@hollware/core 0.9.1 → 0.11.0

package/dist/index.d.mts

@@ -315,11 +315,18 @@ interface SiteDefinition {
       /** The Worker secret that signs; Hollware's own sealed one when it is left out. */
       readonly secret?: string;
     }[];
-    /** Tells IndexNow the URLs that changed; `key` names the Worker secret with the key. */
+    /** Tells IndexNow the URLs that changed; `key` is the key itself, which is public. */
     readonly indexNow?: {
       readonly key: string;
     };
   };
+  /** What the site's activity log keeps (ADR-037): no addresses, and forever, by default. */
+  readonly audit?: {
+    /** `hashed` keeps a keyed hash of the address of each request; `off` keeps nothing of it. */
+    readonly ipAddresses?: 'off' | 'hashed';
+    /** How many days a line is kept, 30 to 3650; `null` keeps the log as long as the site. */
+    readonly retentionDays?: number | null;
+  };
 }
 /** What `hollware.config.ts` exports. */
 interface HollwareConfig {
@@ -369,6 +376,12 @@ interface ResolvedSite {
     readonly origins: readonly string[];
   };
   readonly events: ResolvedEvents;
+  readonly audit: ResolvedAudit;
+}
+/** What the activity log of a site keeps (ADR-037). */
+interface ResolvedAudit {
+  readonly ipAddresses: 'off' | 'hashed';
+  readonly retentionDays: number | null;
 }
 /**
  * A webhook of a site. `secret` names the Worker secret that signs its deliveries; `null` when the
@@ -442,6 +455,22 @@ export declare class ConfigError extends Error {
   constructor(problems: readonly ConfigProblem[]);
 }
 //#endregion
+//#region src/config/events.d.ts
+/**
+ * An IndexNow key, which is public by design (search engines fetch it at `/<key>.txt`): the
+ * definition holds the key itself, never the name of a Worker secret, so no value of the Worker
+ * can be sent to IndexNow (T-69 of docs/security/threat-model.md).
+ */
+export declare const INDEXNOW_KEY: RegExp;
+//#endregion
+//#region src/config/audit.d.ts
+/** The fewest days a site may keep its activity log for, when it sets a retention (ADR-037). */
+export declare const AUDIT_RETENTION_MIN_DAYS = 30;
+/** The most days a retention may be: ten years. Beyond that, keep it with no retention. */
+export declare const AUDIT_RETENTION_MAX_DAYS = 3650;
+/** What a site that says nothing keeps: no addresses, and the log for as long as the site exists. */
+export declare const DEFAULT_AUDIT: ResolvedAudit;
+//#endregion
 //#region src/config/constants.d.ts
 /** The largest Markdown file a collection accepts when its config does not say, 512 KiB. */
 export declare const DEFAULT_MAX_MARKDOWN_BYTES = 524288;
@@ -541,6 +570,7 @@ declare const entrySummary: z.ZodObject<{
   hasUnpublishedChanges: z.ZodBoolean;
   publishedAt: z.ZodNullable<z.ZodString>;
   scheduledAt: z.ZodNullable<z.ZodString>;
+  deletedAt: z.ZodNullable<z.ZodString>;
   updatedAt: z.ZodString;
 }, z.core.$strip>;
 declare const publication: z.ZodObject<{
@@ -604,6 +634,7 @@ declare const entry: z.ZodObject<{
   hasUnpublishedChanges: z.ZodBoolean;
   publishedAt: z.ZodNullable<z.ZodString>;
   scheduledAt: z.ZodNullable<z.ZodString>;
+  deletedAt: z.ZodNullable<z.ZodString>;
   updatedAt: z.ZodString;
   revision: z.ZodString;
   verdict: z.ZodObject<{
@@ -1114,6 +1145,34 @@ export declare const SITE_KEY_MAX_LENGTH = 64;
 /** Whether a value is a site key: a string that fits `SITE_KEY_PATTERN` and is not too long. */
 export declare function isSiteKey(value: unknown): value is string;
 //#endregion
+//#region src/audit/index.d.ts
+/**
+ * The actions of the activity log (ADR-037). A line names one of these, and nothing else: a new
+ * operation or route that changes something is not logged until it is named here.
