@jini-ai/cms 0.5.2 → 0.5.4

package/dist/redirects/repo.memory.d.ts

@@ -0,0 +1,51 @@
+import type { RedirectDbHandle } from "./ports.internal.js";
+import type { RedirectRepoPort } from "./ports.js";
+import type { ListRedirectsFilter, RedirectRecord, RedirectRevision } from "./types.js";
+export declare class InMemoryRedirectRepo implements RedirectRepoPort, RedirectDbHandle {
+    private readonly records;
+    private readonly revisionsByRedirectId;
+    constructor({ seed }?: {
+        seed?: RedirectRecord[];
+    }, _optional?: Record<string, never>);
+    private all;
+    findById(required: {
+        workspaceId: string;
+        id: string;
+    }, _optional?: Record<string, never>): Promise<RedirectRecord | null>;
+    lookupExact(required: {
+        workspaceId: string;
+        path: string;
+        includeOverrideOnly: boolean;
+    }, _optional?: Record<string, never>): Promise<RedirectRecord | null>;
+    lookupLongestPrefix(required: {
+        workspaceId: string;
+        path: string;
+        includeOverrideOnly: boolean;
+    }, _optional?: Record<string, never>): Promise<RedirectRecord | null>;
+    listDynamic(required: {
+        workspaceId: string;
+        includeOverrideOnly: boolean;
+        limit: number;
+    }, _optional?: Record<string, never>): Promise<RedirectRecord[]>;
+    list(filter: ListRedirectsFilter, _optional?: Record<string, never>): Promise<RedirectRecord[]>;
+    findByFromPattern(required: {
+        workspaceId: string;
+        fromPattern: string;
+    }, _optional?: Record<string, never>): Promise<RedirectRecord | null>;
+    save(required: {
+        record: RedirectRecord;
+        revision: RedirectRevision;
+    }, _optional?: Record<string, never>): Promise<void>;
+    tombstone(required: {
+        workspaceId: string;
+        id: string;
+        revision: RedirectRevision;
+    }, _optional?: Record<string, never>): Promise<void>;
+    insertRedirect(record: RedirectRecord, _optional?: Record<string, never>): void;
+    insertRevision(revision: RedirectRevision, _optional?: Record<string, never>): void;
+    /** Test-only helper: the append-only revision ledger for one redirect, in seq order. */
+    listRevisionsForTests({ redirectId }: {
+        redirectId: string;
+    }, _optional?: Record<string, never>): RedirectRevision[];
+}
+//# sourceMappingURL=repo.memory.d.ts.map

