@murumets-ee/yhikas-sync 0.93.0 → 0.94.0

package/dist/room-page-registry-CnqXH_Ls.d.mts

@@ -0,0 +1,974 @@
+import { ToolkitApp } from "@murumets-ee/core";
+import { z } from "zod";
+
+//#region src/constants.d.ts
+/**
+ * Names, identifiers and stated numbers for the yhikas-admin sync.
+ *
+ * Pure module — no imports, no side effects. Both the jiti-loaded plugin entry
+ * and the worker-side job modules read from here, so nothing in this file may
+ * reach a `server-only` module.
+ */
+/** Plugin name, as it appears in `app.plugins` and `Plugin.requires`. */
+declare const YHIKAS_SYNC_PLUGIN_NAME = "@murumets-ee/yhikas-sync";
+/**
+ * The synthetic actor every sync write is attributed to.
+ *
+ * Not `'cli'`. `auditable()` records this in `created_by`/`updated_by`, so a
+ * human reading the audit log can tell a sync write from an operator running a
+ * `lumi` command — and the machine-written guard (see `entities/guard.ts`) can
+ * refuse every other writer by name. Fits `varchar(255)`; user ids in this
+ * codebase are varchar, never uuid.
+ */
+declare const YHIKAS_SYNC_ACTOR_ID = "yhikas-sync";
+/**
+ * Job names. `JOB_NAME_RE` in `@murumets-ee/queue` is
+ * `/^[a-zA-Z0-9:_-]{1,128}$/` — colons are the `plugin:action` separator and
+ * dots are rejected outright.
+ */
+declare const SYNC_JOB_NAME = "yhikas-sync:pull";
+declare const WATCHDOG_JOB_NAME = "yhikas-sync:staleness-watchdog";
+/**
+ * The three resources in scope.
+ *
+ * `site_info` was deliberately absent until 2026-08-11 (D027). PR 05 left it
+ * out on a MEASUREMENT — `site_info`/`site_notice` appear only in
+ * yhikas-admin's `src/db/schema.ts` and its public route, with no admin UI, no
+ * server action, no seed and no internal consumer — from which the plan
+ * concluded that no rows existed and a sync would pull nothing.
+ *
+ * Measured against production on 2026-08-11 (R028), that premise had expired:
+ * the route answers 200 with populated reception hours and two live notices.
+ * The rows were written outside the app. Hardcoding them in the rebuilt site
+ * would therefore have frozen live data, not stood in for an empty upstream.
+ */
+declare const ROOM_TYPES_RESOURCE = "room_types";
+declare const LEGAL_DOCUMENTS_RESOURCE = "legal_documents";
+declare const SITE_INFO_RESOURCE = "site_info";
+declare const SYNC_RESOURCES: readonly ["room_types", "legal_documents", "site_info"];
+type SyncResource = (typeof SYNC_RESOURCES)[number];
+/**
+ * The business key of the one `yhikas_site_info` row.
+ *
+ * Upstream `site_info` is a singleton and its notices carry no id or code of
+ * their own — only `{text, isActive, order}` — so there is no natural key to
+ * diff N rows on. Modelling it as ONE row with a constant key keeps the whole
+ * package on a single identity story (`code`, `type`, and now `key`), and
+ * keeps the notices ordered without inventing an identity that upstream would
+ * not preserve across an edit.
+ */
+declare const SITE_INFO_KEY = "default";
+/**
+ * Locale codes. Upstream `MultilingualText` is `{ en, et }` and the lumi codes
+ * are identical, so there is no mapping to configure — inventing one would be
+ * a seam for a second customer this package does not have (N1).
+ */
+declare const ET_LOCALE = "et";
+declare const EN_LOCALE = "en";
+/**
+ * Currency and VAT treatment, DECLARED here because they are not data upstream
+ * (R009 §6 / R013): `room_type` has no currency column and no tax column, and
+ * VAT is computed at invoice time against Merit article codes, never stored.
+ * Stating them makes a mis-entered source value render as a visibly wrong
+ * number against a declared unit rather than as a plausible one.
+ *
+ * The third semantic — the period — stays encoded in the field NAME
+ * (`monthlyRent` / `dailyRent`), because one row carries two different periods
+ * and a single `period` column could only be wrong about one of them.
+ */
+declare const DECLARED_CURRENCY = "EUR";
+/** `net` = the amount excludes VAT. */
+declare const DECLARED_VAT_TREATMENT = "net";
+/**
+ * Hard ceiling on ticker items. A ticker is a marquee: past a couple of dozen
+ * entries nobody reads the tail, and an unbounded array from upstream would
+ * ride into a JSONB column and out onto every page of the site.
+ */
+declare const MAX_SITE_NOTICES = 25;
+/**
+ * Env var carrying the sync's OWN bearer credential — deliberately not the
+ * site's `PUBLIC_SITE_API_KEY`. The upstream limiter buckets on
+ * `sha256(key).slice(0,16)` rather than on the caller IP (there is no
+ * `x-forwarded-for` over the Docker-internal path), so sharing a key means
+ * sharing one 60/min bucket, and revoking one credential would blind both.
+ */
+declare const API_KEY_ENV_VAR = "YHIKAS_SYNC_API_KEY";
+declare const BASE_URL_ENV_VAR = "YHIKAS_ADMIN_BASE_URL";
+//#endregion
+//#region src/diff.d.ts
+/** One local row, reduced to what the diff needs. */
+interface LocalRow {
+  readonly id: string;
+  /** The business key this row was synced under. */
+  readonly key: string;
+  readonly status: string;
+  /**
+   * `null` on a row whose last sync did not complete — the hash is written
+   * LAST, after every other write for the row succeeded, so a null (or stale)
+   * hash is exactly the signal that the row needs redoing.
