@elytracms/next 0.0.90 → 0.0.92

package/dist/index.d.ts

@@ -1,15 +1,15 @@
 import { ComponentType, ReactNode } from 'react';
-import { ComponentRegistry, ComponentIssue, ComponentManifest } from '@elytracms/core/component-registry';
+import { ComponentRegistry, ComponentManifest } from '@elytracms/core/component-registry';
 export { ComponentManifest, PropField, SlotSpec, defineComponent } from '@elytracms/core/component-registry';
 import { ComponentImplementations, RelationTarget, DocumentBodyItem } from '@elytracms/core/runtime-renderer';
 export { ComponentImplementations, RenderAsset } from '@elytracms/core/runtime-renderer';
-import { HostComponentEntry } from '@elytracms/core/studio-core';
-import { ResolvePageResult, ResolvedAsset, Perspective, ContentClient, CacheTags, ContentDocumentSource, ResolvedDocument } from '@elytracms/core/content';
-export { Perspective } from '@elytracms/core/content';
-import { LocaleConfig, Locale, RouteRecord, CollectionDef, RedirectRecord, LocaleConfigInput } from '@elytracms/core/cms-core';
-export { CmsDocument, CollectionDef, FieldDef, Locale, LocaleConfig, LocaleConfigInput, LocaleRequest, LocaleStrategy, LocaleUrlPath, RedirectRecord, RouteRecord, documentSchema, fallbackHomeRoutes, localeConfigSchema, localeUrlPath, mergeRouteRecords, parseLocaleConfig, redirectRecordSchema, resolveLocale, routeRecordSchema, splitLocalePath, textDirection } from '@elytracms/core/cms-core';
+import { HostComponentEntry, ResolvedProject, WorkspaceProjectEntry } from '@elytracms/core/studio-core';
+import { ContentQueryError, ResolvePageResult, ResolvedAsset, ContentClient, CacheTags, ContentDocumentSource, ResolvedDocument } from '@elytracms/core/content';
+import { LocaleConfig, Perspective, Locale, RouteRecord, CollectionDef, RedirectRecord, LocaleConfigInput, CmsValidationIssue } from '@elytracms/core/cms-core';
+export { CmsDocument, CollectionDef, DRAFT_PERSPECTIVE, FieldDef, Locale, LocaleConfig, LocaleConfigInput, LocaleRequest, LocaleStrategy, LocaleUrlPath, Perspective, RedirectRecord, RouteRecord, documentSchema, localeConfigSchema, localeUrlPath, parseLocaleConfig, redirectRecordSchema, resolveLocale, routeRecordSchema, splitLocalePath, textDirection, variantOf } from '@elytracms/core/cms-core';
 import { AssetRecord, PersistenceAdapter } from '@elytracms/core/persistence';
 export { AssetRecord } from '@elytracms/core/persistence';
+import { Clock } from '@elytracms/core/determinism';
 import { ResolvingMetadata, Metadata, ResolvedMetadata, MetadataRoute } from 'next';
 import { RevalidationEvent } from '@elytracms/core/revalidation';
 export { REVALIDATE_SIGNATURE_HEADER, RevalidationEvent, RevalidationEventKind, revalidationEventSchema, signRevalidationBody, signedRevalidationRequest } from '@elytracms/core/revalidation';
@@ -37,48 +37,43 @@ interface HostComponent {
 /**
  * The registered component surface a host app hands to `<CanvasRenderer />`
  * and the catch-all route helper: a manifest registry plus the implementation
- * map, with registration problems surfaced as structured issues (never
- * thrown — an unknown component renders the EC-015 fallback).
+ * map. Registration problems — duplicate ids, invalid ids, role claims, and
+ * `invalid-implementation` for an entry whose `implementation` is not a React
+ * component — are structured issues in `registry.issues`, the ONE record every
+ * surface reads (EC-591; never thrown — an unknown component renders the EC-015
+ * fallback). The studio registers the same config list through the same core
+ * step, so it shows exactly these issues.
  */
 interface HostComponents {
     registry: ComponentRegistry;
     implementations: ComponentImplementations;
-    /**
-     * Structural registration issues: the registry's own (duplicate ids, invalid
-     * namespaces, …) plus `invalid-implementation` for an entry whose
-     * `implementation` is not a React component (EC-541).
-     */
-    issues: readonly ComponentIssue[];
-}
-interface DefineHostComponentsOptions {
-    /**
-     * Include the platform primitives (`base.*`) that ship with
-     * `@elytracms/core/runtime-renderer`. Defaults to `true` — graphs authored in the
-     * builder assume them.
-     */
-    includeBasePrimitives?: boolean;
 }
 /**
- * Component registration API for the embedded runtime (EC-144). The host repo
- * supplies real implementations + manifests; base primitives are included by
- * default. A host implementation registered under a primitive id replaces the
- * default implementation (the manifest of the first registration wins, which
- * is the primitive's — by design, so prop schemas stay canonical).
+ * Component registration for the embedded runtime (EC-144, EC-591): the host
+ * registers EXACTLY the list it is given — the config's `components` — through
+ * core's one registration step `registerComponents`, the same step the studio
+ * registry and the preview harness call. The engine adds nothing: there are no
+ * base primitives and no override layer (EC-591 deleted `includeBasePrimitives`).
+ * The components Elytra ships are an opt-in package listed in the config like any
+ * other (`components: [...elytraComponents, ...siteComponents]`).
+ *
+ * One precedence rule: a duplicate id is refused WHOLE (`duplicate-id`, the first
+ * entry kept), so a manifest never ships with another entry's implementation.
+ * To replace a shipped component, list yours under the id and leave the shipped
+ * entry out; to swap only the Image implementation for `next/image`, wrap the
+ * list in {@link withNextImage}.
  *
  * Accepts the CONFIG's entry shape (`implementation: unknown`) rather than the
  * strict {@link HostComponent}: the config declares implementations opaquely,
  * and EC-539 made `createElytraHost({ ...site })` the contract, so a
  * compile-time check at this seam was already gone for the recommended path.
- * The check is RUNTIME instead (EC-541), through core's one registration step
- * `registerImplementations` (EC-555 — the studio registry and the preview
- * harness call the same one): a value that is not a component is
+ * The check is RUNTIME instead (EC-541): a value that is not a component is
  * recorded as an `invalid-implementation` issue naming the component id and
  * the received kind, and is NOT put into `implementations` — so the renderer
  * takes its missing-component path (a visible EC-015 fallback) instead of
  * crashing the server render on `createElement` ("Element type is invalid")
  * or, for a string, silently rendering an HTML tag. The manifest still
- * registers, so the registry's own issues (duplicate id, invalid id) for that
- * entry are reported alongside.
+ * registers, so the entry shows as broken rather than vanishing.
  *
  * One consequence of the `unknown` parameter: an INLINE
  * `implementation: (props) => …` literal no longer gets `props` contextually
@@ -87,7 +82,7 @@ interface DefineHostComponentsOptions {
  * anyway. (An overload pair was tried and does not restore it: TypeScript
  * resolves the context-sensitive literal against the wider overload.)
  */
-declare function defineHostComponents(components?: readonly HostComponentEntry[], options?: DefineHostComponentsOptions): HostComponents;
+declare function defineHostComponents(components?: readonly HostComponentEntry[]): HostComponents;
 
 /**
  * `<CanvasRenderer />` (EC-144, vision AD-1): an async React Server Component
@@ -120,9 +115,10 @@ interface CanvasRendererProps {
      * Documents each `listing` block resolved to, keyed by serialized query (EC-255,
      * from the render outcome). A ProductGrid keyed to a picked `category` reads its
      * products through this; an unknown key (or absent map) degrades to the block's
-     * own empty state — the same degradation as a missing relation.
+     * own empty state — the same degradation as a missing relation. A query that
+     * could not run is baked as its errors (EC-581 6a) and shown above the block.
      */
-    listings?: Record<string, RelationTarget[]>;
+    listings?: Record<string, BakedListing>;
     /**
      * URL paths for the documents this page's rich-text props LINK to, keyed
      * `collection:id` (EC-291, from the render outcome). A self-typed internal link
@@ -155,6 +151,14 @@ interface DeliveryPresentation {
     /** Field names whose values form the body, in render order. */
     body?: readonly string[];
 }
+/**
+ * One listing's baked result (EC-255; EC-581 6a): the documents its query matched,
+ * or the structured errors `listDocuments` refused it with. Plain data — it rides
+ * the serializable render outcome and the RSC boundary like the other bakes.
+ */
+type BakedListing = RelationTarget[] | {
+    errors: readonly ContentQueryError[];
+};
 /**
  * Render a resolved page server-side. Async so hosts can compose it like any
  * other RSC; resolution itself is synchronous (the content was prefetched by
@@ -247,6 +251,15 @@ declare function mergeCacheTags(first: CacheTags, ...rest: readonly CacheTags[])
  * API — assembles the exact same `ContentSource` without faking an adapter.
  */
 interface ContentSnapshotOptions {
+    /**
+     * The project's collection definitions — **required** (EC-583). The snapshot's
+     * lookup resolves localized fields and a collection's declared `presentation`
+     * through them, and the persistence contract holds no schema any more (this used to
+     * read `adapter.cms.findSchema`, which in a seeded host was the engine sample's JSON
+     * projection unless the host re-saved its own). Hand it the config's collections —
+     * the same ones the studio and the seed read.