package/dist/redirects/repo.memory.js

@@ -0,0 +1,98 @@
+/**
+ * @file In-memory `RedirectRepoPort` adapter (rule-of-two adapter #1,
+ * ADR-006). Test/dev double — no persistence beyond process lifetime.
+ *
+ * Also satisfies `RedirectDbHandle` (`ports.internal.ts`) directly — `save()`
+ * is implemented as the same two-step write (`insertRedirect` then
+ * `insertRevision`) that `redirects.ts`/`capture.ts` call independently via
+ * `insertRedirectAndRevision`; both paths converge on identical storage
+ * semantics without this file importing `ports.internal.ts`'s function value
+ * (only its `RedirectDbHandle` type, structurally satisfied here).
+ */
+import { compareLongestFirst, compareSamePatternExactFirst, compareTieBreak } from "./order.js";
+import { RedirectNotFoundError } from "./types.js";
+export class InMemoryRedirectRepo {
+    records = new Map();
+    revisionsByRedirectId = new Map();
+    constructor({ seed = [] } = {}, _optional = {}) {
+        for (const record of seed)
+            this.records.set(record.id, { ...record });
+    }
+    all(workspaceId) {
+        return [...this.records.values()].filter((r) => r.workspaceId === workspaceId);
+    }
+    async findById(required, _optional = {}) {
+        const record = this.records.get(required.id);
+        return record && record.workspaceId === required.workspaceId ? { ...record } : null;
+    }
+    async lookupExact(required, _optional = {}) {
+        const candidates = this.all(required.workspaceId).filter((r) => r.status === "active" &&
+            r.matchType === "exact" &&
+            r.fromPattern === required.path &&
+            (!required.includeOverrideOnly || r.override));
+        candidates.sort((a, b) => compareTieBreak({ a, b }, {}));
+        return candidates[0] ? { ...candidates[0] } : null;
+    }
+    async lookupLongestPrefix(required, _optional = {}) {
+        const candidates = this.all(required.workspaceId).filter((r) => {
+            if (r.status !== "active" || r.matchType !== "prefix")
+                return false;
+            if (required.includeOverrideOnly && !r.override)
+                return false;
+            const pattern = r.fromPattern;
+            if (required.path === pattern)
+                return true;
+            return required.path.startsWith(pattern.endsWith("/") ? pattern : `${pattern}/`);
+        });
+        candidates.sort((a, b) => compareLongestFirst({ a, b }, {}));
+        return candidates[0] ? { ...candidates[0] } : null;
+    }
+    async listDynamic(required, _optional = {}) {
+        const candidates = this.all(required.workspaceId).filter((r) => r.status === "active" && r.matchType === "wildcard" && (!required.includeOverrideOnly || r.override));
+        candidates.sort((a, b) => compareLongestFirst({ a, b }, {}));
+        return candidates.slice(0, required.limit).map((r) => ({ ...r }));
+    }
+    async list(filter, _optional = {}) {
+        return this.all(filter.workspaceId)
+            .filter((r) => filter.status === undefined || r.status === filter.status)
+            .filter((r) => filter.source === undefined || r.source === filter.source)
+            .filter((r) => filter.matchType === undefined || r.matchType === filter.matchType)
+            .map((r) => ({ ...r }));
+    }
+    async findByFromPattern(required, _optional = {}) {
+        const candidates = this.all(required.workspaceId).filter((r) => r.status === "active" && r.fromPattern === required.fromPattern);
+        if (candidates.length === 0)
+            return null;
+        candidates.sort((a, b) => compareSamePatternExactFirst({ a, b }, {}));
+        const winner = candidates[0];
+        return winner ? { ...winner } : null;
+    }
+    async save(required, _optional = {}) {
+        this.insertRedirect(required.record);
+        this.insertRevision(required.revision);
+    }
+    async tombstone(required, _optional = {}) {
+        const existing = this.records.get(required.id);
+        if (!existing || existing.workspaceId !== required.workspaceId) {
+            throw new RedirectNotFoundError(`redirect '${required.id}' was not found`);
+        }
+        this.insertRedirect(required.revision.state);
+        this.insertRevision(required.revision);
+    }
+    // -------------------------------------------------------------------
+    // RedirectDbHandle (used by redirects.ts/capture.ts via ports.internal.ts)
+    // -------------------------------------------------------------------
+    insertRedirect(record, _optional = {}) {
+        this.records.set(record.id, { ...record });
+    }
+    insertRevision(revision, _optional = {}) {
+        const list = this.revisionsByRedirectId.get(revision.redirectId) ?? [];
+        list.push({ ...revision });
+        this.revisionsByRedirectId.set(revision.redirectId, list);
+    }
+    /** Test-only helper: the append-only revision ledger for one redirect, in seq order. */
+    listRevisionsForTests({ redirectId }, _optional = {}) {
+        return [...(this.revisionsByRedirectId.get(redirectId) ?? [])].sort((a, b) => a.seq - b.seq);
+    }
+}
+//# sourceMappingURL=repo.memory.js.map

