@kernhq/module-quire 0.11.1 → 0.13.0

package/dist/contract/router.d.ts

@@ -51,6 +51,155 @@ export declare const WatchState: z.ZodObject<{
     watchers: z.ZodArray<z.core.$ZodBranded<z.ZodUUID, "UserId", "out">>;
 }, z.core.$strip>;
 export type WatchState = z.infer<typeof WatchState>;
+/**
+ * A published site addresses its pages by **path, never by id**, and that is a security decision
+ * rather than a matter of taste.
+ *
+ * Every id in a public response is a string somebody can try somewhere else, and the only way to be
+ * sure none of them opens a door is for there to be none. So the whole `public.*` surface below
+ * carries no page id, no space id, no version id, no user id and no workspace id — a nav entry, a
+ * breadcrumb, a search hit and a sitemap line are all `path`, and `path` is built from titles by the
+ * server. `publications.int.test.ts` walks every public response and fails on any uuid belonging to
+ * anything in the fixture, which is what keeps this true as the shapes grow.
+ *
+ * The root page's path is the empty string; a child's is its ancestors' slugs joined with `/`, each
+ * slug being its title reduced to letters, digits and dashes (Unicode letters, so a Persian title
+ * keeps a Persian slug) and suffixed `-2`, `-3` when two siblings would collide.
+ */
+export declare const PublicNavEntry: z.ZodObject<{
+    path: z.ZodString;
+    parentPath: z.ZodNullable<z.ZodString>;
+    title: z.ZodString;
+    icon: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type PublicNavEntry = z.infer<typeof PublicNavEntry>;
+/** What is worth saying about a published site once a reader is allowed to see it. */
+export declare const PublicSiteDetail: z.ZodObject<{
+    title: z.ZodString;
+    description: z.ZodString;
+    ogImageUrl: z.ZodNullable<z.ZodString>;
+    indexable: z.ZodBoolean;
+    updatedAt: z.ZodISODateTime;
+    nav: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        parentPath: z.ZodNullable<z.ZodString>;
+        title: z.ZodString;
+        icon: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type PublicSiteDetail = z.infer<typeof PublicSiteDetail>;
+/**
+ * A published site, or the door to it.
+ *
+ * `locked` is the one thing a password-protected site admits before the password: that there is a
+ * door. Everything else — the title, the description, the shape of the tree — is behind it, because
+ * a nav tree is a table of contents and a table of contents is most of what a private handbook is.
+ * `theme` comes out anyway so the challenge screen is not white on a site that is not.
+ */
+export declare const PublicSite: z.ZodObject<{
+    slug: z.ZodString;
+    theme: z.ZodEnum<{
+        auto: "auto";
+        light: "light";
+        dark: "dark";
+    }>;
+    locked: z.ZodBoolean;
+    site: z.ZodNullable<z.ZodObject<{
+        title: z.ZodString;
+        description: z.ZodString;
+        ogImageUrl: z.ZodNullable<z.ZodString>;
+        indexable: z.ZodBoolean;
+        updatedAt: z.ZodISODateTime;
+        nav: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            parentPath: z.ZodNullable<z.ZodString>;
+            title: z.ZodString;
+            icon: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type PublicSite = z.infer<typeof PublicSite>;
+export declare const PublicBreadcrumb: z.ZodObject<{
+    path: z.ZodString;
+    title: z.ZodString;
+}, z.core.$strip>;
+export type PublicBreadcrumb = z.infer<typeof PublicBreadcrumb>;
+export declare const PublicPage: z.ZodObject<{
+    path: z.ZodString;
+    title: z.ZodString;
+    icon: z.ZodNullable<z.ZodString>;
+    coverUrl: z.ZodNullable<z.ZodString>;
+    html: z.ZodString;
+    publishedAt: z.ZodISODateTime;
+    etag: z.ZodString;
+    breadcrumbs: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        title: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type PublicPage = z.infer<typeof PublicPage>;
+export declare const PublicSearchHit: z.ZodObject<{
+    path: z.ZodString;
+    title: z.ZodString;
+    snippet: z.ZodString;
+}, z.core.$strip>;
+export type PublicSearchHit = z.infer<typeof PublicSearchHit>;
+export declare const PublicSitemapEntry: z.ZodObject<{
+    path: z.ZodString;
+    lastModified: z.ZodISODateTime;
+}, z.core.$strip>;
+/**
+ * One picture from a published page, **as bytes rather than as an address**.