+   */
+  readonly sourceHash: string | null;
+  /** Preserved across updates so it keeps meaning "first published". */
+  readonly publishedAt: Date | null;
+}
+interface DiffPlan<T> {
+  /** Upstream rows with no local counterpart. */
+  readonly create: readonly T[];
+  /** Local rows whose hash differs, OR whose status drifted from `published`. */
+  readonly update: readonly {
+    readonly local: LocalRow;
+    readonly row: T;
+  }[];
+  /** Local rows already identical and already published — no write at all. */
+  readonly unchanged: readonly LocalRow[];
+  /** Published locally, absent upstream. Unpublished, never deleted (D016). */
+  readonly retire: readonly LocalRow[];
+}
+interface SanityFloor {
+  /** Refuse a snapshot larger than this rather than truncating it. */
+  readonly maxRows: number;
+  /** Refuse a run retiring more than this fraction of published rows. */
+  readonly maxRetireFraction: number;
+  /** The fraction rule applies only once at least this many rows are published. */
+  readonly minRowsForFraction: number;
+}
+interface PlanDiffInput<T> {
+  readonly resource: SyncResource;
+  readonly upstream: readonly T[];
+  readonly local: readonly LocalRow[];
+  readonly keyOf: (row: T) => string;
+  readonly hashOf: (row: T) => string;
+  readonly floor: SanityFloor;
+}
+/**
+ * Stable content hash of an upstream row.
+ *
+ * Keys are sorted so the hash does not depend on JSON property order, which no
+ * part of the HTTP stack guarantees. `undefined` and `null` are distinguished
+ * because a null price is meaningful data here, not an absence.
+ */
+declare function stableHash(value: unknown): string;
+/**
+ * Compare an authoritative upstream snapshot against local state.
+ *
+ * **The caller must not invoke this with a snapshot that did not fully
+ * succeed.** That guard lives one level up, in the client: a non-2xx, a
+ * timeout or a body failing the wire schema throws before the differ is ever
+ * reached, so a partial response can never present as an absence here. This
+ * function's own guards are for a snapshot that IS authoritative but whose
+ * shape makes acting on it reckless.
+ *
+ * @throws {YhikasSyncRefusedError} for any of the D016 refusals. Every one of
+ *   them aborts before a single write, so a refused run leaves local content
+ *   exactly as it was — which is the first of PR 05's three obligatory
+ *   negative tests.
+ */
+declare function planDiff<T>(input: PlanDiffInput<T>): DiffPlan<T>;
+//#endregion
+//#region src/upstream/wire.d.ts
+/**
+ * `MultilingualText` — a Postgres `json` column, so it arrives as a nested
+ * object and is never stringified.
+ *
+ * NOT `.strict()`: unknown keys are stripped rather than rejected, so adding a
+ * third language upstream degrades to "the sync ignores it" instead of "every
+ * run fails".
+ *
+ * 🔴 **Each locale key is nullable AND optional, and that is the load-bearing
+ * clause** (F058, cross-referenced to upstream F031). The column is declared
+ * `json(...).notNull()` — and **notNull covers the OBJECT, not its keys**. There
+ * is no CHECK constraint, and two of the four public columns
+ * (`room_type.name`, `legal_document.title`) have no upstream validation at all:
+ * the write is a raw `formData.get(…) as string`, which is `null` the moment a
+ * field is absent. So `{"et":"Tuba","en":null}` — and `{"et":"Tuba"}` — are rows
+ * yhikas-admin accepts today, through its ordinary admin UI.
+ *
+ * Requiring both keys would fail the ENTIRE response for one such row, so 32
+ * room types would stop syncing because one lacks an English name — every six
+ * hours, until somebody edited it upstream. That is exactly the blast-radius
+ * mistake `legalDocumentRowSchema.slug` documents below and deliberately
+ * avoided; a missing translation belongs at one row, and `projection.ts` is
+ * where it is decided (the locale is suppressed, or the row is skipped with a
+ * reason).
+ *
+ * What is NOT relaxed, on purpose:
+ *
+ * - **The object itself stays required.** A missing translation is DATA; a
+ *   missing FIELD is a renamed column or a changed envelope. The consequence of
+ *   tolerating one is caught either way — `assertSomethingSurvived` refuses a
+ *   snapshot in which no row survived — but refusing here NAMES it
+ *   (`title: Required`) instead of reporting 32 identical "no 'et' title
+ *   upstream" skips and leaving the reader to infer the cause.
+ * - **A non-string value is still a shape violation.** `{"en":42}` would
+ *   otherwise be written as a name.
+ *
+ * Note the asymmetry this leaves, deliberately: a RENAMED key (`et_EE`) is
+ * indistinguishable from two absent ones, because unknown keys are stripped by
+ * design so a third language degrades gracefully. That case falls through to
+ * `assertSomethingSurvived`, which is exactly what it is for.
+ */
+declare const multilingualTextSchema: z.ZodObject<{
+  et: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  en: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, "strip", z.ZodTypeAny, {
+  et?: string | null | undefined;
+  en?: string | null | undefined;
+}, {
+  et?: string | null | undefined;
+  en?: string | null | undefined;
+}>;
+type MultilingualText = z.infer<typeof multilingualTextSchema>;
+/**
+ * One `room_type` row.
