@jini-ai/cms 0.5.2 → 0.5.3

package/dist/redirects/types.js

@@ -0,0 +1,42 @@
+/**
+ * How a rule's `fromPattern` is matched against an incoming path.
+ * - `exact`    — full-path equality; index-backed O(1) lookup.
+ * - `prefix`   — longest-prefix match; index/trie-backed, with optional tail
+ *                pass-through to the target (`/old` → `/new` maps `/old/x` → `/new/x`).
+ * - `wildcard` — glob with `*` capture segments; interpolated into the target
+ *                via `$1..$n`. Part of the bounded "dynamic" seam.
+ * - `regex`    — anchored, bounded (linear-time / RE2-semantics) regular
+ *                expression with `$1..$n` capture interpolation. Authoring is
+ *                gated behind `redirects.use_regex` (ADR-021) and OFF by default:
+ *                arbitrary regex is exactly the unbounded-expression trust hazard
+ *                ADR-022's amendment forbids, so it stays a named, gated seam.
+ */
+export const REDIRECT_MATCH_TYPES = ["exact", "prefix", "wildcard", "regex"];
+/**
+ * Provenance of a rule. `auto_slug_change` rows are minted by core inside the
+ * content write transaction (never-break-links, ADR-033 §5) and carry the entry
+ * lineage below; `manual` and `import` come from operators/AI/migration.
+ */
+export const REDIRECT_SOURCES = ["manual", "auto_slug_change", "import"];
+/** Lifecycle of a rule. Disabled rules are retained (audit) but never matched. */
+export const REDIRECT_STATUSES = ["active", "disabled"];
+/** Validation / safety failures raised by the redirects chokepoint. */
+export class RedirectNotFoundError extends Error {
+}
+export class RedirectValidationError extends Error {
+}
+export class RedirectConflictError extends Error {
+}
+/** Raised when a create/update would introduce a cycle that cannot be collapsed. */
+export class RedirectLoopError extends Error {
+}
+/**
+ * Raised by the write chokepoint (`redirects.ts`) when an absolute/off-site
+ * `toTarget` fails `OriginRegistryPort.isAllowedRedirectTarget` (REQ-08,
+ * errors.spec.md `REDIRECT_TARGET_NOT_ALLOWED`). The read-path oracle
+ * rejection (`phase-handler.ts`, REQ-09/10) never raises this — it resolves
+ * to `{ matched: false }` instead (never surfaced as an HTTP error).
+ */
+export class RedirectTargetNotAllowedError extends Error {
+}
+//# sourceMappingURL=types.js.map