+ */
+/** Every operation that is not a read: each call of one is a line, whatever its outcome. */
+export declare const OPERATION_AUDIT_ACTIONS: readonly ['create_draft', 'update_draft', 'publish', 'unpublish', 'delete_entry', 'restore_entry', 'approve_review', 'request_review', 'comment_review', 'request_changes', 'update_site', 'set_collection', 'create_site', 'delete_site', 'restore_site', 'make_webhook_secret'];
+/** What people do outside the operations: their tokens, members, passkeys, sessions and apps. */
+export declare const IDENTITY_AUDIT_ACTIONS: readonly ['token.create',
+/** A person asked for a link that shows an entry's latest revision on the site (T-103). */
+'preview.create', 'token.revoke', 'member.role', 'member.remove', 'invitation.create', 'invitation.accept', 'session.sign_in', 'session.sign_out', 'session.end_all', 'passkey.remove', 'app.allow', 'app.revoke',
+/** A refresh token was used again after it was spent, so its grant was revoked (T-34). */
+'app.refresh_reused',
+/** The cron published an entry whose time had come, for the person who scheduled it. */
+'schedule.publish'];
+export declare const AUDIT_ACTIONS: readonly ["create_draft", "update_draft", "publish", "unpublish", "delete_entry", "restore_entry", "approve_review", "request_review", "comment_review", "request_changes", "update_site", "set_collection", "create_site", "delete_site", "restore_site", "make_webhook_secret", "token.create", "preview.create", "token.revoke", "member.role", "member.remove", "invitation.create", "invitation.accept", "session.sign_in", "session.sign_out", "session.end_all", "passkey.remove", "app.allow", "app.revoke", "app.refresh_reused", "schedule.publish"];
+export type AuditAction = (typeof AUDIT_ACTIONS)[number];
+/** `denied`: a scope or a role was missing; `failed`: any other error the caller got. */
+export declare const AUDIT_OUTCOMES: readonly ['ok', 'denied', 'failed'];
+export type AuditOutcome = (typeof AUDIT_OUTCOMES)[number];
+/**
+ * Who acted: a person in the admin, a personal token, an app a person allowed through OAuth, or
+ * the deployment itself (its cron).
+ */
+export declare const AUDIT_ACTOR_KINDS: readonly ['user', 'token', 'oauth_client', 'system'];
+export type AuditActorKind = (typeof AUDIT_ACTOR_KINDS)[number];
+export declare function isAuditAction(value: string): value is AuditAction;
+//#endregion
 //#region src/structure/compile.d.ts
 /** The definitions of the sites, read from D1 as JSON, checked and resolved. */
 export declare function compileSites(definitions: Readonly<Record<string, unknown>>): ResolvedConfig;
@@ -1179,6 +1238,13 @@ export declare const siteDefinitionData: z.ZodObject<{
       key: z.ZodString;
     }, z.core.$strict>>>;
   }, z.core.$strict>>;
+  audit: z.ZodDefault<z.ZodObject<{
+    ipAddresses: z.ZodDefault<z.ZodEnum<{
+      hashed: "hashed";
+      off: "off";
+    }>>;
+    retentionDays: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+  }, z.core.$strict>>;
   collections: z.ZodRecord<z.ZodString, z.ZodObject<{
     schema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     routes: z.ZodRecord<z.ZodString, z.ZodString>;
@@ -1253,6 +1319,8 @@ export declare const ERROR_CODES: readonly [
 'unknown_collection',
 /** The input names a locale the site does not have. */
 'unknown_locale',
+/** A preview link that has expired, or is not one Hollware made for this site (T-103). */
+'invalid_preview',
 /** The token lacks a scope the operation requires; the message names every missing scope. */
 'insufficient_scope',
 /** The answer would exceed the output cap. Hollware never truncates content. */
@@ -1283,6 +1351,7 @@ export declare class HollwareError extends Error {
  */
 /** The kinds of ids and their prefixes. A new kind adds its prefix here. */
 export declare const ID_PREFIXES: {
+  readonly auditLine: 'aud';
   readonly challenge: 'chl';
   readonly delivery: 'dlv';
   readonly embedding: 'emb';
@@ -1454,6 +1523,7 @@ export declare const listEntries: OperationSpec<"list_entries", z.ZodObject<{
     published: "published";
     scheduled: "scheduled";
   }>>;
+  trashed: z.ZodOptional<z.ZodBoolean>;
   limit: z.ZodDefault<z.ZodNumber>;
   cursor: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>, z.ZodObject<{