package/dist/redirects/reserved-destination.d.ts

@@ -0,0 +1,58 @@
+/**
+ * @file The one "same-origin destination lands on the admin surface" verdict, shared by the
+ * redirect READ gate (`phase-handler.ts`) and WRITE gate (`redirects.ts`) (t91 B1, 2026-09-16).
+ *
+ * Purpose:
+ * Before this file existed, `phase-handler.ts` decided "is this candidate on the workspace's own
+ * origin" by comparing `URL.origin` strings, and `redirects.ts` never asked the question for an
+ * absolute target at all — it only ever ran the reserved-path rule for a site-relative target. Both
+ * gaps let an absolute same-origin target land a visitor on `/admin` or `/api/...` while the
+ * oracle that approved the candidate had already normalized past the exact spelling the string
+ * comparison needed (`https://site./admin` and `https://site%2E/admin` both decode to the same
+ * host the oracle allows, but have a DIFFERENT `URL.origin` string from `https://site`). "Same
+ * origin" is decided here by `origin`'s own `normalizeOriginCandidate` + `isSameOrigin` — never a
+ * raw `URL.origin` string equality — because that is what the oracle that approved the candidate
+ * already normalizes against.
+ *
+ * A `{ kind: "ok" }` verdict for a CROSS-origin candidate means "not this rule's business", not
+ * "allowed" — callers must already have run the origin oracle (`isAllowedRedirectTarget`) first;
+ * this function only ever narrows what the oracle already approved.
+ *
+ * Interpolation happens on the READ path (a stored template like `/go/*` -> `/$1` becomes
+ * `Location: /admin` only once a request path fills it in), so the read gate calls this AFTER
+ * interpolation. The write gate can only ever see the template, so it calls this on an absolute
+ * target once the oracle allows it — a stored relative template is out of scope here, same as
+ * before this file existed.
+ *
+ * Architectural role:
+ * Feature logic, pure, no I/O. Imports only through `features/origin` and `platform/routing`'s own
+ * barrels (both are `no-deep-imports` promoted in `.dependency-cruiser.mjs`).
+ */
+import { type VerifiedOrigin } from "@jini-ai/http-kit/verified-origin";
+import { type SitePathCheck } from "@jini-ai/http-kit/verified-origin";
+/** {@link checkSameOriginDestination}'s verdict — every arm but `ok` is a refusal. */
+export type SameOriginDestinationCheck = SitePathCheck | {
+    kind: "unparseable";
+};
+/**
+ * Whether `candidate` is both same-origin with `canonical` AND lands on the admin application's
+ * own URL space. A cross-origin candidate (by construction, out of this rule's business) and an
+ * ordinary same-origin path both answer `{ kind: "ok" }` — the distinction does not matter to a
+ * caller that only wants to know "must this be refused".
+ *
+ * @param required.candidate - The candidate URL string to classify (already oracle-approved by the caller).
+ * @param required.canonical - The workspace's verified canonical origin.
+ * @returns `{ kind: "unparseable" }` if `candidate` fails the oracle's own normalizer (including a
+ * non-empty userinfo component — fail closed rather than guessing which host it means); otherwise
+ * `{ kind: "ok" }` for a cross-origin candidate or ordinary same-origin content, or the
+ * `checkSitePathname` refusal arm naming why a same-origin candidate is reserved.
+ * @param required.reservedSegments - Host-owned, case-folded first path segments.
+ * @complexity O(n) in the candidate length.
+ * @example checkSameOriginDestination({ candidate: "https://site.example/blog", canonical, reservedSegments }, {});
+ */
+export declare function checkSameOriginDestination({ candidate, canonical, reservedSegments }: {
+    candidate: string;
+    canonical: VerifiedOrigin;
+    reservedSegments: ReadonlySet<string>;
+}, _optional?: Record<string, never>): SameOriginDestinationCheck;
+//# sourceMappingURL=reserved-destination.d.ts.map