+ *
+ * `depositAmount` / `discountedDepositAmount` are absent by design. Upstream
+ * ships them as hardcoded `null` with no backing column; validating them as
+ * `z.null()` would turn the day someone adds the column into a hard sync
+ * failure. Deposits are unbuilt admin-side work, not something the sync can
+ * surface.
+ */
+declare const roomTypeRowSchema: z.ZodObject<{
+  code: z.ZodString;
+  name: z.ZodObject<{
+    et: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    en: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  }, "strip", z.ZodTypeAny, {
+    et?: string | null | undefined;
+    en?: string | null | undefined;
+  }, {
+    et?: string | null | undefined;
+    en?: string | null | undefined;
+  }>;
+  totalArea: z.ZodNullable<z.ZodString>;
+  livingArea: z.ZodNullable<z.ZodString>;
+  commonArea: z.ZodNullable<z.ZodString>;
+  capacity: z.ZodNullable<z.ZodNumber>;
+  monthlyRent: z.ZodNullable<z.ZodString>;
+  discountedRent: z.ZodNullable<z.ZodString>;
+  dailyRent: z.ZodNullable<z.ZodString>;
+  placesOccupied: z.ZodNullable<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+  code: string;
+  name: {
+    et?: string | null | undefined;
+    en?: string | null | undefined;
+  };
+  totalArea: string | null;
+  livingArea: string | null;
+  commonArea: string | null;
+  capacity: number | null;
+  placesOccupied: number | null;
+  monthlyRent: string | null;
+  dailyRent: string | null;
+  discountedRent: string | null;
+}, {
+  code: string;
+  name: {
+    et?: string | null | undefined;
+    en?: string | null | undefined;
+  };
+  totalArea: string | null;
+  livingArea: string | null;
+  commonArea: string | null;
+  capacity: number | null;
+  placesOccupied: number | null;
+  monthlyRent: string | null;
+  dailyRent: string | null;
+  discountedRent: string | null;
+}>;
+type RoomTypeRow = z.infer<typeof roomTypeRowSchema>;
+/**
+ * One active `legal_document` row.
+ *
+ * `type` is `text().notNull().unique()` upstream — NOT a pgEnum, and there is
+ * no TS union anywhere. The five values seeded today are closed by convention
+ * only and the admin UI can mint a sixth, so this validates the SHAPE of the
+ * business key and never its membership in a list. A whitelist here would turn
+ * a new upstream document into a hard sync failure.
+ */
+declare const legalDocumentRowSchema: z.ZodObject<{
+  type: z.ZodString;
+  title: z.ZodObject<{
+    et: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    en: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  }, "strip", z.ZodTypeAny, {
+    et?: string | null | undefined;
+    en?: string | null | undefined;
+  }, {
+    et?: string | null | undefined;
+    en?: string | null | undefined;
+  }>;
+  /**
+   * Accepted as free text HERE, and screened per-row in the projection.
+   *
+   * Upstream derives it from an unvalidated free-text form field
+   * (`type.toLowerCase().replace(/_/g, '-')`), so an Estonian title yields an
+   * Estonian slug — `üldtingimused` — and a title with a space yields a slug
+   * with a space. A character-class regex on the RESPONSE schema would fail
+   * `legalDocumentsResponseSchema` for the whole payload, so one newly
+   * authored document would take the entire resource offline every six hours
+   * until someone edited it upstream. The blast radius belongs at one row.
+   */
+  slug: z.ZodString;
+  htmlContentEt: z.ZodString;
+  htmlContentEn: z.ZodString;
+  order: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+  type: string;
+  slug: string;
+  title: {
+    et?: string | null | undefined;
+    en?: string | null | undefined;
+  };
+  order: number;
+  htmlContentEt: string;
+  htmlContentEn: string;
+}, {
+  type: string;
+  slug: string;
+  title: {
+    et?: string | null | undefined;
+    en?: string | null | undefined;
+  };
+  order: number;
+  htmlContentEt: string;
+  htmlContentEn: string;
+}>;
+type LegalDocumentRow = z.infer<typeof legalDocumentRowSchema>;
+/**
+ * `success: z.literal(true)` is the load-bearing clause, not decoration.
+ *
+ * Every upstream failure path sets `success: false` — 401 (missing header,
+ * wrong scheme, wrong key, AND an unset server-side key: all four
+ * indistinguishable, deny-by-default through one branch), 429, and 500. No
+ * route returns 200 with a degraded body. So the discriminator is `success`,
+ * never array length, and a snapshot that fails this schema can never be
+ * mistaken for an authoritative empty one.