+     */
+    collections: readonly CollectionDef[];
     /** Route records served by `resolvePage` (EC-019). */
     routes?: readonly RouteRecord[];
     /** Redirect records served by `resolvePage` (EC-019/020). */
@@ -298,7 +311,6 @@ interface StaticContentData {
      */
     assetUrl?: (asset: AssetRecord) => string;
 }
-
 /**
  * Assemble a `ContentSource` from plain prefetched data — the pure half of
  * {@link createContentSnapshot}, shared with hosts that fetched the data
@@ -395,8 +407,24 @@ type CanvasPageOutcome = {
      * cannot ride the data cache or cross the RSC boundary. A listing depends on
      * collection MEMBERSHIP (a product joining/leaving the category), so its
      * invalidation rides the per-query `listDocuments` tags merged into `tags`.
+     *
+     * EC-581 6a: a query `listDocuments` refused (a non-filterable field, an
+     * operand of the wrong type, a bad limit) is baked as `{ errors }` — the
+     * structured `ContentQueryError`s — and `<CanvasRenderer />` shows them above
+     * the block (`data-ec-fallback="invalid-listing"`), never an empty grid
+     * indistinguishable from "no matching content".
+     */
+    listings: Record<string, BakedListing>;
+    /**
+     * EC-581 6a: whether resolving this page READ THE CLOCK — a listing on it
+     * binds an operand to `now` (e.g. "events whose date is still ahead"). Such a
+     * page's content changes as time passes, not only on publish: a cached entry
+     * of it is correct for the instant it was resolved and goes stale when a
+     * listed document crosses its `now` boundary, which no publish tag covers. A
+     * cache layer must bound that entry's life (the delivery cache — EC-515 —
+     * reads this). `false` for every page with no `now`-bound listing.
      */
-    listings: Record<string, RelationTarget[]>;
+    readsNow: boolean;
     /**
      * The public URL path of every document a rich-text prop on this page LINKS
      * to (EC-291), keyed `collection:id`. Baked into the outcome (serializable) so
@@ -433,6 +461,14 @@ interface ResolveCanvasPageOptions {
      * resolution exactly, so no referenced image is ever dropped.
      */
     registry?: ComponentRegistry;
+    /**
+     * The clock a `{ now: true }` listing operand reads (EC-581 6a) — an ISO-8601
+     * UTC instant, read at most once per resolution so every listing on the page
+     * compares against the SAME instant. Defaults to the system clock; tests and
+     * fixtures inject a fixed one. Taken as a FUNCTION, read during resolution, so a
+     * `now` value is never an argument a cache keys on.
+     */
+    clock?: Clock;
 }
 /**
  * Resolve one request URL against a content source: split the locale, run
@@ -442,29 +478,165 @@ interface ResolveCanvasPageOptions {
  */
 declare function resolveCanvasPage(source: ContentSource, url: string, perspective: Perspective, options?: ResolveCanvasPageOptions): Promise<CanvasPageOutcome>;
 
-interface CanvasCacheOptions {
-    /**
-     * Project scope prefix for every tag (`p:<scope>:…`) — must be the SAME scope
-     * the revalidate receiver derives its tags with (`createRevalidateRoute`'s
-     * `scope`; the delivery kit hands its one `contentScope` to both, EC-579).
-     */
-    scope?: string;
-    /**
-     * Which content world `loadContent` reads — the delivery kit passes its
-     * `contentMode` (`'live' | 'fallback' | 'empty'`), so entries written in one
-     * world can never be served in another (EC-543, see `canvasCacheKey`). A host
-     * driving this helper directly with a single world may omit it.
-     */
-    mode?: string;
+/**
+ * Cache-tag pipeline (EC-146, vision AD-5) — the pure half.
+ *
+ * This module defines (a) the **canonical Next.js tag string format** mapping
+ * the accessor-level `CacheTags` (EC-143) onto `cacheTag` / `revalidateTag` keys,
+ * (b) the **tag derivation for a revalidation event** ({@link revalidationTags},
+ * EC-579 — the receiver's half of the one emitter), and (c) the **pure half of a
+ * cached resolution**: its key ({@link canvasCacheKey}) and the `cacheTag` calls that
+ * declare its tags ({@link entryTagCalls}). No Next.js imports — everything here is
+ * unit-testable.
+ *
+ * **Caching is the host's (EC-620).** The engine's part is exactly three things: the
+ * tags on everything the accessors return, the invalidation signal (the Convex
+ * trigger's event → the kit receiver → `revalidateTag` for every derived tag), and a
+ * default in the scaffold. Whether a page caches, under which scope, for how long and
+ * with which Next flag is the host's: the kit holds no `'use cache'` scope and no
+ * `cacheLife`. The host's own `'use cache'` function declares a result's tags through
+ * the canvas route's `applyCacheTags` (`route.tsx`), which makes the
+ * {@link entryTagCalls} calls with the host's one scope.
+ *
+ * This is the ONE tag module: the entries are tagged here and the invalidations
+ * are derived here, from the same formatters and the same scope. Before EC-579 the
+ * format was mirrored twice more (the studio's browser dispatcher and an inline
+ * literal in the Convex emitter), and each emitter brought its own scope.
+ *
+ * ## Tag format
+ *
+ * - `doc:<collection>:<id>` — one per document whose content was actually in
+ *   the response (fetch-time tagging: includes depth-1 populated relation
+ *   targets, and documents inside filtered/dynamic lists *after* the filter
+ *   ran).
+ * - `collection:<name>:<locale>` — the coarse membership tag: every response
+ *   that read from a collection carries it, so create/delete/newly-matching
+ *   documents sweep cached lists without read-set tracking.
+ * - `route:<pattern>:<locale>` — the resolved URL path plus every hop of a
+ *   redirect chain.
+ * - `asset:<id>` — one per asset whose delivery shape the page *baked*
+ *   (page-scoped images + `seoOgImage`, EC-227); editing that asset record
+ *   (alt/dimensions/re-upload) drops exactly the pages that baked it. Not
+ *   locale-scoped — an asset record is locale-agnostic.
+ * - `project` — the whole-project sweep tag attached to **every** cached
+ *   entry; derived for the events whose effect no narrower tag names (a redirect
+ *   change, an asset edit — see {@link revalidationTags}).
+ *
+ * ## Project scope
+ *
+ * Every tag is prefixed `p:<projectId>:` when a scope is configured (e.g.
+ * `p:prj_aurora:doc:post:post-1`). The cost is a few bytes per tag and it
+ * keeps multi-project hosts (one Next app serving several builder projects)
+ * from cross-invalidating, so the prefix is **on whenever the host knows its
+ * project id** — decision: include it. Since EC-579 the scope has ONE owner: the
+ * host. The webhook carries an event, not tags, and the receiver derives the
+ * tags with the same scope its cache entries are written under (the delivery
+ * kit hands both the one `contentScope`), so emitter and host can no longer
+ * disagree about it.
+ */
+/** Apply the optional multi-project scope prefix to one tag. */
+declare function scopeCacheTag(tag: string, scope?: string): string;
+/**
+ * Tag for one document identity. `docKey` is the EC-143 `documentKey` string
+ * (`<collection>:<id>`), exactly as found in `CacheTags.docs`.
+ */
+declare function docCacheTag(docKey: string, scope?: string): string;
+/** The coarse membership tag of one collection in one locale. */
+declare function collectionCacheTag(collection: string, locale: string, scope?: string): string;
+/** Tag for one resolved route path (or redirect-chain hop) in one locale. */
+declare function routeCacheTag(pattern: string, locale: string, scope?: string): string;
+/**
+ * The whole-project sweep tag. Attached to every cached page entry; derived for
+ * the events no narrower tag covers ({@link revalidationTags}).
+ */
+declare function projectSweepTag(scope?: string): string;
+/**
+ * Map an accessor-level `CacheTags` (what one request actually read) onto the
+ * full, deterministic (sorted, deduplicated) set of Next tag strings for the
+ * cache entry — including the project sweep tag.
+ */
+declare function nextCacheTags(tags: CacheTags, scope?: string): string[];
+/** The receiver's own project — what its cached entries are tagged with. */
+interface RevalidationProject {
+    /** The tag scope of this host's cache entries (`p:<scope>:…`), if any. */
+    scope?: string | undefined;
+    /** Every locale this host serves — one `collection:` tag per locale. */
+    locales: readonly string[];
 }
+/**
+ * The tags one revalidation event invalidates on this host — sorted, deduplicated,
+ * scoped with the receiver's OWN scope, so the emitter never needs to know it.
+ *
+ * - `publish` / `unpublish` / `delete` → `doc:<collection>:<id>` (its detail page and
+ *   every cached list that contained it) + `collection:<collection>:<locale>` for
+ *   EVERY locale this host serves (list membership may have changed, and a URL
+ *   cached as not-found for a document that now exists carries it too). **No
+ *   sweep** — a publish drops exactly the entries that read the document or its
+ *   collection (EC-515);
+ * - `redirects` → the sweep (routing can change any URL; see the `redirects` trigger
+ *   in the studio's `convex/triggers.ts` for why a targeted `route:` tag is wrong);
+ * - `asset` → `asset:<id>` + the sweep (a page reading the asset through a document
+ *   asset FIELD carries no `asset:` tag — EC-566 D16, EC-589);
+ * - `probe` → nothing (the doctor's no-op ping).