package/dist/redirects/reserved-destination.js

@@ -0,0 +1,59 @@
+/**
+ * @file The one "same-origin destination lands on the admin surface" verdict, shared by the
+ * redirect READ gate (`phase-handler.ts`) and WRITE gate (`redirects.ts`) (t91 B1, 2026-09-16).
+ *
+ * Purpose:
+ * Before this file existed, `phase-handler.ts` decided "is this candidate on the workspace's own
+ * origin" by comparing `URL.origin` strings, and `redirects.ts` never asked the question for an
+ * absolute target at all — it only ever ran the reserved-path rule for a site-relative target. Both
+ * gaps let an absolute same-origin target land a visitor on `/admin` or `/api/...` while the
+ * oracle that approved the candidate had already normalized past the exact spelling the string
+ * comparison needed (`https://site./admin` and `https://site%2E/admin` both decode to the same
+ * host the oracle allows, but have a DIFFERENT `URL.origin` string from `https://site`). "Same
+ * origin" is decided here by `origin`'s own `normalizeOriginCandidate` + `isSameOrigin` — never a
+ * raw `URL.origin` string equality — because that is what the oracle that approved the candidate
+ * already normalizes against.
+ *
+ * A `{ kind: "ok" }` verdict for a CROSS-origin candidate means "not this rule's business", not
+ * "allowed" — callers must already have run the origin oracle (`isAllowedRedirectTarget`) first;
+ * this function only ever narrows what the oracle already approved.
+ *
+ * Interpolation happens on the READ path (a stored template like `/go/*` -> `/$1` becomes
+ * `Location: /admin` only once a request path fills it in), so the read gate calls this AFTER
+ * interpolation. The write gate can only ever see the template, so it calls this on an absolute
+ * target once the oracle allows it — a stored relative template is out of scope here, same as
+ * before this file existed.
+ *
+ * Architectural role:
+ * Feature logic, pure, no I/O. Imports only through `features/origin` and `platform/routing`'s own
+ * barrels (both are `no-deep-imports` promoted in `.dependency-cruiser.mjs`).
+ */
+import { isSameOrigin, normalizeOriginCandidate } from "@jini-ai/http-kit/verified-origin";
+import { checkSitePathname } from "@jini-ai/http-kit/verified-origin";
+/**
+ * Whether `candidate` is both same-origin with `canonical` AND lands on the admin application's
+ * own URL space. A cross-origin candidate (by construction, out of this rule's business) and an
+ * ordinary same-origin path both answer `{ kind: "ok" }` — the distinction does not matter to a
+ * caller that only wants to know "must this be refused".
+ *
+ * @param required.candidate - The candidate URL string to classify (already oracle-approved by the caller).
+ * @param required.canonical - The workspace's verified canonical origin.
+ * @returns `{ kind: "unparseable" }` if `candidate` fails the oracle's own normalizer (including a
+ * non-empty userinfo component — fail closed rather than guessing which host it means); otherwise
+ * `{ kind: "ok" }` for a cross-origin candidate or ordinary same-origin content, or the
+ * `checkSitePathname` refusal arm naming why a same-origin candidate is reserved.
+ * @param required.reservedSegments - Host-owned, case-folded first path segments.
+ * @complexity O(n) in the candidate length.
+ * @example checkSameOriginDestination({ candidate: "https://site.example/blog", canonical, reservedSegments }, {});
+ */
+export function checkSameOriginDestination({ candidate, canonical, reservedSegments }, _optional = {}) {
+    const target = normalizeOriginCandidate({ rawUrl: candidate });
+    if (target === null)
+        return { kind: "unparseable" };
+    if (!isSameOrigin({ target: target, canonical: canonical }))
+        return { kind: "ok" };
+    // Cannot throw: normalizeOriginCandidate just parsed this exact string with the same no-base
+    // `new URL()`, so re-parsing it here to hand checkSitePathname a real URL cannot fail differently.
+    return checkSitePathname({ url: new URL(candidate), reservedSegments }, {});
+}
+//# sourceMappingURL=reserved-destination.js.map