package/dist/seo/absolute-url.d.ts

@@ -0,0 +1,58 @@
+import type { OriginRegistryPort, VerifiedOrigin } from "@jini-ai/http-kit/verified-origin";
+/**
+ * Joins `path` onto `origin`'s base URL, producing an absolute URL.
+ *
+ * - `path` already absolute (an author's cross-domain canonical override, EC-10, or an
+ *   already-resolved `ogImage`/`twitterImage` ref) is returned UNCHANGED — never double-prefixed.
+ * - `origin` absent (no verified origin registered for the workspace yet — the deliberate,
+ *   disclosed degradation) returns `path` unchanged, matching today's relative-path behavior. Never
+ *   fabricates a broken `undefined/path` URL.
+ * - Never doubles the slash on the root path: `postPublicPath`'s own contract guarantees `path`
+ *   always starts with exactly one `/` (the root case is the literal string `"/"`, never `""`), and
+ *   {@link originBaseUrl} never ends in one, so plain concatenation cannot produce `//`.
+ *
+ * @complexity O(1).
+ */
+export declare function toAbsoluteUrl(required: {
+    origin: VerifiedOrigin | undefined;
+    path: string;
+}, _optional?: Record<string, never>): string;
+/**
+ * Resolves the workspace's verified origin for {@link toAbsoluteUrl}, degrading to `undefined`
+ * when none is registered yet (`OriginNotVerifiedError` — ADR-040's documented fail-closed
+ * precondition on `canonicalOrigin`, not a bug). Any OTHER error is a real registry failure and is
+ * rethrown rather than silently swallowed into the same degraded path.
+ *
+ * 2026-09-18 production sitemap fix: a `dev-capability`-sourced origin (always `http://localhost`,
+ * per `origin/types.ts`'s own invariant) is ALSO degraded to `undefined` whenever this process is
+ * running in production (`resolveRuntimeMode() === "production"`, which `fly.toml` sets). Root
+ * cause this guards against: `server/runtime/composition/deps.ts`'s `seedDevCapabilityOrigin` call
+ * used to be the origin registry's ONLY writer, and ran unconditionally on every boot, including
+ * the Fly deployment's. Its first boot durably persisted `http://localhost:3000` into
+ * `content.db`'s `origin_settings` table, and its own idempotent find-or-create contract (by
+ * design, so a future real registration is never clobbered) means that row survives every later
+ * boot too — it can never self-correct on its own. Every public SEO
+ * document (`sitemap.xml`, `robots.txt`'s `Sitemap:` line, `canonical`, `og:url`, `og:image`) goes
+ * through this one seam, so this is the one place that must refuse to let that row leak into a
+ * document served to real crawlers. Degrading here reuses the SAME pre-existing "no verified
+ * origin" relative-path fallback `toAbsoluteUrl` already had — never a fabricated origin, per
+ * INV-07. Outside production (local dev, tests), a `dev-capability` origin still resolves as
+ * before — its entire purpose is to let a dev server exercise absolute-URL code paths.
+ *
+ * STILL LOAD-BEARING after the 2026-09-18 registration work (`features/origin/configured-origin.ts`,
+ * design note `ADS-memory/reports/2026-09-18-public-origin-registration-design.md`), which stopped
+ * the dev seed from running in production at all. That change prevents NEW poisoned rows; it cannot
+ * remove the one production's `content.db` already holds. Until the host's public URL is set on that
+ * deployment (and `registerConfiguredOrigin` corrects the row on the next boot), this degradation
+ * is the only thing keeping that row out of documents served to real crawlers. Do not delete it as
+ * "now redundant".
+ *
+ * @param required.runtimeMode - Required host runtime mode; the port never chooses a deployment policy.
+ * @complexity O(1) plus one `canonicalOrigin` lookup.
+ */
+export declare function resolveWorkspaceOrigin(required: {
+    originRegistry: OriginRegistryPort;
+    workspaceId: string;
+    runtimeMode: string;
+}, _optional?: Record<string, never>): Promise<VerifiedOrigin | undefined>;
+//# sourceMappingURL=absolute-url.d.ts.map

