
+        });
+    }
+    // -------------------------------------------------------------------
+    // RedirectDbHandle (used by redirects.ts/capture.ts via ports.internal.ts)
+    // -------------------------------------------------------------------
+    /** Upsert-by-id; no transaction control of its own. */
+    async insertRedirect(record, _optional = {}) {
+        const row = toRow({ record }, {});
+        await this.kernel.run((db) => db
+            .withTables()
+            .insertInto(this.tables.redirects)
+            .values(row)
+            .onConflict((oc) => oc.column("id").doUpdateSet(updatableColumns({ row }, {})))
+            .execute());
+    }
+    /** Append-only insert; no transaction control of its own. */
+    async insertRevision(revision, _optional = {}) {
+        await this.kernel.run((db) => db.withTables().insertInto(this.tables.revisions).values(toRevisionRow({ revision }, {})).execute());
+    }
+    /** Test-only helper: the append-only revision ledger for one redirect, in seq order. */
+    async listRevisionsForTests({ redirectId }, _optional = {}) {
+        const rows = await this.kernel.run((db) => db
+            .withTables()
+            .selectFrom(this.tables.revisions)
+            .selectAll()
+            .where("redirect_id", "=", redirectId)
+            .orderBy("seq", "asc")
+            .execute());
+        return rows.map((row) => toRevision({ row }, {}));
+    }
+    /**
+     * The chokepoint's transaction (C-001..004). Takes the redirect write lock first so its
+     * uniqueness / chain-loop reads and the write that follows are one serialized unit; nested calls
+     * (including `save`/`tombstone`) join it. `capture.ts` never calls this (Decision A).
+     */
+    async transaction(fn, _optional = {}) {
+        return this.kernel.transaction(async () => {
+            await this.kernel.lockKey("redirects:write");
+            return fn();
+        });
+    }
+}
+/** The redirect repo for `kernel`. */
+export function redirectRepoFor(required, _optional = {}) {
+    return new SqlRedirectRepo(required, {});
+}
+//# sourceMappingURL=repo.js.map

package/dist/redirects/sql/repo.rows.d.ts

@@ -0,0 +1,49 @@
+import type { Insertable, Selectable } from "kysely";
+import type { RedirectsTable, RedirectRevisionsTable } from "./row-types.js";
+import type { RedirectRecord, RedirectRevision } from "../types.js";
+/**
+ * @file Row mapping for `redirects` / `redirect_revisions`, shared by every dialect: the columns are
+ * the generated `ContentDatabase` types (snake_case, JSON as text, booleans as 0/1 integers). Neutral
+ * on purpose — no repo, no driver.
+ */
+export type RedirectRow = Selectable<RedirectsTable>;
+export type RedirectRevisionRow = Selectable<RedirectRevisionsTable>;
+/** One `redirects` row as a {@link RedirectRecord}. */
+export declare function toRecord({ row }: {
+    row: RedirectRow;
+}, _optional?: Record<string, never>): RedirectRecord;
+/** `toRecord`'s inverse: the exact column values one whole-row upsert persists. */
+export declare function toRow({ record }: {
+    record: RedirectRecord;
+}, _optional?: Record<string, never>): Insertable<RedirectsTable>;
+/** The columns an existing row's upsert replaces — everything but the match key `id`. */
+export declare function updatableColumns({ row }: {
+    row: ReturnType<typeof toRow>;
+}, _optional?: Record<string, never>): {
+    source: string;
+    status: string;
+    version: number;
+    workspace_id: string;
+    created_at: string;
+    updated_at: string;
+    override: number;
+    priority: number;
+    match_type: string;
+    from_pattern: string;
+    to_target: string;
+    status_code: number;
+    created_by_principal: string;
+    source_entry_id?: string | null;
+    from_path_at_capture?: string | null;
+    to_path_at_capture?: string | null;
+    created_by_plugin_id?: string | null;
+};
+/** The `redirect_revisions` row an append writes (compact JSON state; `id` is database-assigned). */
+export declare function toRevisionRow({ revision }: {
+    revision: RedirectRevision;
+}, _optional?: Record<string, never>): Insertable<RedirectRevisionsTable>;
+/** One `redirect_revisions` row as a {@link RedirectRevision}. */
+export declare function toRevision({ row }: {
+    row: RedirectRevisionRow;
+}, _optional?: Record<string, never>): RedirectRevision;
+//# sourceMappingURL=repo.rows.d.ts.map