package/dist/redirects/resolver.d.ts

@@ -0,0 +1,100 @@
+/**
+ * @file `RedirectResolver` (read-path resolution) + `registerRedirectsPhaseHandlers`
+ * (routing-chain adapter) — SPEC-009 REQ-09/10/18/19/20; ADR-PIPE-009 C-006/C-007.
+ *
+ * Purpose:
+ * Owns the read-path open-redirect oracle call (C-013 in the implementation
+ * outline) — the single highest-risk contract in this feature. Gathers
+ * phase-eligible candidate rules from `RedirectRepoPort`'s three lookup
+ * methods (`lookupExact`/`lookupLongestPrefix`/`listDynamic`), hands them to
+ * `RedirectMatcher.match` for precedence/tie-break/interpolation, then
+ * validates the FULLY-INTERPOLATED `location` via
+ * `OriginRegistryPort.isAllowedRedirectTarget` in EVERY code path before ever
+ * returning a `matched: true` outcome (INV-03), and then — for a destination that is same-origin
+ * with the workspace's own verified origin, which the oracle allows by construction — the shared
+ * reserved-path rule from `./reserved-destination.ts`'s `checkSameOriginDestination`. The second
+ * half has to live here rather than only at the write chokepoint because interpolation happens on
+ * THIS path: the stored `toTarget` is a template, and `Location` is what comes out of it.
+ *
+ * Oracle-call discipline (documented, load-bearing): `isAllowedRedirectTarget`
+ * only accepts a fully-qualified, WHATWG-parseable candidate URL (see
+ * `origin/origin.ts`'s `normalizeOriginCandidate` — a bare relative path like
+ * `/new` fails to parse with no base and would otherwise always resolve to
+ * "not allowed"). So a plain relative `location` is first resolved to an
+ * absolute URL against the workspace's own verified canonical origin (making
+ * the oracle call against a genuinely absolute, same-origin-by-construction
+ * candidate) before being handed to the oracle — this satisfies "call the
+ * oracle in every code path" literally while keeping ordinary same-site
+ * redirects (the overwhelmingly common case) working. A `location` that
+ * already looks absolute or protocol-relative (contains a scheme prefix or
+ * starts with `//`) is passed to the oracle exactly as interpolated, since
+ * resolving it against the canonical origin first would corrupt it. If the
+ * workspace has no verified origin registered at all, this fails closed
+ * (`{ matched: false }`) rather than guessing — matches `origin`'s own
+ * fail-closed posture (`OriginNotVerifiedError`).
+ *
+ * Architectural role:
+ * Feature logic (`RedirectPhaseHandlerResolver`, implements `RedirectResolver`)
+ * + a thin composition-root registration function
+ * (`registerRedirectsPhaseHandlers`) that adapts to/from `routing`'s
+ * `RouteResolvePhaseHandler` shape. No Express/route code.
+ */
+import type { Clock as ClockPort, IdGenerator as IdGeneratorPort } from "@jini-ai/core/primitives";
+import type { OutboxPort } from "../core/index.js";
+import { type RedirectTargetOracle } from "./target-gate.js";
+import type { RedirectMatcher, RedirectRepoPort, RedirectResolverWithRefusals, RedirectResolutionReport } from "./ports.js";
+import type { RedirectRequest, RedirectResolution } from "./types.js";
+export interface RedirectPhaseHandlerDeps {
+    repo: RedirectRepoPort;
+    matcher: RedirectMatcher;
+    originRegistry: RedirectTargetOracle;
+    /** First path segments reserved by the composing host; no product-policy default. */
+    reservedSegments: ReadonlySet<string>;
+    /**
+     * Hit-recording deps (W-008) — OPTIONAL so unit tests exercising the
+     * oracle gate alone (T006) don't need to stub them. When present, a
+     * successful resolution enqueues a `redirect.hit` outbox event,
+     * fire-and-forget (never awaited before the outcome is returned, never
+     * allowed to affect the resolution — REQ-21/AC-26).
+     */
+    hits?: {
+        outbox: OutboxPort;
+        clock: ClockPort;
+        idGen: IdGeneratorPort;
+    };
+}
+/**
+ * `RedirectResolver` implementation — the resolution entry point the routing-
+ * chain adapter (`registerRedirectsPhaseHandlers`) calls per phase.
+ */
+export declare class RedirectPhaseHandlerResolver implements RedirectResolverWithRefusals {
+    private readonly deps;
+    constructor(deps: RedirectPhaseHandlerDeps, _optional?: Record<string, never>);
+    /**
+     * @complexity O(1) exact/prefix (index-backed) + O(k) dynamic scan, k =
+     * the capped dynamic-set size (500).
+     */
+    resolve(request: RedirectRequest, _optional?: Record<string, never>): Promise<RedirectResolution>;
+    /**
+     * Same resolution and hit effects, with explicit refusal evidence for SPA/HTTP adapters.
+     * @returns The unchanged legacy resolution plus any rejected finished Location.
+     * @complexity O(1) exact/prefix retrieval plus O(k) capped dynamic candidate scan.
+     */
+    resolveWithRefusals(request: RedirectRequest, _optional?: Record<string, never>): Promise<RedirectResolutionReport>;
+    /**
+     * W-008: enqueue a `redirect.hit` event, fire-and-forget. MUST NOT be
+     * awaited before the redirect response is sent, and MUST NOT let an
+     * enqueue failure affect the resolution outcome (REQ-21/AC-26).
+     */
+    private recordHitFireAndForget;
+}
+/**
+ * Create the read-path resolver with the required origin oracle and host path policy.
+ * @param required Repository, matcher, oracle and reserved path segments.
+ * @param optional Optional best-effort hit recording, independent of resolution.
+ * @returns A resolver that checks the fully interpolated Location before returning a match.
+ * @complexity O(1) construction; resolve inherits the bounded candidate scan.
+ * @example createRedirectResolver({ repo, matcher, originRegistry, reservedSegments }, {});
+ */
+export declare function createRedirectResolver(required: Omit<RedirectPhaseHandlerDeps, "hits">, optional?: Pick<RedirectPhaseHandlerDeps, "hits">): RedirectResolverWithRefusals;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/redirects/resolver.js