+ */
+declare const roomTypesResponseSchema: z.ZodObject<{
+  success: z.ZodLiteral<true>;
+  roomTypes: z.ZodArray<z.ZodObject<{
+    code: z.ZodString;
+    name: z.ZodObject<{
+      et: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+      en: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+      et?: string | null | undefined;
+      en?: string | null | undefined;
+    }, {
+      et?: string | null | undefined;
+      en?: string | null | undefined;
+    }>;
+    totalArea: z.ZodNullable<z.ZodString>;
+    livingArea: z.ZodNullable<z.ZodString>;
+    commonArea: z.ZodNullable<z.ZodString>;
+    capacity: z.ZodNullable<z.ZodNumber>;
+    monthlyRent: z.ZodNullable<z.ZodString>;
+    discountedRent: z.ZodNullable<z.ZodString>;
+    dailyRent: z.ZodNullable<z.ZodString>;
+    placesOccupied: z.ZodNullable<z.ZodNumber>;
+  }, "strip", z.ZodTypeAny, {
+    code: string;
+    name: {
+      et?: string | null | undefined;
+      en?: string | null | undefined;
+    };
+    totalArea: string | null;
+    livingArea: string | null;
+    commonArea: string | null;
+    capacity: number | null;
+    placesOccupied: number | null;
+    monthlyRent: string | null;
+    dailyRent: string | null;
+    discountedRent: string | null;
+  }, {
+    code: string;
+    name: {
+      et?: string | null | undefined;
+      en?: string | null | undefined;
+    };
+    totalArea: string | null;
+    livingArea: string | null;
+    commonArea: string | null;
+    capacity: number | null;
+    placesOccupied: number | null;
+    monthlyRent: string | null;
+    dailyRent: string | null;
+    discountedRent: string | null;
+  }>, "many">;
+}, "strip", z.ZodTypeAny, {
+  success: true;
+  roomTypes: {
+    code: string;
+    name: {
+      et?: string | null | undefined;
+      en?: string | null | undefined;
+    };
+    totalArea: string | null;
+    livingArea: string | null;
+    commonArea: string | null;
+    capacity: number | null;
+    placesOccupied: number | null;
+    monthlyRent: string | null;
+    dailyRent: string | null;
+    discountedRent: string | null;
+  }[];
+}, {
+  success: true;
+  roomTypes: {
+    code: string;
+    name: {
+      et?: string | null | undefined;
+      en?: string | null | undefined;
+    };
+    totalArea: string | null;
+    livingArea: string | null;
+    commonArea: string | null;
+    capacity: number | null;
+    placesOccupied: number | null;
+    monthlyRent: string | null;
+    dailyRent: string | null;
+    discountedRent: string | null;
+  }[];
+}>;
+declare const legalDocumentsResponseSchema: z.ZodObject<{
+  success: z.ZodLiteral<true>;
+  documents: z.ZodArray<z.ZodObject<{
+    type: z.ZodString;
+    title: z.ZodObject<{
+      et: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+      en: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+      et?: string | null | undefined;
+      en?: string | null | undefined;
+    }, {
+      et?: string | null | undefined;
+      en?: string | null | undefined;
+    }>;
+    /**
+     * Accepted as free text HERE, and screened per-row in the projection.
+     *
+     * Upstream derives it from an unvalidated free-text form field
+     * (`type.toLowerCase().replace(/_/g, '-')`), so an Estonian title yields an
+     * Estonian slug — `üldtingimused` — and a title with a space yields a slug
+     * with a space. A character-class regex on the RESPONSE schema would fail
+     * `legalDocumentsResponseSchema` for the whole payload, so one newly
+     * authored document would take the entire resource offline every six hours
+     * until someone edited it upstream. The blast radius belongs at one row.
+     */
+    slug: z.ZodString;
+    htmlContentEt: z.ZodString;
+    htmlContentEn: z.ZodString;
+    order: z.ZodNumber;
+  }, "strip", z.ZodTypeAny, {
+    type: string;
+    slug: string;
+    title: {
+      et?: string | null | undefined;
+      en?: string | null | undefined;
+    };
+    order: number;
+    htmlContentEt: string;
+    htmlContentEn: string;
+  }, {
+    type: string;
+    slug: string;
+    title: {
+      et?: string | null | undefined;
+      en?: string | null | undefined;
+    };
+    order: number;
+    htmlContentEt: string;
+    htmlContentEn: string;
+  }>, "many">;
+}, "strip", z.ZodTypeAny, {
+  success: true;
+  documents: {
+    type: string;
+    slug: string;
+    title: {
+      et?: string | null | undefined;
+      en?: string | null | undefined;
+    };
+    order: number;
+    htmlContentEt: string;
+    htmlContentEn: string;
+  }[];
+}, {
+  success: true;
+  documents: {
+    type: string;
+    slug: string;
+    title: {
+      et?: string | null | undefined;
+      en?: string | null | undefined;
+    };
+    order: number;
+    htmlContentEt: string;
+    htmlContentEn: string;
+  }[];
+}>;
+/**
+ * One `site_notice` — a ticker item.
+ *
+ * No id, no code, no timestamp: `{text, isActive, order}` is the whole row as
+ * the route serves it. That absence is why `site_info` is modelled as one
+ * local row carrying an ordered list rather than as N diffable rows — there is
+ * no key an edit upstream would preserve.
+ *
+ * `isActive` is honoured HERE rather than assumed: the route returns inactive
+ * notices too, and a ticker that shows a retired notice is worse than one that
+ * shows nothing.
+ */
+declare const siteNoticeRowSchema: z.ZodObject<{
+  text: z.ZodObject<{
+    et: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    en: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  }, "strip", z.ZodTypeAny, {
+    et?: string | null | undefined;
+    en?: string | null | undefined;
+  }, {
+    et?: string | null | undefined;
+    en?: string | null | undefined;
+  }>;
+  isActive: z.ZodBoolean;
+  order: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+  text: {
+    et?: string | null | undefined;
+    en?: string | null | undefined;
+  };
+  order: number;
+  isActive: boolean;
+}, {
+  text: {
+    et?: string | null | undefined;
+    en?: string | null | undefined;
+  };
+  order: number;
+  isActive: boolean;
+}>;
+type SiteNoticeRow = z.infer<typeof siteNoticeRowSchema>;
+/**
+ * `/api/public/site-info` — reception hours plus the notice ticker.