+ *
+ * A published page used to carry its pictures as presigned storage URLs, written into the stored
+ * HTML at publish time. That was wrong twice over, and both halves were measured rather than
+ * argued. The URL is the storage key — `ws/<workspaceId>/<module>/<yyyy>/<mm>/<fileId>/<name>` —
+ * so every published page with a picture on it handed a stranger the tenant's workspace uuid and a
+ * file uuid, on the one surface whose whole rule is that no response carries an id; and a presigned
+ * GET expires in an hour while the HTML it was baked into is rendered once and stored for ever, so
+ * every image on every published site broke sixty minutes after it was published.
+ *
+ * So the HTML carries an opaque, workspace-sealed reference and the bytes come through here. The
+ * route layer fetches this from **its own server** and streams the body back under a URL of its
+ * own; nothing in the answer may reach a browser as-is, which is why it is bytes and not a link —
+ * there is no address in it to leak, and none to expire.
+ *
+ * Capped rather than streamed on purpose: a published handbook's illustration is tens of kilobytes,
+ * this path is anonymous, and an unbounded body on an unauthenticated endpoint is a way to spend
+ * somebody else's memory. Over the cap answers the same 404 as a picture that is not there.
+ */
+export declare const PublicAsset: z.ZodObject<{
+    contentType: z.ZodString;
+    bytes: z.ZodString;
+    maxAge: z.ZodNumber;
+}, z.core.$strip>;
+export type PublicAsset = z.infer<typeof PublicAsset>;
+/**
+ * The URL prefix the route layer serves this site under, so a link between two published pages is a
+ * link and not a dead mention.
+ *
+ * The module knows a page's path inside its publication and nothing about the address it is served
+ * at — one instance mounts a site at `/p/<workspace>/<slug>/`, another at the root of its own
+ * domain. Rather than guess, it takes the prefix and refuses anything that is not one: it has to
+ * start and end with `/`, and its segments are unreserved characters only. That refusal is the
+ * point. `//evil.example/` is a protocol-relative URL wearing the costume of a local path, and a
+ * caller that could set it would have every link on somebody's published site point off-site.
+ */
+export declare const PublicBasePath: z.ZodDefault<z.ZodString>;
+/**
+ * The one thing the module does ask of whatever serves a published site: a place for its pictures.
+ *
+ * `public.page` writes every `<img src>` as `<basePath><segment>/<reference>`, so the route layer
+ * has to answer that address by calling `public.asset` and streaming the bytes back. It is a
+ * constant rather than a convention because two sides have to agree on it and only one of them can
+ * be wrong quietly — a route layer that does not serve it renders a published page with no
+ * pictures, which looks like a rendering bug and is a missing route.
+ *
+ * The leading `__` is what keeps it out of the way: a page's own path segment is `slugifyTitle`'s
+ * output, which is Unicode letters and digits separated by hyphens, so no title can ever produce a
+ * segment starting with an underscore and no published page can be shadowed by this one.
+ */
+export declare const PUBLIC_ASSET_SEGMENT = "__media";
 export declare const quireContract: {
     readonly spaces: {
         readonly list: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
@@ -309,6 +458,8 @@ export declare const quireContract: {
             icon: z.ZodNullable<z.ZodString>;
             hasChildren: z.ZodBoolean;
             archivedAt: z.ZodNullable<z.ZodISODateTime>;
+            excludedFromPublic: z.ZodDefault<z.ZodBoolean>;
+            hasPublishedVersion: z.ZodDefault<z.ZodBoolean>;
         }, z.core.$strip>>, import("@orpc/contract").MergedErrorMap<Record<never, never>, {
             BAD_REQUEST: {
                 data: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
@@ -3350,6 +3501,611 @@ export declare const quireContract: {
             };
         }>, Record<never, never>>;
     };
+    /**
+     * Who has published what, from the inside. Every procedure here is authenticated and asks
+     * `quire.page.publish` about the **root page**, because that is the page whose subtree is being
+     * handed to the internet.