@@ -1477,6 +1547,7 @@ export declare const listEntries: OperationSpec<"list_entries", z.ZodObject<{
     hasUnpublishedChanges: z.ZodBoolean;
     publishedAt: z.ZodNullable<z.ZodString>;
     scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
     updatedAt: z.ZodString;
   }, z.core.$strip>>;
   nextCursor: z.ZodNullable<z.ZodString>;
@@ -1518,6 +1589,7 @@ export declare const search: OperationSpec<"search", z.ZodObject<{
       hasUnpublishedChanges: z.ZodBoolean;
       publishedAt: z.ZodNullable<z.ZodString>;
       scheduledAt: z.ZodNullable<z.ZodString>;
+      deletedAt: z.ZodNullable<z.ZodString>;
       updatedAt: z.ZodString;
     }, z.core.$strip>;
     snippet: z.ZodString;
@@ -1557,6 +1629,7 @@ export declare const getEntry: OperationSpec<"get_entry", z.ZodObject<{
     hasUnpublishedChanges: z.ZodBoolean;
     publishedAt: z.ZodNullable<z.ZodString>;
     scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
     updatedAt: z.ZodString;
     revision: z.ZodString;
     verdict: z.ZodObject<{
@@ -1652,6 +1725,7 @@ export declare const getEntry: OperationSpec<"get_entry", z.ZodObject<{
     hasUnpublishedChanges: z.ZodBoolean;
     publishedAt: z.ZodNullable<z.ZodString>;
     scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
     updatedAt: z.ZodString;
   }, z.core.$strip>>>;
 }, z.core.$strip>>;
@@ -1680,6 +1754,7 @@ export declare const getTranslations: OperationSpec<"get_translations", z.ZodObj
     hasUnpublishedChanges: z.ZodBoolean;
     publishedAt: z.ZodNullable<z.ZodString>;
     scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
     updatedAt: z.ZodString;
   }, z.core.$strip>>>;
 }, z.core.$strip>>;
@@ -1690,6 +1765,7 @@ export declare const createDraft: OperationSpec<"create_draft", z.ZodObject<{
   markdown: z.ZodString;
 }, z.core.$strict>, z.ZodObject<{
   outcome: z.ZodEnum<{
+    in_trash: "in_trash";
     refused: "refused";
     saved: "saved";
   }>;
@@ -1710,6 +1786,7 @@ export declare const createDraft: OperationSpec<"create_draft", z.ZodObject<{
     hasUnpublishedChanges: z.ZodBoolean;
     publishedAt: z.ZodNullable<z.ZodString>;
     scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
     updatedAt: z.ZodString;
   }, z.core.$strip>>;
   verdict: z.ZodOptional<z.ZodObject<{
@@ -1772,6 +1849,7 @@ export declare const updateDraft: OperationSpec<"update_draft", z.ZodObject<{
     hasUnpublishedChanges: z.ZodBoolean;
     publishedAt: z.ZodNullable<z.ZodString>;
     scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
     updatedAt: z.ZodString;
   }, z.core.$strip>>;
   verdict: z.ZodOptional<z.ZodObject<{
@@ -1888,6 +1966,7 @@ export declare const publish: OperationSpec<"publish", z.ZodObject<{
     hasUnpublishedChanges: z.ZodBoolean;
     publishedAt: z.ZodNullable<z.ZodString>;
     scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
     updatedAt: z.ZodString;
   }, z.core.$strip>>;
   verdict: z.ZodOptional<z.ZodObject<{
@@ -1967,6 +2046,71 @@ export declare const unpublish: OperationSpec<"unpublish", z.ZodObject<{
     hasUnpublishedChanges: z.ZodBoolean;
     publishedAt: z.ZodNullable<z.ZodString>;
     scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
+    updatedAt: z.ZodString;
+  }, z.core.$strip>>;
+}, z.core.$strip>>;
+export declare const deleteEntry: OperationSpec<"delete_entry", z.ZodObject<{
+  id: z.ZodString;
+  version: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+  outcome: z.ZodEnum<{
+    conflict: "conflict";
+    not_found: "not_found";
+    published: "published";
+    trashed: "trashed";
+  }>;
+  entry: z.ZodOptional<z.ZodObject<{
+    id: z.ZodString;
+    collection: z.ZodString;
+    locale: z.ZodString;
+    slug: z.ZodString;
+    translationGroup: z.ZodNullable<z.ZodString>;
+    status: z.ZodEnum<{
+      draft: "draft";
+      published: "published";
+      scheduled: "scheduled";
+    }>;
+    version: z.ZodNumber;
+    frontmatter: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    tags: z.ZodArray<z.ZodString>;
+    hasUnpublishedChanges: z.ZodBoolean;
+    publishedAt: z.ZodNullable<z.ZodString>;
+    scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
+    updatedAt: z.ZodString;
+  }, z.core.$strip>>;
+  conflict: z.ZodOptional<z.ZodObject<{
+    currentVersion: z.ZodNumber;
+    headRevision: z.ZodString;