package/dist/seo/absolute-url.js

@@ -0,0 +1,117 @@
+import { OriginNotVerifiedError } from "@jini-ai/http-kit/verified-origin";
+/**
+ * @file `toAbsoluteUrl`/`resolveWorkspaceOrigin` — the one seam that joins a workspace's verified
+ * origin onto a site-relative path (SPEC-008 gap fix, 2026-09-03).
+ *
+ * Before this file existed, `canonical`, `og:url`, `og:image`, and `twitter:image` all emitted bare
+ * paths (`/documentation`, `/m/{assetId}/...`) on both production and local — reproduced with
+ * `curl` against both. A relative `rel="canonical"` is technically resolvable by a search engine
+ * (it resolves against the page's own URL), but `og:url`/`og:image` MUST be absolute per the Open
+ * Graph protocol: every social crawler and link-preview fetcher fails to resolve a relative one, so
+ * link previews for the live site were silently broken.
+ *
+ * Root cause: `platform/routing/routing.ts`'s `composeCanonicalUrl` has carried a `TODO(ADR-040)`
+ * since routing was built — "compose canonicalUrl from OriginRegistryPort.canonicalOrigin(ctx) once
+ * src/origin exists" — but nothing ever wired it up once `src/origin` (now `features/origin`)
+ * landed; `RouteResolveContext.originOverride` (the seam that TODO describes) is never populated by
+ * any real caller. This file is that wiring, scoped to SEO's own two call sites
+ * (`seo.ts`'s `resolveCanonical`/`resolveShareImages`, and `routes/site/pages.ts`'s
+ * `buildExtraHead` for the entry-less home/page canonical) rather than a change to the shared
+ * `routing` library itself — `urlFor`/`entryPublicPath`/`RouteResolverDeps` have call sites well
+ * outside SEO's ownership (menus, redirects, post tool-registrations), so widening their signature
+ * to do an async origin lookup on every call is a separate, larger change than this bug fix.
+ *
+ * ONE join point, not scattered string concatenation: every caller in this feature that needs an
+ * absolute URL goes through {@link toAbsoluteUrl}.
+ */
+/** Renders a `VerifiedOrigin` as a base URL with no trailing slash (`https://example.com`,
+ *  `https://example.com/site`, `http://localhost:3000`).
+ *
+ *  Local copy, not a shared import — `features/site-evidence/same-origin.ts`'s own
+ *  `verifiedOriginToBaseUrl` (the same three-line join) documents why: `newsletter/unsubscribe.ts`,
+ *  `newsletter/confirmation.ts`, `redirects/phase-handler.ts`, and `members/write-service.ts` each
+ *  already keep a private copy rather than import one, because `features/origin` deliberately
+ *  exports no shared formatter — promoting one is a cross-cutting change owned by that module, not
+ *  by any one feature. This is the same established convention, not a new one. */
+function originBaseUrl(origin) {
+    const authority = origin.port === undefined ? origin.host : `${origin.host}:${origin.port}`;
+    return `${origin.scheme}://${authority}${origin.basePath ?? ""}`;
+}
+const ABSOLUTE_URL_PATTERN = /^[a-z][a-z0-9+.-]*:\/\//i;
+/** Whether `value` already names a full URL (a scheme is present) rather than a site-relative path
+ *  — mirrors `platform/routing/routing.ts`'s and `features/seo/media.ts`'s own local copies of the
+ *  identical check (both pre-existing, both unexported, so this is a third local copy by the same
+ *  convention {@link originBaseUrl} follows above, not a new pattern). */
+function isAbsoluteUrl(value) {
+    return ABSOLUTE_URL_PATTERN.test(value) || value.startsWith("//");
+}
+/**
+ * Joins `path` onto `origin`'s base URL, producing an absolute URL.
+ *
+ * - `path` already absolute (an author's cross-domain canonical override, EC-10, or an
+ *   already-resolved `ogImage`/`twitterImage` ref) is returned UNCHANGED — never double-prefixed.
+ * - `origin` absent (no verified origin registered for the workspace yet — the deliberate,