+     */
+    readonly publications: {
+        readonly list: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+            workspaceId: z.core.$ZodBranded<z.ZodUUID, "WorkspaceId", "out">;
+            spaceId: z.ZodUUID;
+        }, z.core.$strip>, z.ZodArray<z.ZodObject<{
+            id: z.ZodUUID;
+            workspaceId: z.core.$ZodBranded<z.ZodUUID, "WorkspaceId", "out">;
+            rootPageId: z.ZodUUID;
+            includeDescendants: z.ZodBoolean;
+            slug: z.ZodString;
+            hasPassword: z.ZodBoolean;
+            expiresAt: z.ZodNullable<z.ZodISODateTime>;
+            seoTitle: z.ZodString;
+            seoDescription: z.ZodString;
+            ogImageUrl: z.ZodNullable<z.ZodString>;
+            indexable: z.ZodBoolean;
+            theme: z.ZodEnum<{
+                auto: "auto";
+                light: "light";
+                dark: "dark";
+            }>;
+            createdBy: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "UserId", "out">>;
+            createdAt: z.ZodISODateTime;
+            updatedAt: z.ZodISODateTime;
+        }, z.core.$strip>>, import("@orpc/contract").MergedErrorMap<Record<never, never>, {
+            BAD_REQUEST: {
+                data: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+            };
+            UNAUTHORIZED: {};
+            FORBIDDEN: {
+                data: z.ZodOptional<z.ZodObject<{
+                    permission: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            NOT_FOUND: {};
+            CONFLICT: {
+                data: z.ZodOptional<z.ZodObject<{
+                    reason: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            RATE_LIMITED: {};
+            MODULE_DISABLED: {
+                data: z.ZodObject<{
+                    module: z.ZodString;
+                }, z.core.$strip>;
+            };
+        }>, Record<never, never>>;
+        readonly get: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+            workspaceId: z.core.$ZodBranded<z.ZodUUID, "WorkspaceId", "out">;
+            publicationId: z.ZodUUID;
+        }, z.core.$strip>, z.ZodObject<{
+            id: z.ZodUUID;
+            workspaceId: z.core.$ZodBranded<z.ZodUUID, "WorkspaceId", "out">;
+            rootPageId: z.ZodUUID;
+            includeDescendants: z.ZodBoolean;
+            slug: z.ZodString;
+            hasPassword: z.ZodBoolean;
+            expiresAt: z.ZodNullable<z.ZodISODateTime>;
+            seoTitle: z.ZodString;
+            seoDescription: z.ZodString;
+            ogImageUrl: z.ZodNullable<z.ZodString>;
+            indexable: z.ZodBoolean;
+            theme: z.ZodEnum<{
+                auto: "auto";
+                light: "light";
+                dark: "dark";
+            }>;
+            createdBy: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "UserId", "out">>;
+            createdAt: z.ZodISODateTime;
+            updatedAt: z.ZodISODateTime;
+        }, z.core.$strip>, import("@orpc/contract").MergedErrorMap<Record<never, never>, {
+            BAD_REQUEST: {
+                data: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+            };
+            UNAUTHORIZED: {};
+            FORBIDDEN: {
+                data: z.ZodOptional<z.ZodObject<{
+                    permission: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            NOT_FOUND: {};
+            CONFLICT: {
+                data: z.ZodOptional<z.ZodObject<{
+                    reason: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            RATE_LIMITED: {};
+            MODULE_DISABLED: {
+                data: z.ZodObject<{
+                    module: z.ZodString;
+                }, z.core.$strip>;
+            };
+        }>, Record<never, never>>;
+        readonly create: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+            workspaceId: z.core.$ZodBranded<z.ZodUUID, "WorkspaceId", "out">;
+            rootPageId: z.ZodUUID;
+            slug: z.ZodString;
+            includeDescendants: z.ZodDefault<z.ZodBoolean>;
+            password: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            expiresAt: z.ZodDefault<z.ZodNullable<z.ZodISODateTime>>;
+            seoTitle: z.ZodDefault<z.ZodString>;
+            seoDescription: z.ZodDefault<z.ZodString>;
+            ogImageUrl: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            indexable: z.ZodDefault<z.ZodBoolean>;
+            theme: z.ZodDefault<z.ZodEnum<{
+                auto: "auto";
+                light: "light";
+                dark: "dark";
+            }>>;
+        }, z.core.$strip>, z.ZodObject<{
+            id: z.ZodUUID;
+            workspaceId: z.core.$ZodBranded<z.ZodUUID, "WorkspaceId", "out">;
+            rootPageId: z.ZodUUID;
+            includeDescendants: z.ZodBoolean;
+            slug: z.ZodString;
+            hasPassword: z.ZodBoolean;
+            expiresAt: z.ZodNullable<z.ZodISODateTime>;
+            seoTitle: z.ZodString;
+            seoDescription: z.ZodString;
+            ogImageUrl: z.ZodNullable<z.ZodString>;
+            indexable: z.ZodBoolean;
+            theme: z.ZodEnum<{
+                auto: "auto";
+                light: "light";