+  }, z.core.$strip>>;
+}, z.core.$strip>>;
+export declare const restoreEntry: OperationSpec<"restore_entry", z.ZodObject<{
+  id: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+  outcome: z.ZodEnum<{
+    not_found: "not_found";
+    not_trashed: "not_trashed";
+    restored: "restored";
+  }>;
+  entry: z.ZodOptional<z.ZodObject<{
+    id: z.ZodString;
+    collection: z.ZodString;
+    locale: z.ZodString;
+    slug: z.ZodString;
+    translationGroup: z.ZodNullable<z.ZodString>;
+    status: z.ZodEnum<{
+      draft: "draft";
+      published: "published";
+      scheduled: "scheduled";
+    }>;
+    version: z.ZodNumber;
+    frontmatter: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    tags: z.ZodArray<z.ZodString>;
+    hasUnpublishedChanges: z.ZodBoolean;
+    publishedAt: z.ZodNullable<z.ZodString>;
+    scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
     updatedAt: z.ZodString;
   }, z.core.$strip>>;
 }, z.core.$strip>>;
@@ -2015,6 +2159,7 @@ export declare const listReviews: OperationSpec<"list_reviews", z.ZodObject<{
       hasUnpublishedChanges: z.ZodBoolean;
       publishedAt: z.ZodNullable<z.ZodString>;
       scheduledAt: z.ZodNullable<z.ZodString>;
+      deletedAt: z.ZodNullable<z.ZodString>;
       updatedAt: z.ZodString;
     }, z.core.$strip>;
     comments: z.ZodArray<z.ZodObject<{
@@ -2075,6 +2220,7 @@ export declare const approveReview: OperationSpec<"approve_review", z.ZodObject<
     hasUnpublishedChanges: z.ZodBoolean;
     publishedAt: z.ZodNullable<z.ZodString>;
     scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
     updatedAt: z.ZodString;
   }, z.core.$strip>>;
   verdict: z.ZodOptional<z.ZodObject<{
@@ -2140,6 +2286,7 @@ export declare const requestReview: OperationSpec<"request_review", z.ZodObject<
     hasUnpublishedChanges: z.ZodBoolean;
     publishedAt: z.ZodNullable<z.ZodString>;
     scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
     updatedAt: z.ZodString;
   }, z.core.$strip>>;
   verdict: z.ZodOptional<z.ZodObject<{
@@ -2268,6 +2415,7 @@ export declare const contentStats: OperationSpec<"content_stats", z.ZodObject<{
       hasUnpublishedChanges: z.ZodBoolean;
       publishedAt: z.ZodNullable<z.ZodString>;
       scheduledAt: z.ZodNullable<z.ZodString>;
+      deletedAt: z.ZodNullable<z.ZodString>;
       updatedAt: z.ZodString;
     }, z.core.$strip>>;
   }, z.core.$strip>>>;
@@ -2321,6 +2469,7 @@ export declare const OPERATIONS: readonly [OperationSpec<"approve_review", z.Zod
     hasUnpublishedChanges: z.ZodBoolean;
     publishedAt: z.ZodNullable<z.ZodString>;
     scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
     updatedAt: z.ZodString;
   }, z.core.$strip>>;
   verdict: z.ZodOptional<z.ZodObject<{
@@ -2399,6 +2548,7 @@ export declare const OPERATIONS: readonly [OperationSpec<"approve_review", z.Zod
       hasUnpublishedChanges: z.ZodBoolean;
       publishedAt: z.ZodNullable<z.ZodString>;
       scheduledAt: z.ZodNullable<z.ZodString>;
+      deletedAt: z.ZodNullable<z.ZodString>;
       updatedAt: z.ZodString;
     }, z.core.$strip>>;
   }, z.core.$strip>>>;
@@ -2409,6 +2559,7 @@ export declare const OPERATIONS: readonly [OperationSpec<"approve_review", z.Zod
   markdown: z.ZodString;
 }, z.core.$strict>, z.ZodObject<{
   outcome: z.ZodEnum<{
+    in_trash: "in_trash";
     refused: "refused";
     saved: "saved";
   }>;
@@ -2429,6 +2580,7 @@ export declare const OPERATIONS: readonly [OperationSpec<"approve_review", z.Zod
     hasUnpublishedChanges: z.ZodBoolean;
     publishedAt: z.ZodNullable<z.ZodString>;
     scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
     updatedAt: z.ZodString;
   }, z.core.$strip>>;
   verdict: z.ZodOptional<z.ZodObject<{
@@ -2481,6 +2633,13 @@ export declare const OPERATIONS: readonly [OperationSpec<"approve_review", z.Zod
         key: z.ZodString;
       }, z.core.$strict>>>;
     }, z.core.$strict>>;
+    audit: z.ZodDefault<z.ZodObject<{
+      ipAddresses: z.ZodDefault<z.ZodEnum<{
+        hashed: "hashed";
+        off: "off";
+      }>>;
+      retentionDays: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+    }, z.core.$strict>>;
     collections: z.ZodRecord<z.ZodString, z.ZodObject<{
       schema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