+ *
+ * Why the precise tags are enough (EC-515 option D, kept by EC-620): a cached
+ * resolution declares its tags with `cacheTag` from INSIDE the cache function that
+ * loaded it (the host's, through `applyCacheTags`), and Next decides an entry's
+ * staleness from the tags it was STORED with — so a `doc:` tag drops the entries that
+ * read the document, on a self-hosted host as on any other. Until EC-515 the read
+ * named only the baseline sweep (`unstable_cache` judged the reading wrapper's tags),
+ * every precise tag was inert on a self-hosted host, and every publish carried the
+ * sweep to compensate (wave-0091). Measured both ways in EC-515's harness, and again
+ * with the host-owned scope in EC-620's.
+ */
+declare function revalidationTags(event: RevalidationEvent, project: RevalidationProject): string[];
+declare const canvasCacheKeyBrand: unique symbol;
+/**
+ * What identifies one published canvas resolution — the argument the canvas route
+ * hands the host's cache function (`CanvasRouteOptions.published`), which therefore
+ * IS that entry's key: Next keys a `'use cache'` entry by (build id, function id,
+ * serialized arguments), so whatever identifies an entry has to be an argument, and
+ * nothing else may be. It encodes three facts ({@link parseCanvasCacheKey}):
+ *
+ * - `scope` — the tag scope (the project id the studio publishes under; `''` if none).
+ * - `mode` — which content world the loader reads (the delivery kit's `contentMode`:
+ *   `live` / `fallback` / `empty`; `''` for a host driving the route directly with
+ *   one world).
+ * - `url` — the request path, locale prefix included.
+ *
+ * **An opaque string, not an object — measured (EC-620).** Next wraps every
+ * `'use cache'` function in React's per-request `cache()`, which memoizes by argument
+ * IDENTITY. `Page` and `generateMetadata` each build the key for the same URL; as two
+ * equal objects they missed that memo and a cold URL ran the loader twice (page and
+ * metadata filling the entry concurrently), as one string they share the in-flight
+ * miss — one load, exactly as the kit-owned entry did. A string is also trivially
+ * stable for Next's own key serialization. The brand keeps a hand-built string out.
+ *
+ * The mode is in the key because an entry can outlive the world that wrote it (a
+ * shared or remote cache handler, a host whose env changed under a warm cache) and a
+ * hit never asks the loader whether it still applies. Before EC-543 the key was
+ * `(scope, url)` only, and since `ELYTRA_PROJECT_ID` *is* the config slug, a live host
+ * and an empty one keyed the same URL identically — measured on 0.0.85: a warm cache
+ * written in live mode kept answering `200` with the live world's bytes after both env
+ * vars were blanked and the host itself reported `contentMode: 'empty'`. Keying on the
+ * mode makes that cross-read structurally impossible rather than something to detect —
+ * a world change is a cold miss, never a stale hit. Since EC-620 the cache function is
+ * the host's, so the property holds as long as the host keys on this value — which
+ * it does by passing it through unchanged (the canvas route refuses a key of another
+ * world).
+ */
+type CanvasCacheKey = string & {
+    readonly [canvasCacheKeyBrand]: true;
+};
+
 /**
  * What the route helper tells the content loader about the request it is
  * loading for (EC-156). Loaders that serve both perspectives from one
  * prefetched source (the fixture snapshot) can ignore it; a live loader uses
  * it to fetch the draft-perspective snapshot only for draft-mode requests —
- * it must NOT call request APIs like `draftMode()` itself, because on the
- * cached published path the loader runs inside `unstable_cache`, where
- * dynamic request APIs are unavailable.
+ * it must NOT call request APIs like `draftMode()` itself, because on a cached
+ * published path the loader runs inside the host's `'use cache'` function, where
+ * request APIs are unavailable.
  */
 interface CanvasContentRequest {
     perspective: Perspective;
@@ -474,8 +646,8 @@ interface CanvasRouteOptions {
      * Async content loader — the seam EC-145/146 plug Convex into. For the
      * fixture-backed example this memoizes a `createContentSnapshot` call.
      * Invoked per request; cache/memoize inside the loader as appropriate.
-     * With `cache` configured it only runs on a cache miss (once per
-     * revalidation cycle) — cache hits never touch the content backend.
+     * Behind a host cache function ({@link CanvasRouteOptions.published}) it runs
+     * only on a cache miss — cache hits never touch the content backend.
      * Receives the request's perspective (see {@link CanvasContentRequest});
      * zero-arg loaders remain valid.
      */
@@ -483,17 +655,38 @@ interface CanvasRouteOptions {
     /** Host component surface from `defineHostComponents`. */
     components: HostComponents;
     /**
-     * EC-146 instant publish: cache the published-perspective resolution in
-     * Next's data cache (`unstable_cache`), tagged with the response's own
-     * fetch-time tags, invalidated by the `/api/revalidate` webhook. Draft mode
-     * always bypasses this cache entirely. Tag-driven only — no time-based
-     * revalidation (the AD-5 model). Cached values are JSON-serialized plain data.
+     * The tag scope of everything this route resolves (`p:<scope>:…`) — what
+     * {@link CanvasRoute.applyCacheTags} scopes with and what every
+     * {@link CanvasCacheKey} carries. It must be the SAME scope the revalidate receiver
+     * derives its tags with (`createRevalidateRoute`'s `scope`); the delivery kit hands
+     * its one `contentScope` to both (EC-579) — a disagreement would drop nothing,
+     * silently.
      */
-    cache?: CanvasCacheOptions;
+    scope?: string;
+    /**
+     * Which content world `loadContent` reads — the delivery kit passes its
+     * `contentMode` (`'live' | 'fallback' | 'empty'`). It rides in every
+     * {@link CanvasCacheKey}, so an entry written in one world can never be served in
+     * another (EC-543). A host driving this helper directly with one world may omit it.
+     */
+    mode?: string;
+    /**
+     * How a PUBLISHED request gets its outcome — the host's cache seam (EC-620). Pass
+     * your own `'use cache'` function: it receives the request's {@link CanvasCacheKey}
+     * (keep that its only argument — it is the entry's key), calls
+     * {@link CanvasRoute.resolve} with it, declares the result's tags with
+     * {@link CanvasRoute.applyCacheTags}, picks its `cacheLife`, and returns the
+     * outcome (module example above; the scaffold's page ships it as the default).
+     *
+     * Omit it and every published request resolves fresh — dynamic and uncached. Draft
+     * mode never calls it. `Page` and `generateMetadata` call it with the same key.
+     */
+    published?: (key: CanvasCacheKey) => Promise<CanvasPageOutcome>;
     /**
      * EC-146 hook: receives the merged `CacheTags` of everything this request
      * read (the `resolvePage` tags plus the baked relations/listings/links). On a
-     * cache hit these are the stored tags of the run that wrote the entry.
+     * cache hit (through a host {@link CanvasRouteOptions.published} function) these
+     * are the stored tags of the run that wrote the entry.
      */
     onTags?: (tags: CacheTags, info: CanvasRequestInfo) => void;
     /** Override the generated `<head>` metadata for a resolved page. */
@@ -552,10 +745,131 @@ interface CanvasRoute {
      * on 0.0.88 (the Turbopack validator is lenient, which is how the gate missed it).
      */
     generateMetadata: (props: CanvasRouteProps, parent: ResolvingMetadata) => Promise<Metadata>;
+    /**
+     * Resolve one PUBLISHED request — with no cache scope of its own (EC-620). Call it
+     * from the `'use cache'` function you pass as {@link CanvasRouteOptions.published},
+     * with the key the route handed that function. A key of another scope or content
+     * mode (a cache function shared with a route of another world) is refused loudly:
+     * the entry would be keyed under one world and resolved in another (EC-543).
+     *
+     * The outcome carries everything a cache decision needs: `tags` (what the
+     * resolution read — hand them to {@link applyCacheTags}) and, on a `render`
+     * outcome, `readsNow` (a listing on the page compared against the clock, so the
+     * page changes as time passes — bound that entry's life).
+     */
+    resolve: (key: CanvasCacheKey) => Promise<CanvasPageOutcome>;
+    /**
+     * Declare a result's tags on the CURRENT `'use cache'` entry, scoped with this
+     * route's scope — exactly the strings the revalidate receiver revalidates (EC-620).
+     * Any accessor result works (`{ tags }`): a resolution from {@link resolve}, or a
+     * `listDocuments` result in a route of your own.
+     *
+     * It makes the {@link entryTagCalls} calls: the project sweep first and alone, the
+     * rest in chunks of at most 128. Next keeps 128 tags per `cacheTag()` call and drops
+     * the rest with only a warning, and the sweep sorts last — one `cacheTag(...tags)`
+     * call loses it on a page that read ~125 documents, and with it every redirect and
+     * asset invalidation (measured, EC-515/EC-620).
+     *
+     * Callable ONLY inside a `'use cache'` function: anywhere else Next's own `cacheTag`
+     * throws (E819 during a request or a prerender; E886 when neither `cacheComponents`
+     * nor `experimental.useCache` is enabled) — a loud error, never a silent no-op.
+     */
+    applyCacheTags: (result: {
+        tags: CacheTags;
+    }) => void;
+    /**
+     * `export const generateStaticParams = route.generateStaticParams` — needed in the
+     * catch-all page file only when the HOST enables `cacheComponents` (that flag's
+     * rule, not the kit's; measured on Next 16.2.10, EC-515): without it, awaiting the
+     * catch-all's `params` fails `next build` ("Uncached data was accessed outside of
+     * <Suspense>"). Wrapping the page in `<Suspense>` (or a root `loading.tsx`) instead
+     * also builds, but answers every 404 and every redirect with HTTP 200 — the status
+     * is committed before the content resolves. Declaring params keeps the page
+     * blocking, so `notFound()` is a real 404 and a redirect a real 308/307. A host
+     * without `cacheComponents` needs none of it.