+ *   disclosed degradation) returns `path` unchanged, matching today's relative-path behavior. Never
+ *   fabricates a broken `undefined/path` URL.
+ * - Never doubles the slash on the root path: `postPublicPath`'s own contract guarantees `path`
+ *   always starts with exactly one `/` (the root case is the literal string `"/"`, never `""`), and
+ *   {@link originBaseUrl} never ends in one, so plain concatenation cannot produce `//`.
+ *
+ * @complexity O(1).
+ */
+export function toAbsoluteUrl(required, _optional = {}) {
+    const { origin, path } = required;
+    if (isAbsoluteUrl(path))
+        return path;
+    if (!origin)
+        return path;
+    return `${originBaseUrl(origin)}${path}`;
+}
+/**
+ * Resolves the workspace's verified origin for {@link toAbsoluteUrl}, degrading to `undefined`
+ * when none is registered yet (`OriginNotVerifiedError` — ADR-040's documented fail-closed
+ * precondition on `canonicalOrigin`, not a bug). Any OTHER error is a real registry failure and is
+ * rethrown rather than silently swallowed into the same degraded path.
+ *
+ * 2026-09-18 production sitemap fix: a `dev-capability`-sourced origin (always `http://localhost`,
+ * per `origin/types.ts`'s own invariant) is ALSO degraded to `undefined` whenever this process is
+ * running in production (`resolveRuntimeMode() === "production"`, which `fly.toml` sets). Root
+ * cause this guards against: `server/runtime/composition/deps.ts`'s `seedDevCapabilityOrigin` call
+ * used to be the origin registry's ONLY writer, and ran unconditionally on every boot, including
+ * the Fly deployment's. Its first boot durably persisted `http://localhost:3000` into
+ * `content.db`'s `origin_settings` table, and its own idempotent find-or-create contract (by
+ * design, so a future real registration is never clobbered) means that row survives every later
+ * boot too — it can never self-correct on its own. Every public SEO
+ * document (`sitemap.xml`, `robots.txt`'s `Sitemap:` line, `canonical`, `og:url`, `og:image`) goes
+ * through this one seam, so this is the one place that must refuse to let that row leak into a
+ * document served to real crawlers. Degrading here reuses the SAME pre-existing "no verified
+ * origin" relative-path fallback `toAbsoluteUrl` already had — never a fabricated origin, per
+ * INV-07. Outside production (local dev, tests), a `dev-capability` origin still resolves as
+ * before — its entire purpose is to let a dev server exercise absolute-URL code paths.
+ *
+ * STILL LOAD-BEARING after the 2026-09-18 registration work (`features/origin/configured-origin.ts`,
+ * design note `ADS-memory/reports/2026-09-18-public-origin-registration-design.md`), which stopped
+ * the dev seed from running in production at all. That change prevents NEW poisoned rows; it cannot
+ * remove the one production's `content.db` already holds. Until the host's public URL is set on that
+ * deployment (and `registerConfiguredOrigin` corrects the row on the next boot), this degradation
+ * is the only thing keeping that row out of documents served to real crawlers. Do not delete it as
+ * "now redundant".
+ *
+ * @param required.runtimeMode - Required host runtime mode; the port never chooses a deployment policy.
+ * @complexity O(1) plus one `canonicalOrigin` lookup.
+ */
+export async function resolveWorkspaceOrigin(required, _optional = {}) {
+    const { originRegistry, workspaceId, runtimeMode } = required;
+    try {
+        const origin = await originRegistry.canonicalOrigin({ workspaceId });
+        if (origin.source === "dev-capability" && runtimeMode === "production")
+            return undefined;
+        return origin;
+    }
+    catch (err) {
+        if (err instanceof OriginNotVerifiedError)
+            return undefined;
+        throw err;
+    }
+}
+//# sourceMappingURL=absolute-url.js.map