       routes: z.ZodRecord<z.ZodString, z.ZodString>;
@@ -2517,6 +2676,40 @@ export declare const OPERATIONS: readonly [OperationSpec<"approve_review", z.Zod
     message: z.ZodString;
     fix: z.ZodString;
   }, z.core.$strip>>>;
+}, z.core.$strip>>, OperationSpec<"delete_entry", z.ZodObject<{
+  id: z.ZodString;
+  version: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+  outcome: z.ZodEnum<{
+    conflict: "conflict";
+    not_found: "not_found";
+    published: "published";
+    trashed: "trashed";
+  }>;
+  entry: z.ZodOptional<z.ZodObject<{
+    id: z.ZodString;
+    collection: z.ZodString;
+    locale: z.ZodString;
+    slug: z.ZodString;
+    translationGroup: z.ZodNullable<z.ZodString>;
+    status: z.ZodEnum<{
+      draft: "draft";
+      published: "published";
+      scheduled: "scheduled";
+    }>;
+    version: z.ZodNumber;
+    frontmatter: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    tags: z.ZodArray<z.ZodString>;
+    hasUnpublishedChanges: z.ZodBoolean;
+    publishedAt: z.ZodNullable<z.ZodString>;
+    scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
+    updatedAt: z.ZodString;
+  }, z.core.$strip>>;
+  conflict: z.ZodOptional<z.ZodObject<{
+    currentVersion: z.ZodNumber;
+    headRevision: z.ZodString;
+  }, z.core.$strip>>;
 }, z.core.$strip>>, OperationSpec<"delete_site", z.ZodObject<{
   key: z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
   confirm: z.ZodDefault<z.ZodBoolean>;
@@ -2599,6 +2792,7 @@ export declare const OPERATIONS: readonly [OperationSpec<"approve_review", z.Zod
     hasUnpublishedChanges: z.ZodBoolean;
     publishedAt: z.ZodNullable<z.ZodString>;
     scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
     updatedAt: z.ZodString;
     revision: z.ZodString;
     verdict: z.ZodObject<{
@@ -2694,6 +2888,7 @@ export declare const OPERATIONS: readonly [OperationSpec<"approve_review", z.Zod
     hasUnpublishedChanges: z.ZodBoolean;
     publishedAt: z.ZodNullable<z.ZodString>;
     scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
     updatedAt: z.ZodString;
   }, z.core.$strip>>>;
 }, z.core.$strip>>, OperationSpec<"get_structure", z.ZodObject<{}, z.core.$strict>, z.ZodObject<{
@@ -2720,6 +2915,13 @@ export declare const OPERATIONS: readonly [OperationSpec<"approve_review", z.Zod
         key: z.ZodString;
       }, z.core.$strict>>>;
     }, z.core.$strict>>;
+    audit: z.ZodDefault<z.ZodObject<{
+      ipAddresses: z.ZodDefault<z.ZodEnum<{
+        hashed: "hashed";
+        off: "off";
+      }>>;
+      retentionDays: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+    }, z.core.$strict>>;
     collections: z.ZodRecord<z.ZodString, z.ZodObject<{
       schema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
       routes: z.ZodRecord<z.ZodString, z.ZodString>;
@@ -2774,6 +2976,7 @@ export declare const OPERATIONS: readonly [OperationSpec<"approve_review", z.Zod
     hasUnpublishedChanges: z.ZodBoolean;
     publishedAt: z.ZodNullable<z.ZodString>;
     scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
     updatedAt: z.ZodString;
   }, z.core.$strip>>>;
 }, z.core.$strip>>, OperationSpec<"list_entries", z.ZodObject<{
@@ -2785,6 +2988,7 @@ export declare const OPERATIONS: readonly [OperationSpec<"approve_review", z.Zod
     published: "published";
     scheduled: "scheduled";
   }>>;
+  trashed: z.ZodOptional<z.ZodBoolean>;
   limit: z.ZodDefault<z.ZodNumber>;
   cursor: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>, z.ZodObject<{
@@ -2808,6 +3012,7 @@ export declare const OPERATIONS: readonly [OperationSpec<"approve_review", z.Zod
     hasUnpublishedChanges: z.ZodBoolean;
     publishedAt: z.ZodNullable<z.ZodString>;
     scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
     updatedAt: z.ZodString;
   }, z.core.$strip>>;
   nextCursor: z.ZodNullable<z.ZodString>;
@@ -2856,6 +3061,7 @@ export declare const OPERATIONS: readonly [OperationSpec<"approve_review", z.Zod
       hasUnpublishedChanges: z.ZodBoolean;
       publishedAt: z.ZodNullable<z.ZodString>;
       scheduledAt: z.ZodNullable<z.ZodString>;
+      deletedAt: z.ZodNullable<z.ZodString>;
       updatedAt: z.ZodString;
     }, z.core.$strip>;
     comments: z.ZodArray<z.ZodObject<{
@@ -2915,6 +3121,7 @@ export declare const OPERATIONS: readonly [OperationSpec<"approve_review", z.Zod