+     *
+     * It names ONE param set: {@link CANVAS_VALIDATION_SLUG}, a sample that Next
+     * prerenders to validate the route and that resolves to not-found without
+     * reading content (the build never touches the backend for it). It fits both
+     * catch-all shapes (`[[...slug]]` and the scaffold's required `[...slug]`, which
+     * rejects an empty slug), and it is never empty (Next rejects an empty list).
+     * Every real URL renders on its first request and is cached from then on.
+     */
+    generateStaticParams: () => Promise<Array<{
+        slug: string[];
+    }>>;
 }
-/** Create the `{ Page, generateMetadata }` pair for `app/[[...slug]]/page.tsx`. */
+/**
+ * The catch-all's build-time validation sample (see
+ * {@link CanvasRoute.generateStaticParams}). The path is reserved: the canvas
+ * route answers it with not-found and never resolves it against content.
+ */
+declare const CANVAS_VALIDATION_SLUG: readonly string[];
+/**
+ * THE edge mapping of Next's draft mode onto the delivery perspective (EC-595 binding
+ * point 1): draft mode reads the draft variant, everything else the published snapshot.
+ * The kit's other request-time read (`pageOpensFullBleed`) imports this one, and the
+ * package exports it for a host's own server components, so the mapping is declared
+ * once. A request API: never call it inside a cache scope.
+ */
+declare function requestPerspective(): Promise<Perspective>;
+/**
+ * Create the canvas route for `app/[[...slug]]/page.tsx` — `{ Page, generateMetadata,
+ * generateStaticParams }` to export, plus `resolve` / `applyCacheTags` for the host's
+ * own cache function ({@link CanvasRouteOptions.published}).
+ */
 declare function createCanvasRoute(options: CanvasRouteOptions): CanvasRoute;
 
+/**
+ * A resolved document → Next.js `Metadata` (EC-171, reshaped by EC-187, and by EC-590 —
+ * EC-565 Round 3 "3g, extensibility"): **`seoMetadata(doc, ctx)`**, the kit's pure,
+ * exported SEO reader. The route's `generateMetadata` calls it (the default), so a
+ * project WRAPS it (`{ ...seoMetadata(doc, ctx), other }` for its own sub-fields),
+ * REPLACES it, or ignores it.
+ *
+ * What it reads — never a dictated field name:
+ * - the document's **SEO object**: the field under its collection's SEO ROLE
+ *   (`seoField`, default a field named `seo`; the engine's `seoFields()` declares it).
+ *   Its sub-field names are the contract ({@link SEO_SUBFIELDS}); a sub-field the object
+ *   omits emits nothing, a sub-field the project added is theirs to read.
+ * - the document's **display title**: the ONE `resolveDocumentTitle` over its TITLE ROLE
+ *   (`titleField`, default `title` → `name`) — the resolve result carries it
+ *   (`result.title`), so a function `titleField` titles the page too.
+ *
+ * Mapping:
+ * - `title`: `seo.title` → the display title.
+ * - `description`: `seo.description`.
+ * - `openGraph`: title (`seo.ogTitle` → the effective title), description
+ *   (`seo.ogDescription` → `seo.description`), image (`seo.image`) — and `locale` from the
+ *   page's resolved locale when, and only when, the code carries a territory (EC-531,
+ *   EC-610). The site-wide half of Open Graph (`type`, `siteName`, the site image) is the
+ *   LAYOUT's; the canvas route merges this object over the layout's
+ *   (`mergeMetadataOverParent`), so a page states only what is its own. Site-level SEO
+ *   defaults live on the project's own settings document and are read by its layout —
+ *   this reader needs none (EC-590 (b): nothing here ever read a settings document).
+ * - `robots`: `seo.noindex` → `{ index: false }`.
+ * - `alternates.canonical`: `seo.canonical` (EC-228), verbatim.
+ *
+ * Image resolution (EC-202/EC-266): `seo.image` is an asset field, delivered as a resolved
+ * asset object (`{ id, url, … }`) → its `url`; a string is a passthrough URL or a raw asset
+ * id resolved against the page's baked `assets`; anything unresolvable is dropped — an
+ * `og:image` must carry a real URL, never an internal id.
+ *
+ * `hreflang` alternates are intentionally NOT derived here (a per-page translation map is
+ * the sitemap's — EC-517).
+ */
+interface SeoMetadataContext {
+    /** The SEO role field name — `result.seoField`. Default: the conventional `seo`. */
+    seoField?: string | null;
+    /** The display title — `result.title` (the title role, resolved). */
+    title?: string | null;
+    /** The page's resolved locale (`result.tags.locale`) — for `og:locale`. */
+    locale?: string;
+    /** The page-scoped baked assets (a raw asset-id `image` resolves against them). */
+    assets?: readonly ResolvedAsset[];
+}
+/** The {@link SeoMetadataContext} of a resolve result — the default route's one line. */
+declare function seoContextOf(result: ResolvePageResult, assets?: readonly ResolvedAsset[]): SeoMetadataContext;
 /**
  * EC-531, narrowed by EC-610 (owner ruling 3, 2026-10-23): `og:locale` ONLY in the
  * shape Open Graph specifies — `language_TERRITORY` with an underscore (`de_DE`),
@@ -567,7 +881,10 @@ declare function createCanvasRoute(options: CanvasRouteOptions): CanvasRoute;
  * Brazil, Latin America), and a wrong valid value looks deliberate.
  */
 declare function openGraphLocale(locale: string): string | null;
-declare function canvasPageMetadata(result: ResolvePageResult, assets?: readonly ResolvedAsset[]): Metadata;
+/** The document's SEO object (the field under its SEO role), or an empty record. */
+declare function seoObjectOf(doc: Record<string, unknown> | null | undefined, seoField?: string | null | undefined): Record<string, unknown>;
+/** The kit's SEO reader — see the module docs. Pure: data in, `Metadata` out. */
+declare function seoMetadata(doc: Record<string, unknown> | null | undefined, ctx?: SeoMetadataContext): Metadata;
 /**
  * EC-610 (owner ruling 1, 2026-10-13): **the site provides the default tags, and
  * the page's tags are merged on top** — a value the page states overrides the
@@ -594,72 +911,39 @@ declare function canvasPageMetadata(result: ResolvePageResult, assets?: readonly
 declare function mergeMetadataOverParent(parent: ResolvedMetadata | null | undefined, page: Metadata): Metadata;
 
 /**
- * `sitemap.xml` from published routes (EC-171): walk the same route records
- * `resolvePage` resolves against, resolve every candidate URL in the
- * **published** perspective, and emit `MetadataRoute.Sitemap` entries per
- * locale — Next's `app/sitemap.ts` convention. Pages marked `noindex` (and
- * URLs that do not resolve, e.g. a page that was never published) are
- * omitted.
- *
- * Dynamic routes (`/blog/:slug`): a route record does not declare which
- * collection feeds its params, so enumeration is delegated to the host's
- * {@link SitemapParamsProvider} — it gets a published-perspective accessor
- * client and returns one param record per concrete URL (typically from
- * `listDocuments`). **Honest limit:** parameterized routes without a provider
- * (or provider entries missing a param) are skipped and reported in
- * `skipped`, never guessed. `lastModified` is omitted — the delivery shape
- * carries no per-page timestamps today.
- *
- * Hierarchy mounts (`/:path*`, EC-218): a page-tree mount self-describes its
- * URLs, so it is enumerated automatically from the collection's published
- * documents (composing each page's nested path from its parent chain) — no
- * params provider entry needed.
- *
- * **Enumeration is a candidate list, not the output (EC-486).** Every branch
- * above — static, provider-fed, and mount — only proposes paths; each one is
- * then put back through `resolvePage`, and a path the resolver refuses is
- * dropped. So the sitemap cannot claim a URL the delivery host would 404, even
- * though the mount branch enumerates its collection independently of route
- * precedence. Do not read the enumeration in isolation: the gate below it is
- * what makes the two agree. What a mount enumerated and the resolver then
- * refused is reported in {@link CanvasSitemapResult.skipped}, never dropped in
- * silence.
+ * `sitemap.xml` from published routes (EC-171, reshaped by EC-590): the URL of every
+ * published document of every collection a route names, per locale — Next's
+ * `app/sitemap.ts` convention. Documents marked `noindex` in their SEO object, and URLs
+ * that do not resolve, are omitted.
+ *
+ * **The router enumerates, no host provider (EC-590; EC-565 Round 3, 3e).** A route record
+ * names the collection it serves (`document.collection`), so the router's `urlsFor` —
+ * the same reverse direction the studio's live link and every rendered link read —
+ * yields one URL per published document: template routes (`/blog/:slug`), hierarchy
+ * mounts (`/:path*`, composed through the parent and slug roles) and literal-id routes
+ * alike. The former `SitemapParamsProvider` existed because "a route record does not
+ * declare which collection feeds its params" — false for every document-bound route
+ * (F6c RESTATED). A document-less static route (`/contact`, no `document`) is listed by
+ * its pattern.