+                dark: "dark";
+            }>;
+            createdBy: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "UserId", "out">>;
+            createdAt: z.ZodISODateTime;
+            updatedAt: z.ZodISODateTime;
+        }, z.core.$strip>, import("@orpc/contract").MergedErrorMap<Record<never, never>, {
+            BAD_REQUEST: {
+                data: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+            };
+            UNAUTHORIZED: {};
+            FORBIDDEN: {
+                data: z.ZodOptional<z.ZodObject<{
+                    permission: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            NOT_FOUND: {};
+            CONFLICT: {
+                data: z.ZodOptional<z.ZodObject<{
+                    reason: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            RATE_LIMITED: {};
+            MODULE_DISABLED: {
+                data: z.ZodObject<{
+                    module: z.ZodString;
+                }, z.core.$strip>;
+            };
+        }>, Record<never, never>>;
+        /**
+         * `password` is three-valued on purpose: a string sets one, `null` removes it, and leaving the
+         * key out changes nothing. A two-valued field would make every "rename the site" request also
+         * an "unlock the site" request, which is the shape that quietly takes the door off a handbook.
+         */
+        readonly update: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+            workspaceId: z.core.$ZodBranded<z.ZodUUID, "WorkspaceId", "out">;
+            publicationId: z.ZodUUID;
+            slug: z.ZodOptional<z.ZodString>;
+            includeDescendants: z.ZodOptional<z.ZodBoolean>;
+            password: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            expiresAt: z.ZodOptional<z.ZodNullable<z.ZodISODateTime>>;
+            seoTitle: z.ZodOptional<z.ZodString>;
+            seoDescription: z.ZodOptional<z.ZodString>;
+            ogImageUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            indexable: z.ZodOptional<z.ZodBoolean>;
+            theme: z.ZodOptional<z.ZodEnum<{
+                auto: "auto";
+                light: "light";
+                dark: "dark";
+            }>>;
+        }, z.core.$strip>, z.ZodObject<{
+            id: z.ZodUUID;
+            workspaceId: z.core.$ZodBranded<z.ZodUUID, "WorkspaceId", "out">;
+            rootPageId: z.ZodUUID;
+            includeDescendants: z.ZodBoolean;
+            slug: z.ZodString;
+            hasPassword: z.ZodBoolean;
+            expiresAt: z.ZodNullable<z.ZodISODateTime>;
+            seoTitle: z.ZodString;
+            seoDescription: z.ZodString;
+            ogImageUrl: z.ZodNullable<z.ZodString>;
+            indexable: z.ZodBoolean;
+            theme: z.ZodEnum<{
+                auto: "auto";
+                light: "light";
+                dark: "dark";
+            }>;
+            createdBy: z.ZodNullable<z.core.$ZodBranded<z.ZodUUID, "UserId", "out">>;
+            createdAt: z.ZodISODateTime;
+            updatedAt: z.ZodISODateTime;
+        }, z.core.$strip>, import("@orpc/contract").MergedErrorMap<Record<never, never>, {
+            BAD_REQUEST: {
+                data: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+            };
+            UNAUTHORIZED: {};
+            FORBIDDEN: {
+                data: z.ZodOptional<z.ZodObject<{
+                    permission: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            NOT_FOUND: {};
+            CONFLICT: {
+                data: z.ZodOptional<z.ZodObject<{
+                    reason: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            RATE_LIMITED: {};
+            MODULE_DISABLED: {
+                data: z.ZodObject<{
+                    module: z.ZodString;
+                }, z.core.$strip>;
+            };
+        }>, Record<never, never>>;
+        /** The row is the grant, so removing it takes the site down. Nothing else is deleted. */
+        readonly remove: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+            workspaceId: z.core.$ZodBranded<z.ZodUUID, "WorkspaceId", "out">;
+            publicationId: z.ZodUUID;
+        }, z.core.$strip>, z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, z.core.$strip>, import("@orpc/contract").MergedErrorMap<Record<never, never>, {
+            BAD_REQUEST: {
+                data: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+            };
+            UNAUTHORIZED: {};
+            FORBIDDEN: {
+                data: z.ZodOptional<z.ZodObject<{
+                    permission: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            NOT_FOUND: {};
+            CONFLICT: {
+                data: z.ZodOptional<z.ZodObject<{
+                    reason: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            RATE_LIMITED: {};
+            MODULE_DISABLED: {
+                data: z.ZodObject<{
+                    module: z.ZodString;
+                }, z.core.$strip>;
+            };
+        }>, Record<never, never>>;
+        /**
+         * Keep one page — and therefore everything under it — out of every publication, present and
+         * future.