package/dist/redirects/sql/repo.rows.js

@@ -0,0 +1,79 @@
+import { toBool } from "@jini-ai/db/kernel";
+/** One `redirects` row as a {@link RedirectRecord}. */
+export function toRecord({ row }, _optional = {}) {
+    return {
+        id: row.id,
+        workspaceId: row.workspace_id,
+        matchType: row.match_type,
+        fromPattern: row.from_pattern,
+        toTarget: row.to_target,
+        statusCode: row.status_code,
+        status: row.status,
+        override: toBool(row.override) === true,
+        priority: row.priority,
+        source: row.source,
+        sourceEntryId: row.source_entry_id ?? undefined,
+        fromPathAtCapture: row.from_path_at_capture ?? undefined,
+        toPathAtCapture: row.to_path_at_capture ?? undefined,
+        createdByPrincipal: row.created_by_principal,
+        createdByPluginId: row.created_by_plugin_id ?? undefined,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+        version: row.version,
+    };
+}
+/** `toRecord`'s inverse: the exact column values one whole-row upsert persists. */
+export function toRow({ record }, _optional = {}) {
+    return {
+        id: record.id,
+        workspace_id: record.workspaceId,
+        match_type: record.matchType,
+        from_pattern: record.fromPattern,
+        to_target: record.toTarget,
+        status_code: record.statusCode,
+        status: record.status,
+        override: record.override ? 1 : 0,
+        priority: record.priority,
+        source: record.source,
+        source_entry_id: record.sourceEntryId ?? null,
+        from_path_at_capture: record.fromPathAtCapture ?? null,
+        to_path_at_capture: record.toPathAtCapture ?? null,
+        created_by_principal: record.createdByPrincipal,
+        created_by_plugin_id: record.createdByPluginId ?? null,
+        created_at: record.createdAt,
+        updated_at: record.updatedAt,
+        version: record.version,
+    };
+}
+/** The columns an existing row's upsert replaces — everything but the match key `id`. */
+export function updatableColumns({ row }, _optional = {}) {
+    const { id: _id, ...rest } = row;
+    return rest;
+}
+/** The `redirect_revisions` row an append writes (compact JSON state; `id` is database-assigned). */
+export function toRevisionRow({ revision }, _optional = {}) {
+    return {
+        redirect_id: revision.redirectId,
+        workspace_id: revision.workspaceId,
+        seq: revision.seq,
+        state_json: JSON.stringify(revision.state),
+        tombstoned: revision.tombstoned ? 1 : 0,
+        actor_id: revision.actorId,
+        plugin_id: revision.pluginId ?? null,
+        recorded_at: revision.recordedAt,
+    };
+}
+/** One `redirect_revisions` row as a {@link RedirectRevision}. */
+export function toRevision({ row }, _optional = {}) {
+    return {
+        redirectId: row.redirect_id,
+        workspaceId: row.workspace_id,
+        seq: row.seq,
+        state: JSON.parse(row.state_json),
+        tombstoned: toBool(row.tombstoned) === true,
+        actorId: row.actor_id,
+        pluginId: row.plugin_id ?? undefined,
+        recordedAt: row.recorded_at,
+    };
+}
+//# sourceMappingURL=repo.rows.js.map

package/dist/redirects/sql/row-types.d.ts

@@ -0,0 +1,34 @@
+import type { Generated } from "kysely";
+/** Stored column shapes copied without schema changes; table names are host-owned. */
+export interface RedirectsTable {
+    id: string;
+    workspace_id: string;
+    match_type: string;
+    from_pattern: string;
+    to_target: string;
+    status_code: number;
+    status: string;
+    override: number;
+    priority: number;
+    source: string;
+    source_entry_id: string | null;
+    from_path_at_capture: string | null;
+    to_path_at_capture: string | null;
+    created_by_principal: string;
+    created_by_plugin_id: string | null;
+    created_at: string;
+    updated_at: string;
+    version: number;
+}
+export interface RedirectRevisionsTable {
+    id: Generated<number>;
+    redirect_id: string;
+    workspace_id: string;
+    seq: number;
+    state_json: string;
+    tombstoned: number;
+    actor_id: string;
+    plugin_id: string | null;
+    recorded_at: string;
+}
+//# sourceMappingURL=row-types.d.ts.map