+ *
+ * **Enumeration is a candidate list, not the output (EC-486).** Every candidate is put
+ * back through `resolvePage`, and a path the resolver refuses is dropped — so the sitemap
+ * cannot claim a URL the delivery host would 404. What was enumerated and then refused is
+ * reported in {@link CanvasSitemapResult.skipped}, never dropped in silence. `lastModified`
+ * is omitted — the delivery shape carries no per-page timestamps today.
  *
  * Host usage (`app/sitemap.ts`):
  *
  * ```ts
  * import { createCanvasSitemap } from '@elytracms/next'
- * import { loadContent } from '../lib/content'
- *
- * export default createCanvasSitemap({
- *   loadContent,
- *   baseUrl: 'https://example.com',
- *   params: ({ route, client }) =>
- *     route.id === 'r-post'
- *       ? (client.listDocuments('post').ok ? … : []) // slug per published post
- *       : null,
- * })
+ * import { elytra } from '../lib/elytra'
+ *
+ * export default createCanvasSitemap({ loadContent: elytra.loadContent, baseUrl: elytra.frontendUrl! })
  * ```
  */
-interface SitemapRouteContext {
-    route: RouteRecord;
-    locale: Locale;
-    /** Published-perspective accessor client bound to `locale`. */
-    client: ContentClient;
-}
-/**
- * Enumerate the param sets of one dynamic route — one record per concrete
- * URL (e.g. `[{ slug: 'hello-world' }, …]`). Return `null`/`undefined` to
- * skip the route (reported in `skipped`).
- */
-type SitemapParamsProvider = (ctx: SitemapRouteContext) => readonly Record<string, string>[] | null | undefined;
 interface CanvasSitemapOptions {
     /** Absolute site origin, e.g. `https://example.com` (no trailing slash needed). */
     baseUrl: string;
-    /** Route records to enumerate; defaults to the source's own route table. */
-    routes?: readonly RouteRecord[];
-    /** Param enumeration for dynamic routes (see {@link SitemapParamsProvider}). */
-    params?: SitemapParamsProvider;
 }
 interface SitemapSkippedRoute {
     routeId: string;
@@ -668,13 +952,12 @@ interface SitemapSkippedRoute {
 }
 interface CanvasSitemapResult {
     entries: MetadataRoute.Sitemap;
-    /** Routes that could not be enumerated — explicit, never silent. */
+    /** Routes whose candidates could not be published — explicit, never silent. */
     skipped: SitemapSkippedRoute[];
 }
 /**
- * Enumerate the sitemap entries of one content source (published
- * perspective). Pure over the prefetched source — synchronous accessors,
- * deterministic ordering (sorted by URL).
+ * Enumerate the sitemap entries of one content source (published perspective). Pure over
+ * the prefetched source — synchronous accessors, deterministic ordering (sorted by URL).
  */
 declare function canvasSitemapEntries(source: ContentSource, options: CanvasSitemapOptions): CanvasSitemapResult;
 interface CreateCanvasSitemapOptions extends CanvasSitemapOptions {
@@ -691,220 +974,6 @@ interface CreateCanvasSitemapOptions extends CanvasSitemapOptions {
  */
 declare function createCanvasSitemap(options: CreateCanvasSitemapOptions): () => Promise<MetadataRoute.Sitemap>;
 
-/**
- * Cache-tag pipeline (EC-146, vision AD-5) — the pure half.
- *
- * This module defines (a) the **canonical Next.js tag string format** mapping
- * the accessor-level `CacheTags` (EC-143) onto `revalidateTag` keys, (b) the
- * **tag derivation for a revalidation event** ({@link revalidationTags}, EC-579 —
- * the receiver's half of the one emitter), and (c) the **tag-discovery caching
- * logic** the catch-all route helper runs inside `unstable_cache`. No Next.js
- * imports — everything here is unit-testable; `route.tsx` injects the real
- * `unstable_cache` via {@link CacheWrapper}.
- *
- * This is the ONE tag module: the entries are tagged here and the invalidations
- * are derived here, from the same formatters and the same scope. Before EC-579 the
- * format was mirrored twice more (the studio's browser dispatcher and an inline
- * literal in the Convex emitter), and each emitter brought its own scope.
- *
- * ## Tag format
- *
- * - `doc:<collection>:<id>` — one per document whose content was actually in
- *   the response (fetch-time tagging: includes depth-1 populated relation
- *   targets, and documents inside filtered/dynamic lists *after* the filter
- *   ran).
- * - `collection:<name>:<locale>` — the coarse membership tag: every response
- *   that read from a collection carries it, so create/delete/newly-matching
- *   documents sweep cached lists without read-set tracking.
- * - `route:<pattern>:<locale>` — the resolved URL path plus every hop of a
- *   redirect chain.
- * - `asset:<id>` — one per asset whose delivery shape the page *baked*
- *   (page-scoped images + `seoOgImage`, EC-227); editing that asset record
- *   (alt/dimensions/re-upload) drops exactly the pages that baked it. Not
- *   locale-scoped — an asset record is locale-agnostic.
- * - `project` — the whole-project sweep tag attached to **every** cached
- *   entry; every revalidation event that changes live output invalidates it
- *   (see {@link revalidationTags} for why, until EC-515).
- *
- * ## Project scope
- *
- * Every tag is prefixed `p:<projectId>:` when a scope is configured (e.g.
- * `p:prj_aurora:doc:post:post-1`). The cost is a few bytes per tag and it
- * keeps multi-project hosts (one Next app serving several builder projects)
- * from cross-invalidating, so the prefix is **on whenever the host knows its
- * project id** — decision: include it. Since EC-579 the scope has ONE owner: the
- * host. The webhook carries an event, not tags, and the receiver derives the
- * tags with the same scope its cache entries are written under (the delivery
- * kit hands both the one `contentScope`), so emitter and host can no longer
- * disagree about it.
- */
-/** Apply the optional multi-project scope prefix to one tag. */
-declare function scopeCacheTag(tag: string, scope?: string): string;
-/**
- * Tag for one document identity. `docKey` is the EC-143 `documentKey` string
- * (`<collection>:<id>`), exactly as found in `CacheTags.docs`.
- */
-declare function docCacheTag(docKey: string, scope?: string): string;
-/** The coarse membership tag of one collection in one locale. */
-declare function collectionCacheTag(collection: string, locale: string, scope?: string): string;
-/** Tag for one resolved route path (or redirect-chain hop) in one locale. */
-declare function routeCacheTag(pattern: string, locale: string, scope?: string): string;
-/**
- * The whole-project sweep tag. Attached to every cached page entry; derived for
- * every revalidation event that changes live output ({@link revalidationTags}).
- */
-declare function projectSweepTag(scope?: string): string;
-/**
- * Map an accessor-level `CacheTags` (what one request actually read) onto the
- * full, deterministic (sorted, deduplicated) set of Next tag strings for the
- * cache entry — including the project sweep tag.
- */
-declare function nextCacheTags(tags: CacheTags, scope?: string): string[];
-/** The receiver's own project — what its cached entries are tagged with. */
-interface RevalidationProject {
-    /** The tag scope of this host's cache entries (`p:<scope>:…`), if any. */
-    scope?: string | undefined;
-    /** Every locale this host serves — one `collection:` tag per locale. */
-    locales: readonly string[];
-}
-/**
- * The tags one revalidation event invalidates on this host — sorted, deduplicated,
- * scoped with the receiver's OWN scope, so the emitter never needs to know it.
- *
- * - `publish` / `unpublish` / `delete` → `doc:<collection>:<id>` (its detail page and
- *   every cached list that contained it) + `collection:<collection>:<locale>` for
- *   EVERY locale this host serves (list membership may have changed) + the sweep;
- * - `redirects` → the sweep (routing can change any URL; see the `redirects` trigger
- *   in the studio's `convex/triggers.ts` for why a targeted `route:` tag is wrong);
- * - `asset` → `asset:<id>` + the sweep (a page reading the asset through a document
- *   asset FIELD carries no `asset:` tag — EC-566 D16, EC-589);
- * - `probe` → nothing (the doctor's no-op ping).
- *
- * **Why every live-output event also carries the project sweep — a deliberate,
- * measured deviation from the EC-579 ruling's text, which lists the sweep only for
- * redirects and asset removes.** A self-hosted Next host honours ONLY the baseline
- * tags of a cache read (measured in EC-515 on Next 16.2.10 — see
- * {@link loadCachedEntry}): a discovered `doc:` / `collection:` / `asset:` tag
- * invalidates nothing there, silently, and Vercel is unmeasured. Until EC-515's
- * option D makes the precise tags honoured, the precise tags alone would turn
- * "revalidates coarsely" into "never revalidates" on every self-hosted host — so the
- * sweep stays on every event, exactly as the Convex path sent it before. Dropping it
- * from a publish is EC-515's job, together with the read that makes it safe.
- */
-declare function revalidationTags(event: RevalidationEvent, project: RevalidationProject): string[];
-/**
- * The slice of `unstable_cache` the discovery logic needs, injectable so the
- * logic is testable against a faithful in-memory model (and so the test model
- * can mirror the real semantics this design depends on — see below).
- */
-interface CacheWrapperOptions {
-    tags: string[];
-    /** `false` = never expire by time (tag-driven invalidation only). */
-    revalidate: number | false;
-}
-type CacheWrapper = <T>(cb: () => Promise<T>, keyParts: string[], options: CacheWrapperOptions) => () => Promise<T>;
-/** What one cached request stores: the outcome plus its own discovered tags. */
-interface CachedEntry<T> {
-    value: T;
-    /** The Next tag strings discovered at fetch time by the run that wrote this entry. */
-    tags: string[];
-}
-/**
- * Fetch-time tag discovery over `unstable_cache` — the heart of EC-146.