+         *
+         * Absolute rather than per-publication, and that is the whole reason it is a flag on the page:
+         * an opt-out recorded against one publication says nothing about a publication somebody roots
+         * above the page next month, and its author would never see it. This one holds against
+         * publications that do not exist yet.
+         */
+        readonly optOut: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+            workspaceId: z.core.$ZodBranded<z.ZodUUID, "WorkspaceId", "out">;
+            pageId: z.ZodUUID;
+            excluded: z.ZodDefault<z.ZodBoolean>;
+        }, z.core.$strip>, z.ZodObject<{
+            pageId: z.ZodUUID;
+            excluded: z.ZodBoolean;
+        }, z.core.$strip>, import("@orpc/contract").MergedErrorMap<Record<never, never>, {
+            BAD_REQUEST: {
+                data: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+            };
+            UNAUTHORIZED: {};
+            FORBIDDEN: {
+                data: z.ZodOptional<z.ZodObject<{
+                    permission: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            NOT_FOUND: {};
+            CONFLICT: {
+                data: z.ZodOptional<z.ZodObject<{
+                    reason: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            RATE_LIMITED: {};
+            MODULE_DISABLED: {
+                data: z.ZodObject<{
+                    module: z.ZodString;
+                }, z.core.$strip>;
+            };
+        }>, Record<never, never>>;
+    };
+    /**
+     * The signed-out surface. **This is the only part of Kern with no principal behind it.**
+     *
+     * Five rules hold here, and each of them is a test in `publications.int.test.ts`:
+     *
+     *   1. A page is public only if it is inside the publication's subtree, not opted out, not
+     *      archived, not trashed, and has a published version that has been rendered. Failing any one
+     *      of those is **404, never 403** — a refusal that distinguishes "not yours" from "not there"
+     *      confirms the page exists to whoever is guessing.
+     *   2. Guessing a sibling, a parent, a page in another space or another workspace gets 404 too,
+     *      which is free here because nothing is addressed by id: `path` names a place in *this*
+     *      publication's tree or it names nothing.
+     *   3. No response carries a draft, a comment, an author, a version list, or any id.
+     *   4. A password-protected publication answers a challenge and nothing else. `unlock` mints a
+     *      **capability token, not a session**: an AES-GCM envelope sealed with the instance secret,
+     *      bound by its associated data to this one publication, carrying an expiry and no identity.
+     *      The server keeps nothing. The route layer is expected to hold it in an HttpOnly cookie and
+     *      pass it back — never to put it in a link, because a token in a URL is a token in a referrer
+     *      header and in somebody's access log.
+     *   5. An expired publication is 404, checked on the request rather than by a sweep.
+     *
+     * `workspaceId` is in the path because *anonymous means no principal, not no tenant*: the request
+     * has to name a workspace before anything touches `mod_quire`, or row-level security has nothing
+     * to fence with. See the note at the top of `migrations/0008_publications.sql`.
+     */
+    readonly public: {
+        readonly site: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+            workspaceId: z.core.$ZodBranded<z.ZodUUID, "WorkspaceId", "out">;
+            slug: z.ZodString;
+            token: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strip>, z.ZodObject<{
+            slug: z.ZodString;
+            theme: z.ZodEnum<{
+                auto: "auto";
+                light: "light";
+                dark: "dark";
+            }>;
+            locked: z.ZodBoolean;
+            site: z.ZodNullable<z.ZodObject<{
+                title: z.ZodString;
+                description: z.ZodString;
+                ogImageUrl: z.ZodNullable<z.ZodString>;
+                indexable: z.ZodBoolean;
+                updatedAt: z.ZodISODateTime;
+                nav: z.ZodArray<z.ZodObject<{
+                    path: z.ZodString;
+                    parentPath: z.ZodNullable<z.ZodString>;
+                    title: z.ZodString;
+                    icon: z.ZodNullable<z.ZodString>;
+                }, z.core.$strip>>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>, import("@orpc/contract").MergedErrorMap<Record<never, never>, {
+            BAD_REQUEST: {
+                data: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+            };
+            UNAUTHORIZED: {};
+            FORBIDDEN: {
+                data: z.ZodOptional<z.ZodObject<{
+                    permission: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            NOT_FOUND: {};
+            CONFLICT: {
+                data: z.ZodOptional<z.ZodObject<{
+                    reason: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            RATE_LIMITED: {};
+            MODULE_DISABLED: {
+                data: z.ZodObject<{
+                    module: z.ZodString;
+                }, z.core.$strip>;
+            };
+        }>, Record<never, never>>;
+        /**
+         * One page of a published site.