+ *
+ * 🔴 **This envelope cannot express "not configured yet".** The route answers
+ * `200 { success: true, receptionHours: {et:'',en:''}, notices: [] }` when no
+ * row exists, which is byte-identical to an operator having deliberately
+ * cleared everything (F015). The other two resources have no such hole —
+ * theirs discriminate on `success` and on array length against a local
+ * snapshot.
+ *
+ * The schema is therefore NOT where that is solved, and deliberately so: the
+ * shape is valid either way. `projectSiteInfo` refuses an all-empty payload as
+ * unusable (D027), which is the only place that has the standing to decide
+ * that a well-formed response is not authoritative. Upstream's later
+ * `updatedAt` / `noticeCount` are not declared here, so zod strips them; why
+ * they are not needed is on `projectSiteInfo`.
+ */
+declare const siteInfoResponseSchema: z.ZodObject<{
+  success: z.ZodLiteral<true>;
+  receptionHours: z.ZodObject<{
+    et: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    en: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  }, "strip", z.ZodTypeAny, {
+    et?: string | null | undefined;
+    en?: string | null | undefined;
+  }, {
+    et?: string | null | undefined;
+    en?: string | null | undefined;
+  }>;
+  notices: z.ZodArray<z.ZodObject<{
+    text: z.ZodObject<{
+      et: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+      en: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, "strip", z.ZodTypeAny, {
+      et?: string | null | undefined;
+      en?: string | null | undefined;
+    }, {
+      et?: string | null | undefined;
+      en?: string | null | undefined;
+    }>;
+    isActive: z.ZodBoolean;
+    order: z.ZodNumber;
+  }, "strip", z.ZodTypeAny, {
+    text: {
+      et?: string | null | undefined;
+      en?: string | null | undefined;
+    };
+    order: number;
+    isActive: boolean;
+  }, {
+    text: {
+      et?: string | null | undefined;
+      en?: string | null | undefined;
+    };
+    order: number;
+    isActive: boolean;
+  }>, "many">;
+}, "strip", z.ZodTypeAny, {
+  receptionHours: {
+    et?: string | null | undefined;
+    en?: string | null | undefined;
+  };
+  notices: {
+    text: {
+      et?: string | null | undefined;
+      en?: string | null | undefined;
+    };
+    order: number;
+    isActive: boolean;
+  }[];
+  success: true;
+}, {
+  receptionHours: {
+    et?: string | null | undefined;
+    en?: string | null | undefined;
+  };
+  notices: {
+    text: {
+      et?: string | null | undefined;
+      en?: string | null | undefined;
+    };
+    order: number;
+    isActive: boolean;
+  }[];
+  success: true;
+}>;
+type SiteInfoResponse = z.infer<typeof siteInfoResponseSchema>;
+//#endregion
+//#region src/projection.d.ts
+/** Injected at the seam; see the module docblock for why it is not imported. */
+type HtmlSanitizer = (html: string) => string;
+interface ProjectionOptions {
+  /** The locale whose values live on the base entity row. `et` or `en`. */
+  readonly defaultLocale: string;
+}
+interface ProjectedRow {
+  /** The business key — `room_type.code` or `legal_document.type`. */
+  readonly key: string;
+  /** Base-row fields, including the default locale's values for translatable fields. */
+  readonly base: Record<string, unknown>;
+  /**
+   * Translatable values for the non-default locale, or `null` when that
+   * locale's text is empty upstream. `null` means "unpublish that locale",
+   * never "write an empty string".
+   */
+  readonly secondary: Record<string, unknown> | null;
+  readonly hash: string;
+}
+interface SkippedRow {
+  readonly key: string;
+  readonly reason: string;
+}
+interface ProjectionResult {
+  readonly projected: readonly ProjectedRow[];
+  readonly skipped: readonly SkippedRow[];
+}
+/** The locale that is NOT the base row's. */
+declare function secondaryLocaleOf(defaultLocale: string): string;
+declare function projectRoomTypes(rows: readonly RoomTypeRow[], options: ProjectionOptions): ProjectionResult;
+declare function projectLegalDocuments(rows: readonly LegalDocumentRow[], options: ProjectionOptions, sanitize: HtmlSanitizer): ProjectionResult;
+/**
+ * Reception hours + the notice ticker → the one `yhikas_site_info` row.
+ *
+ * ## 🔴 The refusal is the point of this function
+ *
+ * `/api/public/site-info` answers `200 { success: true, receptionHours:
+ * {et:'',en:''}, notices: [] }` when no upstream row exists. That is
+ * byte-identical to an operator having deliberately cleared both, and it is the
+ * state the endpoint is in whenever nobody has filled it in (F015). The other
+ * two resources have no equivalent hole — theirs discriminate on `success` and
+ * on array length against a local snapshot.
+ *
+ * The shipped `empty-snapshot` floor cannot cover it, and the reason is
+ * structural rather than an oversight: that rule is a row-COUNT test, and this
+ * resource always projects exactly one row. The count is 1 whether the row says
+ * anything or not, so the floor never fires and an all-empty payload would be
+ * applied as an authoritative blanking — emptying the ticker and the hours on
+ * every page of the site, silently, six hours after upstream hiccupped.
+ *
+ * So emptiness is restated here as a CONTENT test: if the default locale has
+ * neither hours nor a single active notice, the payload is refused as
+ * unusable. Local content is left exactly as it was and the failure arms the
+ * staleness watchdog, which is the same posture as an unreachable endpoint —
+ * because epistemically it is the same situation.
+ *
+ * Note what is NOT refused: hours with no notices, or notices with no hours.