     hasUnpublishedChanges: z.ZodBoolean;
     publishedAt: z.ZodNullable<z.ZodString>;
     scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
     updatedAt: z.ZodString;
   }, z.core.$strip>>;
   verdict: z.ZodOptional<z.ZodObject<{
@@ -3027,6 +3234,7 @@ export declare const OPERATIONS: readonly [OperationSpec<"approve_review", z.Zod
     hasUnpublishedChanges: z.ZodBoolean;
     publishedAt: z.ZodNullable<z.ZodString>;
     scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
     updatedAt: z.ZodString;
   }, z.core.$strip>>;
   verdict: z.ZodOptional<z.ZodObject<{
@@ -3080,6 +3288,34 @@ export declare const OPERATIONS: readonly [OperationSpec<"approve_review", z.Zod
     decidedAt: z.ZodNullable<z.ZodString>;
     note: z.ZodNullable<z.ZodString>;
   }, z.core.$strip>>;
+}, z.core.$strip>>, OperationSpec<"restore_entry", z.ZodObject<{
+  id: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+  outcome: z.ZodEnum<{
+    not_found: "not_found";
+    not_trashed: "not_trashed";
+    restored: "restored";
+  }>;
+  entry: z.ZodOptional<z.ZodObject<{
+    id: z.ZodString;
+    collection: z.ZodString;
+    locale: z.ZodString;
+    slug: z.ZodString;
+    translationGroup: z.ZodNullable<z.ZodString>;
+    status: z.ZodEnum<{
+      draft: "draft";
+      published: "published";
+      scheduled: "scheduled";
+    }>;
+    version: z.ZodNumber;
+    frontmatter: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    tags: z.ZodArray<z.ZodString>;
+    hasUnpublishedChanges: z.ZodBoolean;
+    publishedAt: z.ZodNullable<z.ZodString>;
+    scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
+    updatedAt: z.ZodString;
+  }, z.core.$strip>>;
 }, z.core.$strip>>, OperationSpec<"restore_site", z.ZodObject<{
   key: z.ZodString & z.ZodType<string, string, z.core.$ZodTypeInternals<string, string>>;
 }, z.core.$strict>, z.ZodObject<{
@@ -3124,6 +3360,7 @@ export declare const OPERATIONS: readonly [OperationSpec<"approve_review", z.Zod
       hasUnpublishedChanges: z.ZodBoolean;
       publishedAt: z.ZodNullable<z.ZodString>;
       scheduledAt: z.ZodNullable<z.ZodString>;
+      deletedAt: z.ZodNullable<z.ZodString>;
       updatedAt: z.ZodString;
     }, z.core.$strip>;
     snippet: z.ZodString;
@@ -3210,6 +3447,7 @@ export declare const OPERATIONS: readonly [OperationSpec<"approve_review", z.Zod
     hasUnpublishedChanges: z.ZodBoolean;
     publishedAt: z.ZodNullable<z.ZodString>;
     scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
     updatedAt: z.ZodString;
   }, z.core.$strip>>;
 }, z.core.$strip>>, OperationSpec<"update_draft", z.ZodObject<{
@@ -3241,6 +3479,7 @@ export declare const OPERATIONS: readonly [OperationSpec<"approve_review", z.Zod
     hasUnpublishedChanges: z.ZodBoolean;
     publishedAt: z.ZodNullable<z.ZodString>;
     scheduledAt: z.ZodNullable<z.ZodString>;
+    deletedAt: z.ZodNullable<z.ZodString>;
     updatedAt: z.ZodString;
   }, z.core.$strip>>;
   verdict: z.ZodOptional<z.ZodObject<{
@@ -3297,6 +3536,13 @@ export declare const OPERATIONS: readonly [OperationSpec<"approve_review", z.Zod
         key: z.ZodString;
       }, z.core.$strict>>>;
     }, z.core.$strict>>;
+    audit: z.ZodDefault<z.ZodObject<{
+      ipAddresses: z.ZodDefault<z.ZodEnum<{
+        hashed: "hashed";
+        off: "off";
+      }>>;
+      retentionDays: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+    }, z.core.$strict>>;
     collections: z.ZodRecord<z.ZodString, z.ZodObject<{
       schema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
       routes: z.ZodRecord<z.ZodString, z.ZodString>;
@@ -3449,13 +3695,140 @@ export interface WebhookCheck {
   /** Now, in seconds since the epoch; the system clock when absent. */
   readonly now?: number;
   readonly toleranceSeconds?: number;
+  /**
+   * Whether the receiver sees this event for the first time, given its id, and records it (T-67):
+   * a request captured and sent again within the tolerance is then refused. The id is read from
+   * the signed body, never from `hollware-event-id`, which no signature covers. A retry of a
+   * delivery carries the same id, so a receiver that records an id only once it has handled the
+   * event lets a failed delivery be retried. Keep each id for longer than the tolerance.