+         *
+         * `path` is a query parameter rather than a path segment because it contains slashes: a nested
+         * page's address is `guide/install`, and oRPC's route matcher takes one segment per parameter.
+         */
+        readonly page: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+            workspaceId: z.core.$ZodBranded<z.ZodUUID, "WorkspaceId", "out">;
+            slug: z.ZodString;
+            path: z.ZodDefault<z.ZodString>;
+            basePath: z.ZodDefault<z.ZodString>;
+            token: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strip>, z.ZodObject<{
+            path: z.ZodString;
+            title: z.ZodString;
+            icon: z.ZodNullable<z.ZodString>;
+            coverUrl: z.ZodNullable<z.ZodString>;
+            html: z.ZodString;
+            publishedAt: z.ZodISODateTime;
+            etag: z.ZodString;
+            breadcrumbs: z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                title: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>, import("@orpc/contract").MergedErrorMap<Record<never, never>, {
+            BAD_REQUEST: {
+                data: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+            };
+            UNAUTHORIZED: {};
+            FORBIDDEN: {
+                data: z.ZodOptional<z.ZodObject<{
+                    permission: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            NOT_FOUND: {};
+            CONFLICT: {
+                data: z.ZodOptional<z.ZodObject<{
+                    reason: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            RATE_LIMITED: {};
+            MODULE_DISABLED: {
+                data: z.ZodObject<{
+                    module: z.ZodString;
+                }, z.core.$strip>;
+            };
+        }>, Record<never, never>>;
+        /**
+         * Search inside this publication and nowhere else.
+         *
+         * It reads the **published version's** flattened text, not `pages.text`. That column mirrors the
+         * live document, so searching it would put a sentence somebody has not published yet into a
+         * snippet on the public internet — the one place in this module where the draft and the
+         * published copy differ and the difference is the whole point.
+         */
+        readonly search: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+            workspaceId: z.core.$ZodBranded<z.ZodUUID, "WorkspaceId", "out">;
+            slug: z.ZodString;
+            q: z.ZodString;
+            limit: z.ZodDefault<z.ZodNumber>;
+            token: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strip>, z.ZodObject<{
+            items: z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                title: z.ZodString;
+                snippet: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>, import("@orpc/contract").MergedErrorMap<Record<never, never>, {
+            BAD_REQUEST: {
+                data: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+            };
+            UNAUTHORIZED: {};
+            FORBIDDEN: {
+                data: z.ZodOptional<z.ZodObject<{
+                    permission: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            NOT_FOUND: {};
+            CONFLICT: {
+                data: z.ZodOptional<z.ZodObject<{
+                    reason: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            RATE_LIMITED: {};
+            MODULE_DISABLED: {
+                data: z.ZodObject<{
+                    module: z.ZodString;
+                }, z.core.$strip>;
+            };
+        }>, Record<never, never>>;
+        /**
+         * What a crawler may index, which is not the same list as what a reader may open: a site behind
+         * a password, or marked `indexable: false`, has an empty sitemap rather than a private one.
+         */
+        readonly sitemap: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+            workspaceId: z.core.$ZodBranded<z.ZodUUID, "WorkspaceId", "out">;
+            slug: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            entries: z.ZodArray<z.ZodObject<{
+                path: z.ZodString;
+                lastModified: z.ZodISODateTime;
+            }, z.core.$strip>>;
+        }, z.core.$strip>, import("@orpc/contract").MergedErrorMap<Record<never, never>, {
+            BAD_REQUEST: {
+                data: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+            };
+            UNAUTHORIZED: {};
+            FORBIDDEN: {
+                data: z.ZodOptional<z.ZodObject<{
+                    permission: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            NOT_FOUND: {};
+            CONFLICT: {
+                data: z.ZodOptional<z.ZodObject<{
+                    reason: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            RATE_LIMITED: {};
+            MODULE_DISABLED: {
+                data: z.ZodObject<{
+                    module: z.ZodString;
+                }, z.core.$strip>;
+            };
+        }>, Record<never, never>>;
+        /**
+         * The one procedure here that never distinguishes one slug from another.