package/dist/seo/dom/index.d.ts

@@ -0,0 +1,14 @@
+import type { HeadElement } from "../types.js";
+/**
+ * Applies the finalized head descriptors using the browser's text/attribute sinks. The caller
+ * owns registration, deduplication and replacement of previous contributions. JSON-LD retains the
+ * server serializer's `<` escape so an embedded closing script tag cannot become markup when the
+ * document is serialized. Returns the inserted nodes so the caller can remove its contribution.
+ * @complexity O(total descriptor text length), one element per descriptor.
+ */
+export declare function applyHeadElements(required: {
+    elements: readonly HeadElement[];
+}, optional: {
+    document: Document;
+}): HTMLElement[];
+//# sourceMappingURL=index.d.ts.map

package/dist/seo/dom/index.js

@@ -0,0 +1,52 @@
+/**
+ * Applies the finalized head descriptors using the browser's text/attribute sinks. The caller
+ * owns registration, deduplication and replacement of previous contributions. JSON-LD retains the
+ * server serializer's `<` escape so an embedded closing script tag cannot become markup when the
+ * document is serialized. Returns the inserted nodes so the caller can remove its contribution.
+ * @complexity O(total descriptor text length), one element per descriptor.
+ */
+export function applyHeadElements(required, optional) {
+    const { document } = optional;
+    const nodes = required.elements.map((element) => {
+        switch (element.kind) {
+            case "title": {
+                const node = document.createElement("title");
+                node.textContent = element.text;
+                return node;
+            }
+            case "meta": {
+                const node = document.createElement("meta");
+                node.setAttribute("name", element.name);
+                node.setAttribute("content", element.content);
+                return node;
+            }
+            case "og": {
+                const node = document.createElement("meta");
+                node.setAttribute("property", element.property);
+                node.setAttribute("content", element.content);
+                return node;
+            }
+            case "link": {
+                const node = document.createElement("link");
+                node.setAttribute("rel", element.rel);
+                node.setAttribute("href", element.href);
+                if (element.hreflang)
+                    node.setAttribute("hreflang", element.hreflang);
+                if (element.type)
+                    node.setAttribute("type", element.type);
+                if (element.title)
+                    node.setAttribute("title", element.title);
+                return node;
+            }
+            case "jsonld": {
+                const node = document.createElement("script");
+                node.setAttribute("type", "application/ld+json");
+                node.textContent = JSON.stringify(element.data).replace(/</g, "\\u003c");
+                return node;
+            }
+        }
+    });
+    document.head.append(...nodes);
+    return nodes;
+}
+//# sourceMappingURL=index.js.map

package/dist/seo/errors.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @file Typed domain errors for `seo` (SPEC-008 errors.spec.md §2).
+ *
+ * Purpose:
+ * One class per error this module originates, mirroring
+ * `features/settings/errors.ts`'s one-class-per-code convention. Route
+ * handlers (`src/server/routes/admin/seo/*.ts`) map these 1:1 to the HTTP
+ * codes in api.spec.md §6. `FORBIDDEN` reuses `core/commands`'s shared
+ * `ForbiddenError` (same authorize-then-throw shape `write-service.ts`'s
+ * settings counterpart and every command-gateway route already use) rather
+ * than a second, SEO-local class — `UNAUTHENTICATED` is a route/session-
+ * middleware concern (`getAuthedPrincipal`), never thrown by this module.
+ */
+export declare class SeoFieldValidationError extends Error {
+}
+export declare class SeoInvalidCanonicalUrlError extends Error {
+}
+export declare class SeoEntryNotFoundError extends Error {
+}
+export declare class SeoSettingsValidationError extends Error {
+}
+/**
+ * A concurrent write kept an SEO override from landing (2026-09-07, fable bugs audit SEO-01).
+ *
+ * `setEntrySeoOverrides` writes the whole `posts` row, so it now writes it under a version
+ * predicate and re-reads/re-merges when another writer wins the row. This error is what remains
+ * after that bounded retry is exhausted — a row being rewritten faster than this chokepoint can
+ * merge onto it. Deliberately its own class rather than reusing `features/post`'s
+ * `PostVersionConflictError`: no SEO caller states a version basis, so there is no basis to report
+ * back and nothing for the client to reconcile — the honest answer is "retry", not "your version
+ * was N and theirs is M".
+ */
+export declare class SeoConcurrentWriteError extends Error {
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/seo/errors.js