+   */
+  readonly isNew?: (eventId: string) => boolean | Promise<boolean>;
 }
 /**
  * Whether a request is a webhook of Hollware: its signature matches the body and the secret, and
- * its timestamp is within the tolerance, so a captured request cannot be replayed later.
+ * its timestamp is within the tolerance, so a captured request cannot be replayed later; with
+ * `isNew`, also that its event was not received before, so it cannot be replayed sooner either.
  */
 export declare function verifyWebhook(check: WebhookCheck): Promise<boolean>;
 //#endregion
+//#region src/preview.d.ts
+/**
+ * The preview token (T-103 of docs/security/threat-model.md): a signed, stateless proof that a person of a site may read the
+ * latest revision of one entry, for one hour. A site that reads published content only (the
+ * binding of RPC, the read API) reads that entry's head instead when it presents one.
+ *
+ *   hw_prv_<payload>.<signature>
+ *
+ * The payload is base64url of `{ "s": site, "e": entryId, "x": expiresAtSeconds }`, and the
+ * signature the base64url HMAC-SHA256 of the payload text under a key that HKDF-SHA256 derives
+ * from the Worker secret `HOLLWARE_SECRET`, bound to the site. Nothing is stored: a token cannot
+ * be revoked, only wait out its hour, and rotating the secret ends every one.
+ */
+export declare const PREVIEW_TOKEN_PREFIX = "hw_prv_";
+/** The query parameter a site's page takes the token from. */
+export declare const PREVIEW_QUERY_PARAM = "hollware-preview";
+/** How long a token lasts, in seconds. */
+export declare const PREVIEW_TTL_SECONDS = 3600;
+/** The least characters of `HOLLWARE_SECRET` that Hollware signs anything with. */
+export declare const PREVIEW_SECRET_MIN_LENGTH = 32;
+/** Why a token was not accepted: for the log of the operator, never for the caller. */
+type PreviewRefusal = 'no_secret' | 'malformed' | 'signature' | 'site' | 'expired';
+type PreviewCheck = {
+  readonly ok: true;
+  readonly entryId: string;
+  readonly expiresAt: string;
+} | {
+  readonly ok: false;
+  readonly reason: PreviewRefusal;
+};
+/** Whether a Worker's secret can sign previews: present and long enough. */
+export declare function canSignPreviews(secret: string | undefined): secret is string;
+/** A token for one entry of one site, valid for `PREVIEW_TTL_SECONDS` from `now`. */
+export declare function makePreviewToken(input: {
+  readonly secret: string;
+  readonly site: string;
+  readonly entryId: string;
+  readonly now: Date;
+}): Promise<{
+  readonly token: string;
+  readonly expiresAt: string;
+}>;
+/**
+ * Checks a token for a site. The signature is verified (in constant time, by `crypto.subtle`)
+ * before the payload is parsed, under the key of the site that is asked: a token made for another
+ * site fails there. The entry the token names is the caller's to compare with the entry it read.
+ */
+export declare function verifyPreviewToken(input: {
+  readonly secret: string | undefined;
+  readonly site: string;
+  readonly token: string;
+  readonly now: Date;
+}): Promise<PreviewCheck>;
+//#endregion
+//#region src/events.d.ts
+/** A publish or an unpublish: the entry, and where it lives on the site. */
+export declare const entryEvent: z.ZodObject<{
+  id: z.ZodString;
+  site: z.ZodString;
+  at: z.ZodString;
+  cacheTags: z.ZodArray<z.ZodString>;
+  kind: z.ZodEnum<{
+    "entry.published": "entry.published";
+    "entry.unpublished": "entry.unpublished";
+  }>;
+  entry: z.ZodObject<{
+    id: z.ZodString;
+    collection: z.ZodString;
+    locale: z.ZodString;
+    slug: z.ZodString;
+    translationGroup: z.ZodNullable<z.ZodString>;
+  }, z.core.$strip>;
+  path: z.ZodNullable<z.ZodString>;
+  url: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+/** A change of the site's structure: no entry, the tags to purge. */
+export declare const siteEvent: z.ZodObject<{
+  id: z.ZodString;
+  site: z.ZodString;
+  at: z.ZodString;
+  cacheTags: z.ZodArray<z.ZodString>;
+  kind: z.ZodLiteral<"site.changed">;
+}, z.core.$strip>;
+/** Every event a webhook gets. */
+export declare const hollwareEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  id: z.ZodString;
+  site: z.ZodString;
+  at: z.ZodString;
+  cacheTags: z.ZodArray<z.ZodString>;
+  kind: z.ZodEnum<{
+    "entry.published": "entry.published";
+    "entry.unpublished": "entry.unpublished";
+  }>;
+  entry: z.ZodObject<{
+    id: z.ZodString;
+    collection: z.ZodString;
+    locale: z.ZodString;
+    slug: z.ZodString;
+    translationGroup: z.ZodNullable<z.ZodString>;
+  }, z.core.$strip>;
+  path: z.ZodNullable<z.ZodString>;
+  url: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+  id: z.ZodString;
+  site: z.ZodString;
+  at: z.ZodString;
+  cacheTags: z.ZodArray<z.ZodString>;
+  kind: z.ZodLiteral<"site.changed">;
+}, z.core.$strip>], "kind">;
+type EntryEvent = z.infer<typeof entryEvent>;
+type SiteEvent = z.infer<typeof siteEvent>;
+type HollwareEvent = z.infer<typeof hollwareEvent>;
+/**
+ * The event of a webhook's body, once its signature holds, or `null` for a body that is not one
+ * of the events this version knows (a newer kind, say): a receiver skips it.