package/dist/redirects/sql/row-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=row-types.js.map

package/dist/redirects/target-gate.d.ts

@@ -0,0 +1,30 @@
+/** The shared INV-03 read gate used by runtime resolution and host export. */
+import type { OriginRegistryPort, RedirectTargetContext } from "@jini-ai/http-kit/verified-origin";
+import { type SameOriginDestinationCheck } from "./reserved-destination.js";
+/** Only the verified-origin owner's two redirect reads; no egress dependency. */
+export type RedirectTargetOracle = Pick<OriginRegistryPort, "canonicalOrigin" | "isAllowedRedirectTarget">;
+export type RedirectLocationRefusalReason = "referrer-alias" | "origin-unavailable" | "target-not-allowed" | "reserved-destination";
+export type RedirectLocationCheck = {
+    kind: "allowed";
+    candidate: string;
+} | {
+    kind: "refused";
+    reason: RedirectLocationRefusalReason;
+    destinationCheck?: SameOriginDestinationCheck;
+};
+/**
+ * Check a FULLY-INTERPOLATED Location with the required verified-origin oracle, then host path policy.
+ * Never checks a stored wildcard template in place of the Location a visitor would receive (INV-03).
+ * @param required Context, finished location, oracle and host-owned reserved first segments.
+ * @returns An explicit refusal or the absolute oracle candidate. No allow-all default exists.
+ * @throws Oracle infrastructure errors propagate, preserving the original resolver contract.
+ * @complexity O(location length), plus the origin reads. Constant additional state.
+ * @example checkRedirectLocation({ context, location: "/new", oracle, reservedSegments }, {});
+ */
+export declare function checkRedirectLocation({ context, location, oracle, reservedSegments }: {
+    context: RedirectTargetContext;
+    location: string;
+    oracle: RedirectTargetOracle;
+    reservedSegments: ReadonlySet<string>;
+}, _optional?: Record<string, never>): Promise<RedirectLocationCheck>;
+//# sourceMappingURL=target-gate.d.ts.map