@@ -0,0 +1,35 @@
+/**
+ * @file Typed domain errors for `seo` (SPEC-008 errors.spec.md §2).
+ *
+ * Purpose:
+ * One class per error this module originates, mirroring
+ * `features/settings/errors.ts`'s one-class-per-code convention. Route
+ * handlers (`src/server/routes/admin/seo/*.ts`) map these 1:1 to the HTTP
+ * codes in api.spec.md §6. `FORBIDDEN` reuses `core/commands`'s shared
+ * `ForbiddenError` (same authorize-then-throw shape `write-service.ts`'s
+ * settings counterpart and every command-gateway route already use) rather
+ * than a second, SEO-local class — `UNAUTHENTICATED` is a route/session-
+ * middleware concern (`getAuthedPrincipal`), never thrown by this module.
+ */
+export class SeoFieldValidationError extends Error {
+}
+export class SeoInvalidCanonicalUrlError extends Error {
+}
+export class SeoEntryNotFoundError extends Error {
+}
+export class SeoSettingsValidationError extends Error {
+}
+/**
+ * A concurrent write kept an SEO override from landing (2026-09-07, fable bugs audit SEO-01).
+ *
+ * `setEntrySeoOverrides` writes the whole `posts` row, so it now writes it under a version
+ * predicate and re-reads/re-merges when another writer wins the row. This error is what remains
+ * after that bounded retry is exhausted — a row being rewritten faster than this chokepoint can
+ * merge onto it. Deliberately its own class rather than reusing `features/post`'s
+ * `PostVersionConflictError`: no SEO caller states a version basis, so there is no basis to report
+ * back and nothing for the client to reconcile — the honest answer is "retry", not "your version
+ * was N and theirs is M".
+ */
+export class SeoConcurrentWriteError extends Error {
+}
+//# sourceMappingURL=errors.js.map

package/dist/seo/feed.d.ts

@@ -0,0 +1,49 @@
+import type { UUID } from "@jini-ai/core/primitives";
+import { type SeoSitemapDeps } from "./sitemap.js";
+/**
+ * @file The site's RSS 2.0 feed (`GET /feed.xml`), built like `sitemap.xml`: from
+ * {@link computeIndexableEntries}, the one publish/visibility/`noindex` filter every public SEO
+ * document shares, so a draft, trashed or members-only post can never leak here either. Only blog
+ * posts (`kind: "post"`) are items; pages are not news.
+ *
+ * Links are absolute: feed readers resolve nothing against the site. They come from
+ * `meta.canonical`, which is absolute once the workspace has a verified origin and degrades to a
+ * root-relative path without one (the same disclosed fallback the sitemap has). A static export
+ * writes this file without its base-path rewrite (`site-exporter.ts`).
+ *
+ * Hand-written rather than the `feed` package: one format, about sixty lines, no dependency.
+ */
+/** How many of the newest posts the feed carries. */
+export declare const FEED_ITEM_LIMIT = 20;
+export declare const FEED_PATH = "/feed.xml";
+export interface FeedItem {
+    readonly title: string;
+    readonly link: string;
+    /** ISO timestamp. The post's go-live time (`publishAt`) when it has one, else `updatedAt` — posts
+     *  carry no separate published-at column (`postDisplayDateIso`, owner decision 2026-10-05). */
+    readonly publishedAt: string;
+    readonly description: string | undefined;
+}
+export interface Feed {
+    readonly siteTitle: string;
+    readonly siteLink: string;
+    readonly feedUrl: string;
+    readonly items: readonly FeedItem[];
+}
+/**
+ * The newest {@link FEED_ITEM_LIMIT} published, publicly visible, indexable posts, newest first.
+ * @complexity O(n log n) in the workspace's post count (the sort), after
+ *   {@link computeIndexableEntries}' own O(n) pass.
+ */
+export declare function buildFeed(required: {
+    deps: SeoSitemapDeps;
+    input: {
+        workspaceId: UUID;
+        siteTitle: string;
+    };
+}, _optional?: Record<string, never>): Promise<Feed>;
+/** Serializes a {@link Feed} as RSS 2.0 XML. @complexity O(total text length). */
+export declare function renderRssXml(required: {
+    feed: Feed;
+}, _optional?: Record<string, never>): string;
+//# sourceMappingURL=feed.d.ts.map