+ */
+export declare function parseHollwareEvent(body: string): HollwareEvent | null;
+//#endregion
 //#region src/search/chunks.d.ts
 /**
  * The pieces of an entry that semantic search embeds (v0.5): one summary, and one piece for each
@@ -3521,8 +3894,15 @@ export declare function tagsOfEntries(entries: readonly TaggedEntry[]): string[]
  * collection in its locale and in every locale, and the pages that link to its translations.
  */
 export declare function tagsOfChange(entry: TaggedEntry): string[];
+/**
+ * The tags a change of a site's structure invalidates (ADR-033): the pages that show the structure
+ * (`site`, such as a navigation), and every list of its collections in each locale and in every
+ * locale, as a list may change with a schema, a route or a collection that goes. `collections` and
+ * `locales` are those of the definition before and after the change, together.
+ */
+export declare function tagsOfSiteChange(collections: readonly string[], locales: readonly string[]): string[];
 //#endregion
 //#region src/index.d.ts
 export declare const name = "@hollware/core";
 //#endregion
-export { type AcknowledgedWarning, type AuthDefinition, type BuiltInContractId, type BuiltInOptions, type CatalogRule, type Chunk, type CollectionDefinition, type CollectionDefinitionData, type ComponentDefinition, type ComponentUse, type ConfigProblem, type Contract, type ContractContext, type ContractDescription, type ContractFinding, type ContractText, type CustomContractOptions, type DescribedSchema, type DisallowedMarker, type Effect, type EntryDocument, type EntryFacts, type EntryLookup, type EntryRef, type ErrorCode, type ExtractedContent, type Heading, type HollwareConfig, type IdPrefix, type ImageRef, type LinkRef, type LinkTarget, type Operation, type OperationByName, type OperationName, type OperationSpec, type OutcomeInfo, type OutcomeOf, type Phase, type Preset, type ProcessMarkdown, type ProcessMarkdownOptions, type ProcessResult, type ProcessedMarkdown, type RenderHtml, type ResolveConfig, type ResolvedAuth, type ResolvedCollection, type ResolvedConfig, type ResolvedSite, type RuleDefinition, type RunContractsInput, type SchemaOutput, type Scope, type Severity, type SiteDefinition, type SiteDefinitionData, type SiteDefinitionInput, type SiteDescription, type TaggedEntry, type Verdict, type Violation, schemas_d_exports as schemas };
+export { type AcknowledgedWarning, type AuthDefinition, type BuiltInContractId, type BuiltInOptions, type CatalogRule, type Chunk, type CollectionDefinition, type CollectionDefinitionData, type ComponentDefinition, type ComponentUse, type ConfigProblem, type Contract, type ContractContext, type ContractDescription, type ContractFinding, type ContractText, type CustomContractOptions, type DescribedSchema, type DisallowedMarker, type Effect, type EntryDocument, type EntryEvent, type EntryFacts, type EntryLookup, type EntryRef, type ErrorCode, type ExtractedContent, type Heading, type HollwareConfig, type HollwareEvent, type IdPrefix, type ImageRef, type LinkRef, type LinkTarget, type Operation, type OperationByName, type OperationName, type OperationSpec, type OutcomeInfo, type OutcomeOf, type Phase, type Preset, type PreviewCheck, type PreviewRefusal, type ProcessMarkdown, type ProcessMarkdownOptions, type ProcessResult, type ProcessedMarkdown, type RenderHtml, type ResolveConfig, type ResolvedAudit, type ResolvedAuth, type ResolvedCollection, type ResolvedConfig, type ResolvedSite, type RuleDefinition, type RunContractsInput, type SchemaOutput, type Scope, type Severity, type SiteDefinition, type SiteDefinitionData, type SiteDefinitionInput, type SiteDescription, type SiteEvent, type TaggedEntry, type Verdict, type Violation, schemas_d_exports as schemas };