+ * Both are ordinary states of a real dormitory, and refusing them would make
+ * the guard fire on exactly the operator action it exists to protect.
+ *
+ * ## Why upstream's `updatedAt: null` is not read (F015, decided 2026-09-29)
+ *
+ * yhikas-admin now answers `updatedAt: null` when both of its tables are
+ * empty, which looks like the missing "never configured" signal. It adds
+ * nothing this refusal does not already know. Upstream enforces a database
+ * CHECK that every `site_info.receptionHours` from a row has both locales
+ * non-blank; the empty `{et:'',en:''}` is a value the route FABRICATES when no
+ * row exists (its `PUBLIC_API.md`, "The one exception"). So once the
+ * constraints are deployed, "deliberately cleared" is not a state an operator
+ * can produce: empty hours can only mean no row, and every all-empty response
+ * is already "never configured". Reading the null would split one case into
+ * one case. It would also make the guard depend on a field an older
+ * deployment omits — an absent key, not an error. So the content test stays
+ * the single rule, and it holds whether or not the field is present.
+ */
+declare function projectSiteInfo(response: SiteInfoResponse, options: ProjectionOptions): ProjectionResult;
+//#endregion
+//#region src/apply.d.ts
+/**
+ * The `AdminClient` surface the sync uses, structurally.
+ *
+ * Declared rather than imported so the apply logic is unit-testable with a
+ * fake — CI runs unit tests only, with no database, so a design that could
+ * only be exercised by an integration test would in practice be exercised by
+ * nothing.
+ */
+interface SyncEntityClient {
+  findMany(options: {
+    limit: number;
+  }): Promise<Record<string, unknown>[]>;
+  create(data: Record<string, unknown>): Promise<Record<string, unknown>>;
+  update(id: string, data: Record<string, unknown>): Promise<Record<string, unknown>>;
+  updateForLocale(id: string, data: Record<string, unknown>, locale: string): Promise<Record<string, unknown>>;
+  deleteTranslation(id: string, locale: string): Promise<void>;
+}
+interface SyncLogger {
+  info(obj: Record<string, unknown>, msg: string): void;
+  warn(obj: Record<string, unknown>, msg: string): void;
+  error(obj: Record<string, unknown>, msg: string): void;
+}
+interface ApplyCounts {
+  created: number;
+  updated: number;
+  retired: number;
+  unchanged: number;
+  failed: number;
+}
+/** Thrown when at least one row failed; carries the counts that were achieved. */
+declare class YhikasApplyPartialError extends Error {
+  readonly counts: ApplyCounts;
+  constructor(resource: SyncResource, counts: ApplyCounts);
+}
+declare function readLocalRows(client: SyncEntityClient, keyField: string, limit: number): Promise<LocalRow[]>;
+interface ApplyPlanInput {
+  readonly resource: SyncResource;
+  readonly plan: DiffPlan<ProjectedRow>;
+  readonly client: SyncEntityClient;
+  /** The locale that is NOT on the base row — the one whose publish state is toggled. */
+  readonly secondaryLocale: string;
+  readonly logger: SyncLogger;
+}
+declare function applyPlan(input: ApplyPlanInput): Promise<ApplyCounts>;
+//#endregion
+//#region src/entity-client.d.ts
+/** The `AdminClient` methods the adapter forwards, structurally. */
+type AdminClientLike = ReturnType<ToolkitApp['getClient']>;
+/**
+ * @param defaultLocale The app's REAL default locale — resolved from
+ *   `@murumets-ee/content`, never configured. It is passed explicitly on every
+ *   `updateForLocale` call and is not optional, because
+ *   `elevateRequestContext` deliberately strips `locale`/`defaultLocale` from
+ *   the context it builds, and `updateForLocale` THROWS when it can resolve
+ *   the default locale from neither the options nor the context.
+ */
+declare function toSyncEntityClient(client: AdminClientLike, defaultLocale: string): SyncEntityClient;
+//#endregion
+//#region src/room-pages-table.d.ts
+/**
+ * `yhikas_room_pages` — one row per room type code the sync has given a page
+ * (block-library PR21, D010).
+ *
+ * ## Why a table, and not "does a child page with this slug exist?"
+ *
+ * The owner's rule is that a room page is created ONCE, ever: never
+ * overwritten, never re-created. A slug lookup cannot hold that — an editor
+ * who deletes the page, renames its slug, or moves it would get a fresh
+ * draft on the next six-hourly run, undoing a decision a person made on
+ * purpose. So the decision "this code has had its page" is recorded here, and
+ * a code in this table is never acted on again, whatever has since happened
+ * to the page.
+ *
+ * ## A row is CLAIMED before its page is created
+ *
+ * Two runs can overlap — a manual run-now beside the schedule, two workers,
+ * a reclaimed stale lease. So a run first inserts the code with no page
+ * (`page_id` NULL, `claim_token` its own, `claimed_at` now) in ONE
+ * `INSERT … ON CONFLICT … WHERE` statement (`TableClient.tryClaim`); only
+ * the run whose insert wins creates the page, and then fills in `page_id`.
+ * A claim that never got its page — the run crashed, or the page was refused
+ * — lapses after a lease, and the next run takes it over, re-checking by slug
+ * first. A row WITH a `page_id` is final.
+ *
+ * The slug lookup is kept as well, for the other direction: a child page the
+ * site seeded by hand (or a migration wrote) before this table knew about it
+ * is FOUND and recorded, not duplicated.