package/dist/redirects/target-gate.js

@@ -0,0 +1,85 @@
+import { isReferrerAliasLocation } from "./referrer-alias.js";
+import { checkSameOriginDestination } from "./reserved-destination.js";
+/** A candidate `location` that already carries (or claims to carry) its own scheme/authority. */
+function isPotentiallyCrossOrigin(location) {
+    return location.startsWith("//") || /^[a-z][a-z0-9+.-]*:/i.test(location);
+}
+function isDefaultPort(scheme, port) {
+    if (port === undefined)
+        return true;
+    return (scheme === "https" && port === 443) || (scheme === "http" && port === 80);
+}
+function composeOriginUrl(origin) {
+    const authority = isDefaultPort(origin.scheme === "https" ? "https" : "http", origin.port)
+        ? origin.host
+        : `${origin.host}:${origin.port}`;
+    return `${origin.scheme}://${authority}`;
+}
+/**
+ * Resolve `location` to a candidate suitable for `isAllowedRedirectTarget`:
+ * pass an already-absolute/protocol-relative location through unchanged;
+ * resolve a relative location against the workspace's verified canonical
+ * origin. Returns `null` if no verified origin exists and `location` is
+ * relative (cannot even form a candidate to check — fails closed), and for
+ * Express's `back` alias, which is served as the request's `Referer` rather than
+ * as a path, so no candidate describes where it goes (see `./referrer-alias.ts`).
+ */
+async function toOracleCandidate(ctx, location, originRegistry) {
+    if (isReferrerAliasLocation({ location: location }, {}))
+        return null;
+    if (isPotentiallyCrossOrigin(location))
+        return location;
+    try {
+        const canonical = await originRegistry.canonicalOrigin(ctx);
+        const path = location.startsWith("/") ? location : `/${location}`;
+        return `${composeOriginUrl(canonical)}${path}`;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Check a FULLY-INTERPOLATED Location with the required verified-origin oracle, then host path policy.
+ * Never checks a stored wildcard template in place of the Location a visitor would receive (INV-03).
+ * @param required Context, finished location, oracle and host-owned reserved first segments.
+ * @returns An explicit refusal or the absolute oracle candidate. No allow-all default exists.
+ * @throws Oracle infrastructure errors propagate, preserving the original resolver contract.
+ * @complexity O(location length), plus the origin reads. Constant additional state.
+ * @example checkRedirectLocation({ context, location: "/new", oracle, reservedSegments }, {});
+ */
+export async function checkRedirectLocation({ context, location, oracle, reservedSegments }, _optional = {}) {
+    const candidate = await toOracleCandidate(context, location, oracle);
+    if (candidate === null) {
+        return { kind: "refused", reason: isReferrerAliasLocation({ location }, {}) ? "referrer-alias" : "origin-unavailable" };
+    }
+    const allowed = await oracle.isAllowedRedirectTarget({ context, url: candidate });
+    if (!allowed) {
+        // T050 (Polish) adds a warn-level log line here (normalized host only,
+        // never the full raw candidate) — named but not yet implemented.
+        return { kind: "refused", reason: "target-not-allowed" };
+    }
+    // The oracle answers "is that HOST allowed", which a same-origin destination passes by
+    // construction — including `/admin` and `/api`. See `checkSameOriginDestination`.
+    return checkReservedDestination({ context, candidate, oracle, reservedSegments }, {});
+}
+/**
+   * Second half of the read-path target gate: the oracle's host verdict, then this pathname
+   * verdict for a destination that is same-origin with the workspace's verified origin.
+   *
+   * @returns An explicit refusal when the redirect must not be served. Fails closed when no verified origin
+   * exists — the same posture `toOracleCandidate` already takes for a relative location.
+   * @complexity One `canonicalOrigin` lookup plus O(n) in the candidate length.
+   */
+async function checkReservedDestination({ context, candidate, oracle, reservedSegments }, _optional = {}) {
+    try {
+        const canonical = await oracle.canonicalOrigin(context);
+        const destinationCheck = checkSameOriginDestination({ candidate, canonical, reservedSegments }, {});
+        if (destinationCheck.kind !== "ok")
+            return { kind: "refused", reason: "reserved-destination", destinationCheck };
+        return { kind: "allowed", candidate };
+    }
+    catch {
+        return { kind: "refused", reason: "origin-unavailable" };
+    }
+}
+//# sourceMappingURL=target-gate.js.map