package/dist/seo/feed.js

@@ -0,0 +1,61 @@
+import { escapeXml } from "./xml-escape.js";
+import { resolveWorkspaceOrigin, toAbsoluteUrl } from "./absolute-url.js";
+import { deriveExcerpt } from "./seo.js";
+import { computeIndexableEntries } from "./sitemap.js";
+/**
+ * @file The site's RSS 2.0 feed (`GET /feed.xml`), built like `sitemap.xml`: from
+ * {@link computeIndexableEntries}, the one publish/visibility/`noindex` filter every public SEO
+ * document shares, so a draft, trashed or members-only post can never leak here either. Only blog
+ * posts (`kind: "post"`) are items; pages are not news.
+ *
+ * Links are absolute: feed readers resolve nothing against the site. They come from
+ * `meta.canonical`, which is absolute once the workspace has a verified origin and degrades to a
+ * root-relative path without one (the same disclosed fallback the sitemap has). A static export
+ * writes this file without its base-path rewrite (`site-exporter.ts`).
+ *
+ * Hand-written rather than the `feed` package: one format, about sixty lines, no dependency.
+ */
+/** How many of the newest posts the feed carries. */
+export const FEED_ITEM_LIMIT = 20;
+export const FEED_PATH = "/feed.xml";
+/**
+ * The newest {@link FEED_ITEM_LIMIT} published, publicly visible, indexable posts, newest first.
+ * @complexity O(n log n) in the workspace's post count (the sort), after
+ *   {@link computeIndexableEntries}' own O(n) pass.
+ */
+export async function buildFeed(required, _optional = {}) {
+    const { deps, input } = required;
+    const entries = await computeIndexableEntries({ deps, input: { workspaceId: input.workspaceId } });
+    const items = entries
+        .filter(({ post }) => post.kind === "post")
+        .sort((a, b) => (a.post.updatedAt < b.post.updatedAt ? 1 : a.post.updatedAt > b.post.updatedAt ? -1 : 0))
+        .slice(0, FEED_ITEM_LIMIT)
+        .map(({ post, meta }) => ({ title: post.title, link: meta.canonical, publishedAt: deps.liveness.postDisplayDateIso({ post }), description: deriveExcerpt({ post, postRepo: deps.postRepo }) }));
+    const origin = await resolveWorkspaceOrigin({ originRegistry: deps.originRegistry, workspaceId: input.workspaceId, runtimeMode: deps.runtimeMode });
+    return { siteTitle: input.siteTitle, siteLink: toAbsoluteUrl({ origin, path: "/" }), feedUrl: toAbsoluteUrl({ origin, path: FEED_PATH }), items };
+}
+function renderItem(item) {
+    const description = item.description === undefined ? "" : `      <description>${escapeXml({ text: item.description })}</description>\n`;
+    return (`    <item>\n` +
+        `      <title>${escapeXml({ text: item.title })}</title>\n` +
+        `      <link>${escapeXml({ text: item.link })}</link>\n` +
+        `      <guid isPermaLink="true">${escapeXml({ text: item.link })}</guid>\n` +
+        `      <pubDate>${new Date(item.publishedAt).toUTCString()}</pubDate>\n` +
+        description +
+        `    </item>\n`);
+}
+/** Serializes a {@link Feed} as RSS 2.0 XML. @complexity O(total text length). */
+export function renderRssXml(required, _optional = {}) {
+    const { feed } = required;
+    return (`<?xml version="1.0" encoding="UTF-8"?>\n` +
+        `<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">\n` +
+        `  <channel>\n` +
+        `    <title>${escapeXml({ text: feed.siteTitle })}</title>\n` +
+        `    <link>${escapeXml({ text: feed.siteLink })}</link>\n` +
+        `    <description>${escapeXml({ text: feed.siteTitle })}</description>\n` +
+        `    <atom:link href="${escapeXml({ text: feed.feedUrl })}" rel="self" type="application/rss+xml"/>\n` +
+        feed.items.map(renderItem).join("") +
+        `  </channel>\n` +
+        `</rss>\n`);
+}
+//# sourceMappingURL=feed.js.map

package/dist/seo/index.d.ts

@@ -0,0 +1,13 @@
+/** Universal SEO domain: pure producers and services, with host-owned dependencies supplied as ports. */
+export * from "./types.js";
+export * from "./errors.js";
+export * from "./ports.js";
+export * from "./absolute-url.js";
+export * from "./seo.js";
+export * from "./media.js";
+export * from "./sitemap.js";
+export * from "./feed.js";
+export * from "./page-head.js";
+export * from "./write-service.js";
+export * from "./xml-escape.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/seo/index.js