- *
- * The problem: `unstable_cache` fixes an entry's tags when the *wrapper* is
- * created (`options.tags` is validated and **copied** at construction time in
- * Next 15 — mutating the array during the callback does not propagate), but
- * the correct tags are only known *after* the loader resolved the page. So a
- * single wrapper can never both (a) run the loader and (b) store the result
- * under the tags that run discovered.
- *
- * The design ("resolve once, cache with discovered tags, serve cached
- * thereafter") uses two wrapper constructions per request around **one**
- * cache entry:
- *
- * 1. **Probe pass** — a wrapper keyed by `keyParts` whose callback runs the
- *    loader, captures the result + its discovered tags into the closure, and
- *    then throws an internal sentinel.
- *    - Cache **hit**: the stored entry (written by a previous request with
- *      its full discovered tags) is returned; the callback — and therefore
- *      the loader and any backend access — never runs. This is the outage
- *      story: fully cached routes keep serving when the backend is down.
- *    - Cache **miss**: the loader runs exactly once; the sentinel throw
- *      prevents `unstable_cache` from persisting the entry under the
- *      incomplete baseline tags (thrown callbacks cache nothing).
- * 2. **Write pass** (miss only) — a second wrapper is constructed *now that
- *    the tags are known*, with `options.tags` = the discovered set, same key.
- *    Its callback just returns the already-loaded entry, so the backend is
- *    not hit again; `unstable_cache` persists the entry under the full
- *    fetch-time tag set. `revalidateTag` on any of those tags drops the
- *    entry and the next request repeats the cycle with fresh data.
- *
- * The loader runs **once per revalidation cycle** (per key), never once per
- * request. Time-based revalidation is intentionally not exposed, and the reason
- * is a real hazard rather than a preference: a stale-while-revalidate background
- * refresh re-runs the probe callback, whose bail aborts the refresh, so the
- * entry is never rewritten. `revalidate: false` keeps *time* from ever putting
- * an entry into that state — which is the AD-5 model.
- *
- * **What `revalidate: false` does NOT buy (EC-515, measured on Next 16.2.10).**
- * The earlier version of this comment claimed `revalidate: false` made the SWR
- * hazard unreachable. It does not: a **tag** can put an entry into the stale
- * state too, and then exactly the aborted-refresh loop above happens. Whether it
- * does is decided by how the invalidator stamps the tag —
- * `revalidateTag(tag, 'max')` marks entries stale (365-day expiry) and triggers
- * the loop; `revalidateTag(tag, { expire: 0 })` drops them outright and does
- * not. `revalidate.ts` therefore sends `{ expire: 0 }`, and the reasoning lives
- * at that call site. Keep the two in step: this design only survives an
- * invalidation that **drops** the entry, never one that merely staleness-marks
- * it.
- *
- * Concurrency: wrappers and the captured closure are per-request, so there is
- * no cross-request mutation; two racing first requests both resolve and the
- * last write wins (deterministic content ⇒ identical entries).
- *
- * ## ⚠️ Self-hosted hosts: only the BASELINE tags invalidate (EC-515)
- *
- * **Measured on a self-hosted `next start` (Next 16.2.10, default
- * `FileSystemCache`, `.next/cache` on disk); NOT measured on Vercel.**
- *
- * Fetch-time tag discovery writes the entry with the tags the response actually
- * read — but the default self-hosted cache handler decides staleness and expiry
- * from the tags the **reading** wrapper names (`ctx.tags`, see
- * `IncrementalCache.get` / `FileSystemCache.get` for `kind: FETCH`), not from
- * the tags the entry was **stored** with. The stored tag set is only ever used
- * to decide whether to re-write the entry with a superset.
- *
- * Every read in {@link loadCachedEntry} goes through the **probe** wrapper,
- * whose tags are `baselineTags`. So on such a host:
- *
- * - revalidating a tag that is in `baselineTags` works (the route helper passes
- *   the project sweep tag, so `project` sweeps do invalidate);
- * - revalidating a *discovered* `doc:` / `collection:` / `route:` / `asset:` tag
- *   invalidates **nothing** — silently. No error, no log line, no loader run.
- *
- * Measured 2×2 that isolates it (same host, same run): a probe handed the full
- * discovered tag set up front DOES honour a `doc:` tag, and the same probe
- * handed only the baseline does not. So the tags, their formatting and the
- * webhook are all correct — the read simply never consults them.
- *
- * Consequence for a self-hosted deployment: invalidation granularity collapses
- * to whatever is in `baselineTags`. {@link revalidationTags} therefore adds the
- * project sweep to every event that changes live output (EC-579), so instant
- * publish still *works* there, coarsely; its targeted `doc:`/`collection:`/`asset:`
- * tags do not reach a self-hosted host's entries at all. Vercel-hosted deployments
- * are unaffected in practice — both consumer
- * sites were measured healthy on 2026-08-01 — which is consistent with Vercel's
- * cache handler purging by the entry's stored tags, though that has **not** been
- * measured here.
- *
- * Fixing this properly means the read must be able to name the entry's own tags,
- * which no `unstable_cache` API allows without restructuring the probe/bail
- * seam. That is a deliberate open decision — see EC-515, do not "fix" it here
- * incidentally.
- */
-declare function loadCachedEntry<T>(cache: CacheWrapper, keyParts: string[], baselineTags: readonly string[], load: () => Promise<CachedEntry<T>>): Promise<CachedEntry<T>>;
-
 /**
  * Pure request logic of the revalidation webhook receiver (EC-146), kept free of
  * Next.js imports so it is unit-testable. `revalidate.ts` wires it into a route
@@ -1085,20 +1154,12 @@ interface AssetImageLoaderOptions {
  */
 declare function createAssetImageLoader(options?: AssetImageLoaderOptions): ImageLoader;
 /**
- * The `base.Image` implementation for Next.js host apps: same
- * canonical manifest, rendered optimized through {@link ElytraImage}. The
- * renderer resolves an `asset`-typed `src` (EC-195) to `{ url, width, height,
- * alt }` before this runs, so `normalizeImageSource` yields intrinsic dimensions
- * (→ no layout shift, sized variants) whether the editor picked an uploaded asset
- * or pasted a URL. `priority` opts an above-the-fold image out of lazy-loading.
- */
-/**
- * Per-deployment image-delivery options for {@link nextImagePrimitive} (EC-271).
+ * Per-deployment image-delivery options for {@link withNextImage} (EC-271).
  * The default is the host's own Next.js optimizer (Vercel) — zero config. A host
  * on a different CDN supplies its own `loader` (a plain function) to route variants
  * through that CDN instead, without touching component code.
  */
-interface NextImagePrimitiveOptions {
+interface NextImageOptions {
     /**
      * Custom `next/image` loader — the override seam for non-Vercel hosting. Omit
      * for the Vercel default (Next's own `/_next/image` optimizer). Supply a
@@ -1117,31 +1178,35 @@ interface NextImagePrimitiveOptions {
     quality?: number;
 }
 /**
- * Host registration that swaps the `base.Image` implementation
- * for {@link ElytraImage} while keeping the primitive's canonical manifest
- * (the first registration's manifest wins in `defineHostComponents` — by
- * design, so prop schemas stay canonical; the duplicate-id registry issue it
- * reports is the documented override signal, not an error):
+ * Batteries included, opted into (EC-591): return the component list with the
+ * implementation of the component that fills the `image` role swapped for
+ * `next/image` delivery ({@link ElytraImage}) — the manifest is kept, so the
+ * studio and the host still register the same component. Nothing is added to the
+ * list and nothing is registered by the engine: no image-role component in the
+ * list → the list comes back unchanged.
+ *
+ * Which entry fills the role is decided by core's one registration rule (the first
+ * valid claimant — `ComponentRegistry.roleComponent('image')`), so the swap can
+ * never land on a different entry than the one the registry resolves. Use it on
+ * the DELIVERY side only (the studio's canvas runs on Vite, where `next/image`
+ * does not exist) — the scaffold's host seam file does it in one line:
  *
  * ```ts
- * export const hostComponents = defineHostComponents([
- *   nextImagePrimitive(),                       // Vercel default optimizer
- *   // ...project components
- * ])
+ * export const elytra = createElytraHost({ ...site, components: withNextImage(site.components) })
  * ```
  *
- * Pass {@link NextImagePrimitiveOptions} to delegate image delivery to another
- * CDN (EC-271) — the v1 default is Vercel, with room to grow:
+ * Pass {@link NextImageOptions} to delegate image delivery to another CDN
+ * (EC-271) — the v1 default is Vercel, with room to grow:
  *
  * ```ts
- * nextImagePrimitive({ loader: createAssetImageLoader() })       // ?w=&q= CDN
- * nextImagePrimitive({ loader: cloudflareImageLoader })          // Cloudflare Images
+ * withNextImage(site.components, { loader: createAssetImageLoader() })   // ?w=&q= CDN
+ * withNextImage(site.components, { loader: cloudflareImageLoader })      // Cloudflare Images
  * ```
  */
-declare function nextImagePrimitive(options?: NextImagePrimitiveOptions): HostComponent;
+declare function withNextImage(components: readonly HostComponentEntry[] | undefined, options?: NextImageOptions): HostComponentEntry[];
 /** Per-deployment options for {@link elytraHostImage} (the EC-271 loader seam). */
 interface ElytraHostImageOptions {
-    /** Custom `next/image` loader for non-Vercel CDNs (see {@link NextImagePrimitiveOptions}). */
+    /** Custom `next/image` loader for non-Vercel CDNs (see {@link NextImageOptions}). */
     loader?: ImageLoader;
     /** Default quality (1–100) when a call site doesn't set one (Next defaults to 75). */
     quality?: number;
@@ -1366,6 +1431,8 @@ declare function createPreviewDisableRoute(): PreviewRouteHandlers;
  * const route = elytra.canvasRoute()
  * export default route.Page
  * export const generateMetadata = route.generateMetadata
+ * export const generateStaticParams = route.generateStaticParams // only if YOU enable cacheComponents
+ * // (to cache: pass your own 'use cache' function as `published` — see `route.tsx`, EC-620)
  *
  * // app/api/revalidate/route.ts
  * export const { POST } = elytra.revalidateRoute()
@@ -1384,7 +1451,18 @@ declare function createPreviewDisableRoute(): PreviewRouteHandlers;
  * keeps ownership of project config (AD-11), host components, form endpoints,
  * and anything genuinely bespoke.