+ *
+ * Infrastructure, not content: `defineTable` + `TableClient`, per CLAUDE.md's
+ * two-tier rule, declared on the plugin's `server.tables` so `lumi migrate`
+ * sees it.
+ */
+/** How a code came to have its row. */
+declare const ROOM_PAGE_ORIGINS: readonly ["created", "found", "registered"];
+type RoomPageOrigin = (typeof ROOM_PAGE_ORIGINS)[number];
+/**
+ * Why the last attempt for a code got no page — shown on the dashboard.
+ * `room-type-path`: the page's address is still held by the synced room
+ * type's old URL row; `path`: held by another document; `refused`: anything
+ * else the page entity refused.
+ */
+declare const ROOM_PAGE_REFUSAL_KINDS: readonly ["room-type-path", "path", "refused"];
+type RoomPageRefusalKind = (typeof ROOM_PAGE_REFUSAL_KINDS)[number];
+/** How long a claim without a page is honoured before another run may take it over. */
+declare const ROOM_PAGE_CLAIM_LEASE_MS: number;
+declare const yhikasRoomPagesTable: {
+  table: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: string;
+    schema: undefined;
+    columns: {
+      [x: string]: import("drizzle-orm/pg-core").PgColumn<{
+        name: string;
+        tableName: string;
+        dataType: import("drizzle-orm").ColumnDataType;
+        columnType: string;
+        data: unknown;
+        driverParam: unknown;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: string[] | undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {}>;
+    };
+    dialect: "pg";
+  }>;
+  schema: import("@murumets-ee/db").TableDefinition<{
+    /** The room type's business key (`yhikas_room_type.code`, max 190). */readonly code: import("@murumets-ee/db").ColumnFactory<string, "varchar", true, false>;
+    /**
+     * The page row the code's page is — NULL while the code is only CLAIMED.
+     * Not a foreign key: the page may be deleted, and the row must outlive it.
+     */
+    readonly pageId: import("@murumets-ee/db").ColumnFactory<string, "uuid", false, false>;
+    /**
+     * `created` — the sync created it as a draft; `found` — a child page with
+     * the code's slug already existed under the room list page; `registered` —
+     * a site's own migration recorded it (`recordRoomPage`). Only `created`
+     * pages are listed as "waiting for text and photos".
+     */
+    readonly origin: import("@murumets-ee/db").ColumnFactory<string, "varchar", true, true>; /** The run holding the claim (a random UUID per run); NULL once the row has its page. */
+    readonly claimToken: import("@murumets-ee/db").ColumnFactory<string, "varchar", false, false>; /** When the claim was taken. A claim without a page older than the lease lapses. */
+    readonly claimedAt: import("@murumets-ee/db").ColumnFactory<Date, "timestamp", false, false>; /** The last refusal for this code, bounded — see `ROOM_PAGE_REFUSAL_KINDS`. Cleared with the page. */
+    readonly lastError: import("@murumets-ee/db").ColumnFactory<string, "varchar", false, false>;
+    readonly lastErrorKind: import("@murumets-ee/db").ColumnFactory<string, "varchar", false, false>;
+    readonly lastErrorAt: import("@murumets-ee/db").ColumnFactory<Date, "timestamp", false, false>;
+    readonly createdAt: import("@murumets-ee/db").ColumnFactory<Date, "timestamp", true, true>;
+  }>;
+  columnKinds: Readonly<Record<string, import("@murumets-ee/db").ColumnKind>>;
+  primaryKeyColumns: readonly string[];
+  makeClient: (database: import("drizzle-orm/postgres-js").PostgresJsDatabase, partitionValue?: string) => import("@murumets-ee/db").TableClient<{
+    /** The room type's business key (`yhikas_room_type.code`, max 190). */readonly code: import("@murumets-ee/db").ColumnFactory<string, "varchar", true, false>;
+    /**
+     * The page row the code's page is — NULL while the code is only CLAIMED.
+     * Not a foreign key: the page may be deleted, and the row must outlive it.
+     */
+    readonly pageId: import("@murumets-ee/db").ColumnFactory<string, "uuid", false, false>;
+    /**
+     * `created` — the sync created it as a draft; `found` — a child page with
+     * the code's slug already existed under the room list page; `registered` —
+     * a site's own migration recorded it (`recordRoomPage`). Only `created`
+     * pages are listed as "waiting for text and photos".