@@ -0,0 +1,13 @@
+/** Universal SEO domain: pure producers and services, with host-owned dependencies supplied as ports. */
+export * from "./types.js";
+export * from "./errors.js";
+export * from "./ports.js";
+export * from "./absolute-url.js";
+export * from "./seo.js";
+export * from "./media.js";
+export * from "./sitemap.js";
+export * from "./feed.js";
+export * from "./page-head.js";
+export * from "./write-service.js";
+export * from "./xml-escape.js";
+//# sourceMappingURL=index.js.map

package/dist/seo/media.d.ts

@@ -0,0 +1,57 @@
+import type { UUID } from "@jini-ai/core/primitives";
+import type { SeoMediaPort, SeoFeaturedImagePort } from "./ports.js";
+export type ResolveSeoImageRefDeps = SeoMediaPort;
+export interface ResolveSeoImageRefInput {
+    workspaceId: UUID;
+    /** Either `"{idOrSlug}:{transformName}"` (the asset's id, or — since readable-slugs S4/S5b — its
+     *  slug) or an already-absolute URL. */
+    ref: string;
+}
+/**
+ * Resolves an `ogImage`/`twitterImage` field to a URL, or `undefined` on any
+ * miss. Returns `ref` unchanged when it is already an absolute URL; otherwise
+ * returns the site-relative `/m/{key}/...` URL contract (ADR-027 §4), keyed by the asset's current
+ * slug when it has a valid one (readable-slugs S4), otherwise its id —
+ * NOT necessarily absolute (this function has no origin to join, by design;
+ * `seo.ts`'s `resolveShareImages` is the one caller and absolutizes the
+ * result via `toAbsoluteUrl`, since `og:image`/`twitter:image` must be
+ * absolute for crawlers, same as `og:url`).
+ *
+ * Does not check whether a rendition row already exists (AMENDED 2026-09-05
+ * — see this file's header doc for the safety argument): the emitted URL
+ * always targets the latest registered transform version, which the public
+ * `/m/` route always lazily generates on first anonymous fetch.
+ *
+ * @complexity O(1) — bounded repo lookups (one asset read, one transform-
+ * version listing).
+ */
+export declare function resolveSeoImageRef(required: {
+    deps: ResolveSeoImageRefDeps;
+    input: ResolveSeoImageRefInput;
+}, _optional?: Record<string, never>): Promise<string | undefined>;
+/**
+ * The write-path refusal for an `ogImage`/`twitterImage`/`defaultOgImage` value (2026-10-05): the
+ * message to refuse it with, or `null` to accept it. Both SEO write chokepoints call it
+ * (`setEntrySeoOverrides` in `write-service.ts`, `setSeoSettings` in `settings.ts`), so the chat
+ * tools and the admin REST routes share it.
+ *
+ * The check itself is the post featured image's ({@link resolveFeaturedImageRef}), run on the
+ * ref's `{idOrSlug}` half — one content-type rule for every "this must be an image" media field.
+ * Only a KNOWN non-image is refused. A missing or trashed asset is accepted, as before: the head
+ * render already drops such a ref fail-soft (EC-07, {@link resolveSeoImageRef}), and refusing it
+ * here would be a new rule this fix was not asked for. An absolute URL, a non-ref string and
+ * `null`/`undefined` (clear/omitted) are accepted untouched.
+ *
+ * @complexity O(1) — at most two repo reads and one content-type read.
+ */
+export declare function seoImageRefRefusal(required: {
+    deps: {
+        featuredImage: SeoFeaturedImagePort;
+    };
+    input: {
+        workspaceId: string;
+        field: string;
+        ref: unknown;
+    };
+}, _optional?: Record<string, never>): Promise<string | null>;
+//# sourceMappingURL=media.d.ts.map