@@ -0,0 +1,87 @@
+import { nowIso as clockNowIso } from "@jini-ai/core/primitives";
+import { checkRedirectLocation } from "./target-gate.js";
+/** The bounded dynamic (wildcard) set cap (behavior.spec.md §3/§4, OQ-01). */
+const DYNAMIC_SET_LIMIT = 500;
+/**
+ * `RedirectResolver` implementation — the resolution entry point the routing-
+ * chain adapter (`registerRedirectsPhaseHandlers`) calls per phase.
+ */
+export class RedirectPhaseHandlerResolver {
+    deps;
+    constructor(deps, _optional = {}) {
+        this.deps = deps;
+    }
+    /**
+     * @complexity O(1) exact/prefix (index-backed) + O(k) dynamic scan, k =
+     * the capped dynamic-set size (500).
+     */
+    async resolve(request, _optional = {}) {
+        return (await this.resolveWithRefusals(request, {})).resolution;
+    }
+    /**
+     * Same resolution and hit effects, with explicit refusal evidence for SPA/HTTP adapters.
+     * @returns The unchanged legacy resolution plus any rejected finished Location.
+     * @complexity O(1) exact/prefix retrieval plus O(k) capped dynamic candidate scan.
+     */
+    async resolveWithRefusals(request, _optional = {}) {
+        const includeOverrideOnly = request.phase === "pre_content";
+        const lookupBase = { workspaceId: request.workspaceId, includeOverrideOnly };
+        const [exact, prefix, dynamic] = await Promise.all([
+            this.deps.repo.lookupExact({ ...lookupBase, path: request.path }),
+            this.deps.repo.lookupLongestPrefix({ ...lookupBase, path: request.path }),
+            this.deps.repo.listDynamic({ ...lookupBase, limit: DYNAMIC_SET_LIMIT }),
+        ]);
+        const candidates = [exact, prefix, ...dynamic].filter((r) => r !== null);
+        if (candidates.length === 0)
+            return { resolution: { matched: false }, refused: [] };
+        const resolution = this.deps.matcher.match({ request, rules: candidates });
+        if (!resolution.matched)
+            return { resolution: { matched: false }, refused: [] };
+        // INV-03: the read-path open-redirect oracle gate — MUST run in every
+        // code path before ever returning a matched:true outcome.
+        const verdict = await checkRedirectLocation({
+            context: { workspaceId: request.workspaceId }, location: resolution.location,
+            oracle: this.deps.originRegistry, reservedSegments: this.deps.reservedSegments,
+        }, {});
+        if (verdict.kind === "refused") {
+            return { resolution: { matched: false }, refused: [{ redirectId: resolution.redirectId, location: resolution.location, reason: verdict.reason }] };
+        }
+        this.recordHitFireAndForget(request.workspaceId, resolution.redirectId);
+        return { resolution, refused: [] };
+    }
+    /**
+     * W-008: enqueue a `redirect.hit` event, fire-and-forget. MUST NOT be
+     * awaited before the redirect response is sent, and MUST NOT let an
+     * enqueue failure affect the resolution outcome (REQ-21/AC-26).
+     */
+    recordHitFireAndForget(workspaceId, redirectId) {
+        if (!this.deps.hits)
+            return;
+        const { outbox, clock, idGen } = this.deps.hits;
+        const event = {
+            id: idGen.newId(),
+            name: "redirect.hit",
+            occurredAt: clockNowIso({ clock: clock }),
+            aggregateId: redirectId,
+            workspaceId,
+            payload: { workspaceId, redirectId, at: clockNowIso({ clock: clock }) },
+        };
+        // See redirects.ts's `enqueueMutatedEvent` comment for why this cast is needed (a named
+        // interface payload isn't auto-assignable to DomainEvent's default Record<string,unknown>).
+        void outbox.enqueue(event).catch(() => {
+            // Best-effort — a dropped hit-count enqueue never affects the redirect response (INV-06).
+        });
+    }
+}
+/**
+ * Create the read-path resolver with the required origin oracle and host path policy.
+ * @param required Repository, matcher, oracle and reserved path segments.
+ * @param optional Optional best-effort hit recording, independent of resolution.
+ * @returns A resolver that checks the fully interpolated Location before returning a match.
+ * @complexity O(1) construction; resolve inherits the bounded candidate scan.
+ * @example createRedirectResolver({ repo, matcher, originRegistry, reservedSegments }, {});
+ */
+export function createRedirectResolver(required, optional = {}) {
+    return new RedirectPhaseHandlerResolver({ ...required, ...optional });
+}
+//# sourceMappingURL=resolver.js.map