package/dist/redirects/types.d.ts

@@ -0,0 +1,213 @@
+/**
+ * @file Core type definitions for the `redirects` Tier-2 library (ADR-033).
+ *
+ * Purpose:
+ * Declares the row/record shapes, the resolution result, and the command
+ * envelopes the redirects subsystem introduces. Redirect rules are operational
+ * routing state layered over the (future) `routing` library — they are NOT
+ * `entries` (ADR-022): modelling them as content would generate an editorial
+ * revision on every hit-count touch (INV-3 violation) and put high-write
+ * telemetry on the content chokepoint. Redirects therefore own dedicated,
+ * core-owned tables that reuse ADR-022's *discipline* (single write chokepoint,
+ * append-only revisions, ULIDs, bounded validation, CI canary) — the same call
+ * ADR-027 (media sidecars) and ADR-028 (settings ledger) made.
+ *
+ * Architectural role:
+ * INTERFACES AND TYPES ONLY — no feature logic. Concrete matchers, repos, and
+ * the resolver service satisfy these contracts elsewhere.
+ *
+ * Grounding: ADR-033 (this subsystem), ADR-022 (chokepoint/revision discipline,
+ * pluginId attribution, bounded expression language), ADR-021 (flat permission
+ * strings, composite workspace scoping), ADR-007 (workspaceId everywhere),
+ * ADR-009 (typed calls / outbox events / hooks), ADR-015 (repo behind a port).
+ */
+import type { ISODateTime, UUID } from "@jini-ai/core/primitives";
+/**
+ * HTTP status a matched rule emits. 301/308 are permanent (cacheable, SEO
+ * link-equity transfer); 302/307 are temporary. 307/308 preserve the request
+ * method + body (the RFC 7538 successors to 301/302), which matters for
+ * non-GET routes; the admin default is 301.
+ */
+export type RedirectStatusCode = 301 | 302 | 307 | 308;
+/**
+ * How a rule's `fromPattern` is matched against an incoming path.
+ * - `exact`    — full-path equality; index-backed O(1) lookup.
+ * - `prefix`   — longest-prefix match; index/trie-backed, with optional tail
+ *                pass-through to the target (`/old` → `/new` maps `/old/x` → `/new/x`).
+ * - `wildcard` — glob with `*` capture segments; interpolated into the target
+ *                via `$1..$n`. Part of the bounded "dynamic" seam.
+ * - `regex`    — anchored, bounded (linear-time / RE2-semantics) regular
+ *                expression with `$1..$n` capture interpolation. Authoring is
+ *                gated behind `redirects.use_regex` (ADR-021) and OFF by default:
+ *                arbitrary regex is exactly the unbounded-expression trust hazard
+ *                ADR-022's amendment forbids, so it stays a named, gated seam.
+ */
+export declare const REDIRECT_MATCH_TYPES: readonly ["exact", "prefix", "wildcard", "regex"];
+export type RedirectMatchType = (typeof REDIRECT_MATCH_TYPES)[number];
+/**
+ * Provenance of a rule. `auto_slug_change` rows are minted by core inside the
+ * content write transaction (never-break-links, ADR-033 §5) and carry the entry
+ * lineage below; `manual` and `import` come from operators/AI/migration.
+ */
+export declare const REDIRECT_SOURCES: readonly ["manual", "auto_slug_change", "import"];
+export type RedirectSource = (typeof REDIRECT_SOURCES)[number];
+/** Lifecycle of a rule. Disabled rules are retained (audit) but never matched. */
+export declare const REDIRECT_STATUSES: readonly ["active", "disabled"];
+export type RedirectStatus = (typeof REDIRECT_STATUSES)[number];
+/**
+ * A single redirect rule — a row in the core-owned `redirects` table.
+ * Written only through the redirects chokepoint, which records a
+ * {@link RedirectRevision} in the same transaction (ADR-022 §4a).
+ */
+export interface RedirectRecord {
+    /** ULID — stable identity (ADR-022 §4c). */
+    id: UUID;
+    /** Tenant boundary; part of every composite FK (ADR-007/021). */
+    workspaceId: UUID;
+    matchType: RedirectMatchType;
+    /** Normalized source pattern (leading slash, no trailing slash, lower-cased host-relative path). */
+    fromPattern: string;
+    /**
+     * Resolved destination — a normalized site-relative path, or an absolute URL.
+     * Absolute/off-site targets are an open-redirect vector: they require
+     * `redirects.manage` + host allowlist (ADR-033 §7), enforced at write time.
+     */
+    toTarget: string;
+    statusCode: RedirectStatusCode;
+    status: RedirectStatus;
+    /**
+     * When true the rule is consulted BEFORE live content resolution (retire a
+     * live URL). Default false: rules only fill the 404 path so reusing an old
+     * slug for new content transparently reclaims it. Setting `override` needs
+     * `redirects.manage`.
+     */
+    override: boolean;
+    /** Explicit tie-breaker within an equal-specificity band (higher wins). */
+    priority: number;
+    source: RedirectSource;
+    /** Provenance for `auto_slug_change` rows — the entry whose slug moved. */