+         *
+         * A crawler asking about a slug that does not exist, one that has expired, and one behind a
+         * password must all get the same answer, or `robots` becomes the oracle every other procedure
+         * refuses to be. So it succeeds for all three and says "do not index". (A workspace with the
+         * module switched off is still a 404, from the middleware — that is a statement about the
+         * workspace, which the path already named, and not about any slug.)
+         */
+        readonly robots: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+            workspaceId: z.core.$ZodBranded<z.ZodUUID, "WorkspaceId", "out">;
+            slug: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            indexable: z.ZodBoolean;
+            sitemapPath: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>, import("@orpc/contract").MergedErrorMap<Record<never, never>, {
+            BAD_REQUEST: {
+                data: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+            };
+            UNAUTHORIZED: {};
+            FORBIDDEN: {
+                data: z.ZodOptional<z.ZodObject<{
+                    permission: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            NOT_FOUND: {};
+            CONFLICT: {
+                data: z.ZodOptional<z.ZodObject<{
+                    reason: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            RATE_LIMITED: {};
+            MODULE_DISABLED: {
+                data: z.ZodObject<{
+                    module: z.ZodString;
+                }, z.core.$strip>;
+            };
+        }>, Record<never, never>>;
+        /**
+         * The bytes of one picture on a published page.
+         *
+         * `asset` is the opaque reference the page's own HTML carries — an AES-GCM envelope sealed with
+         * the instance secret and bound by its associated data to this workspace, so it names nothing
+         * on its own and cannot be carried to another instance. Resolving it is not enough on its own:
+         * the file has to be referenced by a version that is *currently* public in this publication, so
+         * opting a page out stops its pictures resolving in the same breath as its prose.
+         *
+         * Everything unresolvable is the same 404 as everything else here — a reference that will not
+         * decrypt, one for a file nothing public uses, a file that has been deleted, an object over the
+         * cap. And a locked publication answers the door first: the pictures are behind the password
+         * along with the pages they are on.
+         */
+        readonly asset: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+            workspaceId: z.core.$ZodBranded<z.ZodUUID, "WorkspaceId", "out">;
+            slug: z.ZodString;
+            asset: z.ZodString;
+            token: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strip>, z.ZodObject<{
+            contentType: z.ZodString;
+            bytes: z.ZodString;
+            maxAge: z.ZodNumber;
+        }, z.core.$strip>, import("@orpc/contract").MergedErrorMap<Record<never, never>, {
+            BAD_REQUEST: {
+                data: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+            };
+            UNAUTHORIZED: {};
+            FORBIDDEN: {
+                data: z.ZodOptional<z.ZodObject<{
+                    permission: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            NOT_FOUND: {};
+            CONFLICT: {
+                data: z.ZodOptional<z.ZodObject<{
+                    reason: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            RATE_LIMITED: {};
+            MODULE_DISABLED: {
+                data: z.ZodObject<{
+                    module: z.ZodString;
+                }, z.core.$strip>;
+            };
+        }>, Record<never, never>>;
+        /** Present the password, get a token. A site with no password has no door, and answers 404. */
+        readonly unlock: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+            workspaceId: z.core.$ZodBranded<z.ZodUUID, "WorkspaceId", "out">;
+            slug: z.ZodString;
+            password: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            token: z.ZodString;
+            expiresAt: z.ZodISODateTime;
+        }, z.core.$strip>, import("@orpc/contract").MergedErrorMap<Record<never, never>, {
+            BAD_REQUEST: {
+                data: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+            };
+            UNAUTHORIZED: {};
+            FORBIDDEN: {
+                data: z.ZodOptional<z.ZodObject<{
+                    permission: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            NOT_FOUND: {};
+            CONFLICT: {
+                data: z.ZodOptional<z.ZodObject<{
+                    reason: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>>;
+            };
+            RATE_LIMITED: {};
+            MODULE_DISABLED: {
+                data: z.ZodObject<{
+                    module: z.ZodString;
+                }, z.core.$strip>;
+            };
+        }>, Record<never, never>>;
+    };
 };
 export type QuireContract = typeof quireContract;
 export { Ok };