package/dist/redirects/spa/index.d.ts

@@ -0,0 +1,30 @@
+import type { RedirectTargetOracle } from "../target-gate.js";
+import type { RedirectResolutionReport } from "../ports.js";
+import type { RedirectRecord, RedirectRequest, RedirectStatusCode } from "../types.js";
+export interface SpaRedirectRequired {
+    rules: readonly RedirectRecord[];
+    oracle: RedirectTargetOracle;
+    reservedSegments: ReadonlySet<string>;
+    navigate(required: {
+        location: string;
+        statusCode: RedirectStatusCode;
+        redirectId: string;
+    }, optional?: Record<string, never>): void | Promise<void>;
+}
+export interface SpaRedirectResult extends RedirectResolutionReport {
+    navigated: boolean;
+}
+export type SpaRedirectGuard = (required: {
+    request: RedirectRequest;
+}, optional?: Record<string, never>) => Promise<SpaRedirectResult>;
+/**
+ * Create a router guard from a snapshot of rules and required host security/navigation ports.
+ * @param required Rules, verified-origin oracle, reserved segments and navigation effect.
+ * @returns A guard reporting no match or refusal; only a gate-approved finished Location navigates.
+ * @throws Repository/oracle errors and navigation errors propagate to the router's error boundary.
+ * @complexity O(n) rule snapshot; calls inherit the root memory repo and bounded dynamic scan.
+ * @example const guard = createSpaRedirectGuard({ rules, oracle, reservedSegments, navigate }, {});
+ * await guard({ request: { workspaceId: "site", path: "/old", phase: "post_content" } }, {});
+ */
+export declare function createSpaRedirectGuard({ rules, oracle, reservedSegments, navigate }: SpaRedirectRequired, _optional?: Record<string, never>): SpaRedirectGuard;
+//# sourceMappingURL=index.d.ts.map

package/dist/redirects/spa/index.js

@@ -0,0 +1,27 @@
+/** Framework-free SPA navigation through the same matcher and INV-03 gate as server resolution. */
+import { redirectMatcher } from "../matcher.js";
+import { InMemoryRedirectRepo } from "../repo.memory.js";
+import { createRedirectResolver } from "../resolver.js";
+/**
+ * Create a router guard from a snapshot of rules and required host security/navigation ports.
+ * @param required Rules, verified-origin oracle, reserved segments and navigation effect.
+ * @returns A guard reporting no match or refusal; only a gate-approved finished Location navigates.
+ * @throws Repository/oracle errors and navigation errors propagate to the router's error boundary.
+ * @complexity O(n) rule snapshot; calls inherit the root memory repo and bounded dynamic scan.
+ * @example const guard = createSpaRedirectGuard({ rules, oracle, reservedSegments, navigate }, {});
+ * await guard({ request: { workspaceId: "site", path: "/old", phase: "post_content" } }, {});
+ */
+export function createSpaRedirectGuard({ rules, oracle, reservedSegments, navigate }, _optional = {}) {
+    const repo = new InMemoryRedirectRepo({ seed: [...rules] }, {});
+    const resolver = createRedirectResolver({ repo, matcher: redirectMatcher, originRegistry: oracle, reservedSegments }, {});
+    return async ({ request }, _options = {}) => {
+        const report = await resolver.resolveWithRefusals(request, {});
+        if (!report.resolution.matched)
+            return { ...report, navigated: false };
+        const { location, statusCode, redirectId } = report.resolution;
+        // INV-03: resolver checks the interpolated Location before this effect is reachable.
+        await navigate({ location, statusCode, redirectId }, {});
+        return { ...report, navigated: true };
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/redirects/sql/index.d.ts

@@ -0,0 +1,4 @@
+export { SqlRedirectRepo, redirectRepoFor, type RedirectSqlRequired, type RedirectTables } from "./repo.js";
+export { toRecord, toRow, toRevision, toRevisionRow, updatableColumns, type RedirectRow, type RedirectRevisionRow } from "./repo.rows.js";
+export { insertRedirectAndRevision, type RedirectDbHandle, type InsertRedirectAndRevisionRequired } from "../ports.internal.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/redirects/sql/index.js