+    sourceEntryId?: UUID | undefined;
+    /** Old/new path captured at the slug change (auto rows only). */
+    fromPathAtCapture?: string | undefined;
+    toPathAtCapture?: string | undefined;
+    /** Principal that caused the write (ADR-021). For auto rows, the slug-change actor. */
+    createdByPrincipal: UUID;
+    /** Originating plugin, or undefined for core/operator writes (ADR-022 attribution). */
+    createdByPluginId?: string | undefined;
+    createdAt: ISODateTime;
+    updatedAt: ISODateTime;
+    /** Monotonic per-record revision counter (ADR-022 §4c). */
+    version: number;
+}
+/**
+ * Append-only revision of a rule (ADR-022 §4b): full post-state snapshot +
+ * actor + attribution + monotonic sequence, written in the same transaction as
+ * the mutation. Deletes tombstone; the ledger is never rewritten.
+ */
+export interface RedirectRevision {
+    redirectId: UUID;
+    workspaceId: UUID;
+    /** Monotonic sequence per redirect. */
+    seq: number;
+    /** Complete state after the mutation (or the tombstone marker). */
+    state: RedirectRecord;
+    tombstoned: boolean;
+    actorId: UUID;
+    pluginId?: string | undefined;
+    recordedAt: ISODateTime;
+}
+/**
+ * Operational hit telemetry — a row in the core-owned `redirect_hits` sidecar.
+ * DELIBERATELY excluded from the revision discipline above (narrows ADR-022
+ * INV-3, exactly as ADR-027 does for `asset_renditions`): counters are
+ * high-write, best-effort, and non-critical to the never-break-links guarantee.
+ * Updated asynchronously off the request hot path (ADR-009 outbox lane), so a
+ * dropped increment loses a statistic, never a redirect.
+ */
+export interface RedirectHitStats {
+    redirectId: UUID;
+    workspaceId: UUID;
+    hitCount: number;
+    lastHitAt?: ISODateTime | undefined;
+}
+/**
+ * Where in the request pipeline a resolution attempt runs.
+ * - `pre_content`  — only `override` rules are eligible (retire a live URL).
+ * - `post_content` — the default 404-fill pass (all active rules).
+ */
+export type RedirectResolvePhase = "pre_content" | "post_content";
+/** Normalized inbound request handed to the resolver by the routing chain. */
+export interface RedirectRequest {
+    workspaceId: UUID;
+    /** Normalized, query-stripped request path (e.g. `/old/page`). */
+    path: string;
+    phase: RedirectResolvePhase;
+}
+/**
+ * Outcome of a resolution attempt. `location` already has wildcard/regex
+ * captures interpolated and (for prefix rules) any tail appended. Resolution
+ * follows AT MOST ONE hop — chains are collapsed at write time (ADR-033 §6), so
+ * the request path never chases A→B→C.
+ */
+export type RedirectResolution = {
+    matched: false;
+} | {
+    matched: true;
+    redirectId: UUID;
+    location: string;
+    statusCode: RedirectStatusCode;
+    matchType: RedirectMatchType;
+};
+/** Create-rule command envelope (mirrors the features/* Required/Deps/Input idiom). */
+export interface CreateRedirectInput {
+    workspaceId: UUID;
+    matchType: RedirectMatchType;
+    fromPattern: string;
+    toTarget: string;
+    statusCode: RedirectStatusCode;
+    override?: boolean | undefined;
+    priority?: number | undefined;
+    actorId: UUID;
+    pluginId?: string | undefined;
+}
+/** Update-rule command envelope. */
+export interface UpdateRedirectInput {
+    workspaceId: UUID;
+    id: UUID;
+    matchType?: RedirectMatchType | undefined;
+    fromPattern?: string | undefined;
+    toTarget?: string | undefined;
+    statusCode?: RedirectStatusCode | undefined;
+    status?: RedirectStatus | undefined;
+    override?: boolean | undefined;
+    priority?: number | undefined;
+    actorId: UUID;
+    pluginId?: string | undefined;
+}
+/** Filter for admin/AI listing. */
+export interface ListRedirectsFilter {
+    workspaceId: UUID;
+    status?: RedirectStatus | undefined;
+    source?: RedirectSource | undefined;
+    matchType?: RedirectMatchType | undefined;
+}
+/** Validation / safety failures raised by the redirects chokepoint. */
+export declare class RedirectNotFoundError extends Error {
+}
+export declare class RedirectValidationError extends Error {
+}
+export declare class RedirectConflictError extends Error {
+}
+/** Raised when a create/update would introduce a cycle that cannot be collapsed. */
+export declare class RedirectLoopError extends Error {
+}
+/**
+ * Raised by the write chokepoint (`redirects.ts`) when an absolute/off-site
+ * `toTarget` fails `OriginRegistryPort.isAllowedRedirectTarget` (REQ-08,
+ * errors.spec.md `REDIRECT_TARGET_NOT_ALLOWED`). The read-path oracle
+ * rejection (`phase-handler.ts`, REQ-09/10) never raises this — it resolves
+ * to `{ matched: false }` instead (never surfaced as an HTTP error).
+ */
+export declare class RedirectTargetNotAllowedError extends Error {
+}
+//# sourceMappingURL=types.d.ts.map