  */
-interface ElytraHostOptions {
+/**
+ * EC-581 (ratified 2b): the options are generic over the config's `collections`, so a
+ * project declared with `defineCollection` keeps its literal types through the host and
+ * `InferDocument<typeof host, 'post'>` (`@elytracms/core/cms-core`) is a delivered post.
+ */
+interface ElytraHostOptions<Collections extends readonly CollectionDef[] = readonly CollectionDef[]> extends Omit<WorkspaceProjectEntry, 'slug' | 'locales' | 'collections' | 'routes' | 'components' | 'frontendUrl'> {
+    /**
+     * The project's display name (the entry's own `name` — `{ ...site }` carries it).
+     * EC-583: the options ARE the config's project entry plus the host-only keys below,
+     * and the kit resolves them through the one resolver the studio boots through.
+     */
+    name: string;
     /**
      * The project slug (config-as-code identity, mirrors `elytra.config.ts`).
      * Used as the content scope when no live backend is configured.
@@ -1415,14 +1493,17 @@ interface ElytraHostOptions {
      */
     locales: LocaleConfigInput;
     /** CMS collection schema — config-owned (AD-11). */
-    collections: readonly CollectionDef[];
+    collections: Collections;
     /** Routes as code (AD-3/AD-11): records, or the `(collections) => records` derive. */
     routes: readonly RouteRecord[] | ((collections: CollectionDef[]) => RouteRecord[]);
     /**
      * The repo's page-builder components (manifest + implementation pairs — the
-     * SAME modules the studio composes with). Base primitives are always
-     * included; `base.Image` is swapped for `next/image` delivery by default
-     * (see `image`).
+     * SAME list the studio composes with, usually `site.components` via the
+     * `{ ...site }` spread). The host registers exactly this list (EC-591): the
+     * engine adds no components of its own — the shipped ones are the opt-in
+     * `@elytracms/components` package, listed in the config. For `next/image`
+     * delivery of the image-role component, pass the list through
+     * `withNextImage(site.components)` (one line, opt-in).
      *
      * Typed as the CONFIG's `HostComponentEntry` (`implementation: unknown`), not
      * the stricter {@link HostComponent}, so that `createElytraHost({ ...site })`
@@ -1439,7 +1520,7 @@ interface ElytraHostOptions {
      * component. The check is RUNTIME instead — `defineHostComponents` takes the
      * same `HostComponentEntry` shape (no cast, one signature) and tests every
      * implementation on registration; a value that is not a component becomes an
-     * `invalid-implementation` issue in `components.issues` and is withheld from
+     * `invalid-implementation` issue in `components.registry.issues` and is withheld from
      * the implementation map, so its nodes render the visible missing-component
      * fallback rather than crashing the server render. Authoring a component
      * module as the strict {@link HostComponent} keeps the compile-time check at
@@ -1447,14 +1528,9 @@ interface ElytraHostOptions {
      */
     components?: readonly HostComponentEntry[];
     /**
-     * `base.Image` delivery options (loader/sizes/quality — the non-Vercel CDN
-     * seam), or `false` to keep the plain-`<img>` primitive. Default: Next's own
-     * optimizer, registered out of the box.
-     */
-    image?: NextImagePrimitiveOptions | false;
-    /**
-     * The public base URL of the delivery site (mirrors the config's
-     * `frontendUrl`) — exposed on the handle for sitemap/canonical use.
+     * The public base URL of the delivery site (the config's project-level
+     * `frontendUrl`). The handle's {@link ElytraHost.frontendUrl} is the RESOLVED one —
+     * the bound environment's own URL when it declares one (EC-583).
      */
     frontendUrl?: string;
     /**
@@ -1491,17 +1567,18 @@ interface HostCanvasRouteOptions {
      */
     wrap?: (children: ReactNode, ctx: CanvasWrapContext) => ReactNode;
     /**
-     * Tagged data cache (instant publish). Always on and always scoped to the kit's
-     * {@link ElytraHost.contentScope}, with the kit's
-     * {@link ElytraHost.contentMode} in the entry key (EC-543). `false` disables
-     * caching entirely.
+     * The host's cache function for published requests (EC-620 — see
+     * `CanvasRouteOptions.published`): your own `'use cache'` function that calls
+     * `route.resolve(key)`, `route.applyCacheTags(outcome)` and picks its `cacheLife`.
+     * Omit it and the route resolves every request fresh (dynamic, uncached).
      *
-     * There is no scope override (EC-579): the kit's revalidate receiver derives its
-     * tags with that same `contentScope`, so one value scopes both the entries and
-     * their invalidation. An override here was the one way left for the two to
-     * disagree — and a disagreement drops nothing, silently.
+     * The route it builds is always scoped to the kit's {@link ElytraHost.contentScope}
+     * with the kit's {@link ElytraHost.contentMode} in every cache key (EC-543), and
+     * there is no override (EC-579): the kit's revalidate receiver derives its tags with
+     * that same `contentScope`, so one value scopes both the entries and their
+     * invalidation — a disagreement would drop nothing, silently.
      */
-    cache?: false;
+    published?: CanvasRouteOptions['published'];
 }
 interface LoadGlobalsOptions {
     /** Perspective of the chrome read. Default `'published'` (live is published-only). */
@@ -1525,18 +1602,24 @@ interface LoadGlobalsOptions {
  * once, read here, so a host can *say* which world it is in instead of
  * re-deriving it from `env` and drifting.
  *
- * **The mode is also part of the route's data-cache key** (EC-543). A cache
- * entry outlives the process that wrote it and a hit never runs the loader, so
- * until 0.0.85 the "clean 404" above held only on a COLD cache: measured, a
- * `next start` with both env vars blanked and a warm `.next/cache` from a live
- * run answered `200` with the live world's bytes on every cached URL while
- * reporting `empty` — the wrong-world failure EC-527 removed, one layer down.
- * Keyed on the mode (`canvasCacheKey`, `cache.ts`), a world change is a cold
- * miss per URL, never a stale hit, in either direction.
+ * **The mode is also part of the route's cache-entry key** (EC-543; since EC-515
+ * an argument of the cached function). An entry can outlive the world that wrote
+ * it and a hit never runs the loader, so until 0.0.85 the "clean 404" above held
+ * only on a COLD cache: measured, a `next start` with both env vars blanked and a
+ * warm `.next/cache` from a live run answered `200` with the live world's bytes
+ * on every cached URL while reporting `empty` — the wrong-world failure EC-527
+ * removed, one layer down. Keyed on the mode (`canvasCacheKey`, `cache.ts`), a
+ * world change is a cold miss per URL, never a stale hit, in either direction.
  */
 type ElytraContentMode = 'live' | 'fallback' | 'empty';
 /** The delivery host handle {@link createElytraHost} yields. */
-interface ElytraHost {
+interface ElytraHost<Collections extends readonly CollectionDef[] = readonly CollectionDef[]> {
+    /**
+     * The config's collections, as passed (EC-581) — typed by their literals when the
+     * project declares them with `defineCollection`, so `InferDocument<typeof host, 'post'>`
+     * types a delivered post with no generation step.
+     */
+    readonly collections: Collections;
     /**
      * The cache-tag scope: `ELYTRA_PROJECT_ID` in live mode, else the config slug.
      * The ONE scope of this host (EC-579): its cache entries are written under it and
@@ -1552,22 +1635,49 @@ interface ElytraHost {
     contentMode: ElytraContentMode;
     /** The resolved env bag (documented names, trimmed, empty = unset). */
     env: ElytraHostEnv;
-    /** Materialized route records (a derive is run once, at factory time). */
+    /**
+     * The ONE resolved project (EC-583) — the options resolved through
+     * `resolveProject`, the same rules the studio boots through: composed, defaulted,
+     * validation slots normalized, routes materialized, every boot rule applied. The
+     * kit reads its locales, collections, routes and frontend URL from here.
+     */
+    project: ResolvedProject;
+    /**
+     * The project's route issue set at boot (EC-590 — the ONE router's: route conflicts,
+     * mount conflicts, reachability). Surfaced on the console at build and in dev; the
+     * editorial redirects (data) are judged per snapshot by the content client's
+     * `routerIssues` and in the studio.