@@ -0,0 +1,4 @@
+export { SqlRedirectRepo, redirectRepoFor } from "./repo.js";
+export { toRecord, toRow, toRevision, toRevisionRow, updatableColumns } from "./repo.rows.js";
+export { insertRedirectAndRevision } from "../ports.internal.js";
+//# sourceMappingURL=index.js.map

package/dist/redirects/sql/repo.d.ts

@@ -0,0 +1,82 @@
+import type { StorageKernel } from "@jini-ai/db/kernel";
+import type { RedirectDbHandle } from "../ports.internal.js";
+import type { RedirectRepoPort } from "../ports.js";
+import type { ListRedirectsFilter, RedirectRecord, RedirectRevision } from "../types.js";
+/**
+ * @file THE redirect repository: one Kysely query body for every database the storage kernel drives
+ * (SQLite, PGlite, Postgres). Satisfies `RedirectRepoPort` and `RedirectDbHandle`. Every statement
+ * goes through `kernel.run` and is awaited.
+ *
+ * `(workspace_id, from_pattern)` uniqueness is NOT re-enforced in `save()`: `redirects.ts`'s write
+ * chokepoint is the sole enforcer (errors.spec.md names it as `REDIRECT_CONFLICT`'s producer) and
+ * runs its `findByFromPattern` check inside `transaction()`, which takes the redirect write lock so
+ * a concurrent chokepoint cannot interleave between that check and the write. `insertRedirect` /
+ * `insertRevision` open no transaction of their own (ADR-PIPE-009 Decision A): atomicity is the
+ * caller's, and nested calls join it.
+ */
+/** Host-owned table names. No schema or product table defaults live in the adapter. */
+export interface RedirectTables {
+    redirects: string;
+    revisions: string;
+}
+export interface RedirectSqlRequired {
+    kernel: StorageKernel<unknown>;
+    tables: RedirectTables;
+}
+export declare class SqlRedirectRepo implements RedirectRepoPort, RedirectDbHandle {
+    protected readonly kernel: StorageKernel<unknown>;
+    protected readonly tables: RedirectTables;
+    constructor({ kernel, tables }: RedirectSqlRequired, _optional?: Record<string, never>);
+    /** Every row of a workspace, optionally narrowed to active rows of one match type (and override-only). */
+    private rowsOf;
+    findById(required: {
+        workspaceId: string;
+        id: string;
+    }, _optional?: Record<string, never>): Promise<RedirectRecord | null>;
+    lookupExact(required: {
+        workspaceId: string;
+        path: string;
+        includeOverrideOnly: boolean;
+    }, _optional?: Record<string, never>): Promise<RedirectRecord | null>;
+    lookupLongestPrefix(required: {
+        workspaceId: string;
+        path: string;
+        includeOverrideOnly: boolean;
+    }, _optional?: Record<string, never>): Promise<RedirectRecord | null>;
+    listDynamic(required: {
+        workspaceId: string;
+        includeOverrideOnly: boolean;
+        limit: number;
+    }, _optional?: Record<string, never>): Promise<RedirectRecord[]>;
+    list(filter: ListRedirectsFilter, _optional?: Record<string, never>): Promise<RedirectRecord[]>;
+    findByFromPattern(required: {
+        workspaceId: string;
+        fromPattern: string;
+    }, _optional?: Record<string, never>): Promise<RedirectRecord | null>;
+    save(required: {
+        record: RedirectRecord;
+        revision: RedirectRevision;
+    }, _optional?: Record<string, never>): Promise<void>;
+    tombstone(required: {
+        workspaceId: string;
+        id: string;
+        revision: RedirectRevision;
+    }, _optional?: Record<string, never>): Promise<void>;
+    /** Upsert-by-id; no transaction control of its own. */
+    insertRedirect(record: RedirectRecord, _optional?: Record<string, never>): Promise<void>;
+    /** Append-only insert; no transaction control of its own. */
+    insertRevision(revision: RedirectRevision, _optional?: Record<string, never>): Promise<void>;
+    /** Test-only helper: the append-only revision ledger for one redirect, in seq order. */
+    listRevisionsForTests({ redirectId }: {
+        redirectId: string;
+    }, _optional?: Record<string, never>): Promise<RedirectRevision[]>;
+    /**
+     * The chokepoint's transaction (C-001..004). Takes the redirect write lock first so its
+     * uniqueness / chain-loop reads and the write that follows are one serialized unit; nested calls
+     * (including `save`/`tombstone`) join it. `capture.ts` never calls this (Decision A).
+     */
+    transaction<T>(fn: () => Promise<T>, _optional?: Record<string, never>): Promise<T>;
+}
+/** The redirect repo for `kernel`. */
+export declare function redirectRepoFor(required: RedirectSqlRequired, _optional?: Record<string, never>): SqlRedirectRepo;
+//# sourceMappingURL=repo.d.ts.map