+     */
+    readonly origin: import("@murumets-ee/db").ColumnFactory<string, "varchar", true, true>; /** The run holding the claim (a random UUID per run); NULL once the row has its page. */
+    readonly claimToken: import("@murumets-ee/db").ColumnFactory<string, "varchar", false, false>; /** When the claim was taken. A claim without a page older than the lease lapses. */
+    readonly claimedAt: import("@murumets-ee/db").ColumnFactory<Date, "timestamp", false, false>; /** The last refusal for this code, bounded — see `ROOM_PAGE_REFUSAL_KINDS`. Cleared with the page. */
+    readonly lastError: import("@murumets-ee/db").ColumnFactory<string, "varchar", false, false>;
+    readonly lastErrorKind: import("@murumets-ee/db").ColumnFactory<string, "varchar", false, false>;
+    readonly lastErrorAt: import("@murumets-ee/db").ColumnFactory<Date, "timestamp", false, false>;
+    readonly createdAt: import("@murumets-ee/db").ColumnFactory<Date, "timestamp", true, true>;
+  }, import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: string;
+    schema: undefined;
+    columns: {
+      [x: string]: import("drizzle-orm/pg-core").PgColumn<{
+        name: string;
+        tableName: string;
+        dataType: import("drizzle-orm").ColumnDataType;
+        columnType: string;
+        data: unknown;
+        driverParam: unknown;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: string[] | undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+      }, {}, {}>;
+    };
+    dialect: "pg";
+  }>>;
+  partitionColumn: "code" | "createdAt" | "lastError" | "pageId" | "origin" | "claimToken" | "claimedAt" | "lastErrorKind" | "lastErrorAt" | undefined;
+};
+//#endregion
+//#region src/room-page-registry.d.ts
+interface RoomPageRecord {
+  readonly code: string;
+  /** `null` while the code is only claimed (or its last attempt was refused). */
+  readonly pageId: string | null;
+  readonly origin: RoomPageOrigin;
+  readonly createdAt: Date;
+  readonly lastError: string | null;
+  readonly lastErrorKind: RoomPageRefusalKind | null;
+  readonly lastErrorAt: Date | null;
+}
+/** What a run needs to know about a code before acting on it. */
+interface RoomPageState {
+  /** Set once the code has its page — final. */
+  readonly pageId: string | null;
+  /** A run's claim, still on the row (that run is creating the page, or crashed doing so). */
+  readonly claimToken: string | null;
+  /** When the last attempt was refused — drives the back-off and the ordering. */
+  readonly lastErrorAt: Date | null;
+}
+interface RoomPageRefusal {
+  readonly kind: RoomPageRefusalKind;
+  readonly message: string;
+}
+interface RoomPageRegistry {
+  /** The rows of `codes` that exist, by code. Read in chunks — nothing dropped. */
+  states(codes: readonly string[]): Promise<ReadonlyMap<string, RoomPageState>>;
+  /**
+   * Atomically claim `code` for creating its page. `true` only for the one
+   * run that may create it: a new code, or a lapsed claim with no page.
+   */
+  claim(code: string, token: string, now: Date): Promise<boolean>;
+  /** Give a claim held by `token` its page. `false` when the claim is no longer this run's. */
+  complete(code: string, token: string, pageId: string, now: Date): Promise<boolean>;
+  /** Keep why a claimed code got no page, and release the claim so the next run retries. */
+  refuse(code: string, token: string, refusal: RoomPageRefusal, now: Date): Promise<void>;
+  /**
+   * Record a page that already exists (found by slug, or written by a site's
+   * migration). Never moves a page already recorded, and never overrides a
+   * FRESH claim of another run. `true` when this call recorded it.
+   */
+  record(code: string, pageId: string, origin: RoomPageOrigin, now: Date): Promise<boolean>;
+  /** The newest rows first, at most `limit`. */
+  list(limit: number): Promise<readonly RoomPageRecord[]>;
+}
+type RoomPagesClient = ReturnType<typeof yhikasRoomPagesTable.makeClient>;
+/** Codes per `IN (…)` read — the whole input is read, in chunks of this size. */
+declare const ROOM_PAGE_READ_CHUNK = 100;
+/** Thrown for a code or page id that cannot be recorded. */
+declare class YhikasRoomPageRecordError extends Error {
+  constructor(message: string);
+}
+declare function createRoomPageRegistry(client: RoomPagesClient): RoomPageRegistry;
+//#endregion
+export { EN_LOCALE as $, secondaryLocaleOf as A, roomTypesResponseSchema as B, ProjectedRow as C, projectLegalDocuments as D, SkippedRow as E, SiteNoticeRow as F, PlanDiffInput as G, siteNoticeRowSchema as H, legalDocumentRowSchema as I, stableHash as J, SanityFloor as K, legalDocumentsResponseSchema as L, MultilingualText as M, RoomTypeRow as N, projectRoomTypes as O, SiteInfoResponse as P, DECLARED_VAT_TREATMENT as Q, multilingualTextSchema as R, HtmlSanitizer as S, ProjectionResult as T, DiffPlan as U, siteInfoResponseSchema as V, LocalRow as W, BASE_URL_ENV_VAR as X, API_KEY_ENV_VAR as Y, DECLARED_CURRENCY as Z, SyncEntityClient as _, YhikasRoomPageRecordError as a, SITE_INFO_RESOURCE as at, applyPlan as b, ROOM_PAGE_ORIGINS as c, SyncResource as ct, RoomPageRefusalKind as d, YHIKAS_SYNC_PLUGIN_NAME as dt, ET_LOCALE as et, yhikasRoomPagesTable as f, ApplyPlanInput as g, ApplyCounts as h, RoomPageRegistry as i, SITE_INFO_KEY as it, LegalDocumentRow as j, projectSiteInfo as k, ROOM_PAGE_REFUSAL_KINDS as l, WATCHDOG_JOB_NAME as lt, toSyncEntityClient as m, RoomPageRecord as n, MAX_SITE_NOTICES as nt, createRoomPageRegistry as o, SYNC_JOB_NAME as ot, AdminClientLike as p, planDiff as q, RoomPageRefusal as r, ROOM_TYPES_RESOURCE as rt, ROOM_PAGE_CLAIM_LEASE_MS as s, SYNC_RESOURCES as st, ROOM_PAGE_READ_CHUNK as t, LEGAL_DOCUMENTS_RESOURCE as tt, RoomPageOrigin as u, YHIKAS_SYNC_ACTOR_ID as ut, SyncLogger as v, ProjectionOptions as w, readLocalRows as x, YhikasApplyPartialError as y, roomTypeRowSchema as z };
+//# sourceMappingURL=room-page-registry-CnqXH_Ls.d.mts.map