+     */
+    routeIssues: readonly CmsValidationIssue[];
+    /** Materialized route records (the resolved project's; a derive ran once, at factory time). */
     routes: RouteRecord[];
-    /** The registered component surface (base primitives + image swap + project components). */
+    /** The registered component surface — exactly the `components` option's list (EC-591). */
     components: HostComponents;
-    /** The public base URL of the delivery site, when configured. */
+    /**
+     * The public base URL of the delivery site, when configured — the resolved project's
+     * (`projectFrontendUrl`): the bound environment's own `frontendUrl`, else the
+     * project-level one. The same answer the studio's live links read (EC-583).
+     */
     frontendUrl?: string;
     /**
      * The content loader (the seam every kit surface reads through): live
      * delivery snapshot when env is configured — published, or the token-gated
      * draft for draft-mode requests — else the fallback source.
+     *
+     * An UNCACHED read: the kit caches nothing itself (EC-620 — caching is the host's).
+     * Under `cacheComponents`, live-mode I/O in a layout or page outside `<Suspense>` fails
+     * `next build` — call it inside a `<Suspense>`'d component (route handlers and
+     * `sitemap.ts` just render dynamically).
      */
     loadContent(request: CanvasContentRequest): Promise<ContentSource>;
     /**
      * Load + resolve the site-chrome globals (settings singleton, navigation by
      * slot alias, link/asset resolution — see `host-globals.ts`). One content
      * load per call; published perspective by default.
+     *
+     * An UNCACHED read, like {@link loadContent}: under `cacheComponents`, render the
+     * chrome that awaits it inside `<Suspense>` — and keep the canvas page OUTSIDE
+     * every boundary, or its 404s and redirects answer HTTP 200 (measured, EC-515).
      */
     loadGlobals(options?: LoadGlobalsOptions): Promise<SiteGlobals>;
     /** The catch-all canvas route pair for `app/[[...slug]]/page.tsx`. */
@@ -1592,12 +1702,13 @@ interface ElytraHost {
     /**
      * Does the page for this catch-all `slug` OPEN full-bleed? Manifest-driven
      * (`presentation.fullBleed`, EC-368) and draft-mode aware — the host lays out
-     * header clearance from data instead of a hand-kept component-id set.
+     * header clearance from data instead of a hand-kept component-id set. An
+     * uncached read (see {@link loadContent}).
      */
     pageOpensFullBleed(slug: readonly string[] | undefined): Promise<boolean>;
 }
 /** Create the delivery host handle — see the module docs for the full wiring. */
-declare function createElytraHost(options: ElytraHostOptions): ElytraHost;
+declare function createElytraHost<const Collections extends readonly CollectionDef[]>(options: ElytraHostOptions<Collections>): ElytraHost<Collections>;
 
 /**
  * The LIVE half of the delivery host kit (EC-368): fetch the delivery snapshot
@@ -1616,10 +1727,10 @@ declare function createElytraHost(options: ElytraHostOptions): ElytraHost;
  * `DRAFT_PREVIEW_TOKEN` — the same single secret that gates the kit's
  * preview-enable route (see `host-env.ts`).
  *
- * Routes: config-sourced route records (AD-3/AD-11, EC-207 — the host repo's
- * own `cms/`, passed via options) and the implicit per-locale home fallback are
- * MERGED (EC-177 gap 2), never XOR'd — config records win per pattern+locale.
- * The backend never carries route data.
+ * Routes: the config's route records (AD-3/AD-11, EC-207), exactly as resolved —
+ * the backend never carries route data, and the engine derives none (EC-590: the
+ * implicit "`/` → the lowest-id `page`" home fallback is gone with every other
+ * engine-dictated name; a project declares its `/`, the scaffold ships one).
  */
 interface LiveContentOptions {
     /** Convex deployment URL, e.g. `https://your-deployment-123.convex.cloud`. */
@@ -1632,7 +1743,7 @@ interface LiveContentOptions {
     locales: LocaleConfigInput;
     /** CMS collection schema — config-owned (AD-11); drives depth-1 relation population. */
     collections: readonly CollectionDef[];
-    /** Route records — config-owned (AD-3/AD-11); merged with the home fallback. */
+    /** Route records — config-owned (AD-3/AD-11), the resolved project's. */
     routes: readonly RouteRecord[];
     /** `DRAFT_PREVIEW_TOKEN` — required for draft-perspective loads. */
     draftToken?: string;
@@ -1652,7 +1763,6 @@ interface DeliverySnapshotPayload {
     documents: unknown[];
     assets: unknown[];
 }
-
 /**
  * Assemble a fetched delivery-snapshot payload into a `ContentSource` — the
  * pure half of {@link loadLiveContent}, exported so the parsing/assembly rules
@@ -1754,4 +1864,4 @@ declare function evaluatePreviewRequest(requestUrl: string | URL, expectedToken:
  */
 declare const PACKAGE = "@elytracms/next";
 
-export { type AssetImageLoaderOptions, type CacheWrapper, type CacheWrapperOptions, type CachedEntry, type CanvasCacheOptions, type CanvasContentRequest, type CanvasPageOutcome, CanvasRenderer, type CanvasRendererProps, type CanvasRequestInfo, type CanvasRoute, type CanvasRouteOptions, type CanvasRouteProps, type CanvasSitemapOptions, type CanvasSitemapResult, type CanvasWrapContext, type ContentSnapshot, type ContentSnapshotOptions, type ContentSource, type CreateCanvasSitemapOptions, type DefineHostComponentsOptions, type DeliveryPresentation, ELYTRA_HOST_ENV_KEYS, type ElytraContentMode, type ElytraHost, type ElytraHostEnv, type ElytraHostImageOptions, type ElytraHostOptions, ElytraImage, type ElytraImageAsset, type ElytraImageProps, type GlobalsConventions, type HostCanvasRouteOptions, type HostComponent, type HostComponents, type LiveContentOptions, type LoadGlobalsOptions, type NextImagePrimitiveOptions, PACKAGE, type PreviewEvaluation, type PreviewRouteHandlers, type PreviewRouteOptions, type ResolveCanvasPageOptions, type ResolveGlobalsOptions, type ResolvedLink, type ResolvedNavEntry, type ResolvedNavLink, type RevalidateEvaluation, type RevalidateRouteHandlers, type RevalidateRouteOptions, type RevalidationProject, type SiteGlobals, type SitemapParamsProvider, type SitemapRouteContext, type SitemapSkippedRoute, type StaticContentData, assembleLiveSource, bodyItemsOf, canvasPageMetadata, canvasSitemapEntries, collectionCacheTag, createAssetImageLoader, createCanvasRoute, createCanvasSitemap, createContentSnapshot, createElytraHost, createPreviewDisableRoute, createPreviewRoute, createRevalidateRoute, createStaticContentSource, defineHostComponents, docCacheTag, elytraHostImage, evaluatePreviewRequest, evaluateRevalidateRequest, firstBlockFullBleed, loadCachedEntry, loadLiveContent, mergeCacheTags, mergeMetadataOverParent, nextCacheTags, nextImagePrimitive, openGraphLocale, pathFromSlug, projectSweepTag, resolveCanvasPage, resolveGlobals, resolveHostEnv, revalidationTags, routeCacheTag, safeRedirectTarget, scopeCacheTag };
+export { type AssetImageLoaderOptions, type BakedListing, CANVAS_VALIDATION_SLUG, type CanvasCacheKey, type CanvasContentRequest, type CanvasPageOutcome, CanvasRenderer, type CanvasRendererProps, type CanvasRequestInfo, type CanvasRoute, type CanvasRouteOptions, type CanvasRouteProps, type CanvasSitemapOptions, type CanvasSitemapResult, type CanvasWrapContext, type ContentSnapshot, type ContentSnapshotOptions, type ContentSource, type CreateCanvasSitemapOptions, type DeliveryPresentation, ELYTRA_HOST_ENV_KEYS, type ElytraContentMode, type ElytraHost, type ElytraHostEnv, type ElytraHostImageOptions, type ElytraHostOptions, ElytraImage, type ElytraImageAsset, type ElytraImageProps, type GlobalsConventions, type HostCanvasRouteOptions, type HostComponent, type HostComponents, type LiveContentOptions, type LoadGlobalsOptions, type NextImageOptions, PACKAGE, type PreviewEvaluation, type PreviewRouteHandlers, type PreviewRouteOptions, type ResolveCanvasPageOptions, type ResolveGlobalsOptions, type ResolvedLink, type ResolvedNavEntry, type ResolvedNavLink, type RevalidateEvaluation, type RevalidateRouteHandlers, type RevalidateRouteOptions, type RevalidationProject, type SeoMetadataContext, type SiteGlobals, type SitemapSkippedRoute, type StaticContentData, assembleLiveSource, bodyItemsOf, canvasSitemapEntries, collectionCacheTag, createAssetImageLoader, createCanvasRoute, createCanvasSitemap, createContentSnapshot, createElytraHost, createPreviewDisableRoute, createPreviewRoute, createRevalidateRoute, createStaticContentSource, defineHostComponents, docCacheTag, elytraHostImage, evaluatePreviewRequest, evaluateRevalidateRequest, firstBlockFullBleed, loadLiveContent, mergeCacheTags, mergeMetadataOverParent, nextCacheTags, openGraphLocale, pathFromSlug, projectSweepTag, requestPerspective, resolveCanvasPage, resolveGlobals, resolveHostEnv, revalidationTags, routeCacheTag, safeRedirectTarget, scopeCacheTag, seoContextOf, seoMetadata, seoObjectOf, withNextImage };