@shapio/cms 0.0.0-stage → 0.2.1

package/dist/index.d.ts

@@ -0,0 +1,1051 @@
+import { A as ServiceFactoryContext, C as HookEvent, D as MediaUsage, E as MediaReferenceService, F as PermissionEvaluator, I as Principal, L as DB, M as ShapioServices, N as defineConfig, O as ModelHooks, P as isHookError, R as OutboxEvents, S as HookError, T as JobHandlerContext, _ as ExtensionRoute, a as BeforeHookContext, b as ExtensionSite, c as ContentReadOptions, d as EXTENSION_CONTRACT_VERSION, f as EnqueueOptions, g as ExtensionJobService, h as ExtensionJobHandler, i as BeforeHook, j as ShapioConfig, k as ServiceFactory, l as ContentReadService, m as ExtensionHostConfig, n as AfterHookContext, o as BeforeHookEvent, p as EntryData, r as AfterHookEvent, s as ContentReadEntry, t as AfterHook, u as CustomServices, v as ExtensionRouteOptions, w as HookModel, x as HookEntry, y as ExtensionServices, z as ContentData } from "./public-CKU0Gkfq.js";
+import { FastifyBaseLogger, FastifyInstance } from "fastify";
+import { Kysely, Selectable, Transaction } from "kysely";
+import { Static, Type } from "typebox";
+import "pino";
+import { BlockList } from "node:net";
+//#region src/config/schema.d.ts
+/**
+ * Every setting Shapio reads from the environment. This is the only place that knows env var names;
+ * the rest of the code receives a typed `AppConfig`. Cross-field rules live in config/index.ts.
+ */
+declare const configSchema: Type.TObject<{
+  NODE_ENV: Type.TEnum<["development", "production", "test"]>;
+  HOST: Type.TString;
+  PORT: Type.TInteger;
+  LOG_LEVEL: Type.TEnum<["fatal", "error", "warn", "info", "debug", "trace", "silent"]>;
+  LOG_PRETTY: Type.TBoolean;
+  /** Origin users reach Shapio at, e.g. https://cms.example.com. Required in production. */
+  PUBLIC_URL: Type.TOptional<Type.TString>;
+  /** Sub-path Shapio is served under, e.g. /cms. Prefixes every route and the admin. */
+  BASE_PATH: Type.TString;
+  /** `true`, `false`, or the number of proxy hops to trust for X-Forwarded-* headers. */
+  TRUST_PROXY: Type.TString;
+  CORS_ORIGINS: Type.TString;
+  RATE_LIMIT_MAX: Type.TInteger;
+  RATE_LIMIT_WINDOW_MS: Type.TInteger;
+  /** Requests per window and IP for public media files (`/api/media/f/*` without a signature). */
+  MEDIA_RATE_LIMIT_MAX: Type.TInteger;
+  /** HTTPS from certificate files. Both or neither. */
+  TLS_CERT_FILE: Type.TOptional<Type.TString>;
+  TLS_KEY_FILE: Type.TOptional<Type.TString>;
+  /** How often the certificate files are re-read; a changed pair is applied without a restart. */
+  TLS_RELOAD_INTERVAL_MS: Type.TInteger;
+  /** Plain-HTTP listener that redirects to HTTPS on PUBLIC_URL. Only with TLS_CERT_FILE/TLS_KEY_FILE. */
+  HTTP_PORT: Type.TOptional<Type.TInteger>;
+  DATABASE_URL: Type.TString;
+  DATABASE_POOL_MAX: Type.TInteger;
+  MIGRATE_ON_START: Type.TBoolean;
+  /**
+   * LISTEN for schema-change notifications to refresh caches early. Turn off where LISTEN does not work
+   * (e.g. PgBouncer in transaction mode); every request still checks the durable schema version.
+   */
+  SCHEMA_LISTEN: Type.TBoolean;
+  /**
+   * The instance's general signing secret (preview tokens, private-media URLs and upload grants, app-user token
+   * keys, the key that encrypts stored webhook and deployment secrets). At least 32 characters.
+   * Optional: when unset, one is generated on first boot and stored in the database (system_settings).
+   * Admin sessions and CSRF do not use it (their secrets are server-side).
+   */
+  SESSION_SECRET: Type.TOptional<Type.TString>;
+  /**
+   * First-run setup. `false` (default): whoever opens the Setup screen first, while no admin exists, creates
+   * the owner. `true`: setup also needs the one-time token the server logs at boot (for installs reachable by
+   * others before setup). `shapio admin create` works either way.
+   */
+  SETUP_REQUIRE_TOKEN: Type.TBoolean;
+  WORKER_MODE: Type.TEnum<["inline", "dedicated"]>;
+  WORKER_CONCURRENCY: Type.TInteger;
+  WORKER_POLL_INTERVAL_MS: Type.TInteger;
+  JOB_LEASE_MS: Type.TInteger;
+  SHUTDOWN_TIMEOUT_MS: Type.TInteger;
+  /**
+   * Days to keep finished bookkeeping: succeeded jobs, dispatched outbox events, after-hook run records,
+   * resolved content health findings.
+   */
+  RETENTION_DAYS: Type.TInteger;
+  /** Days after which an untouched draft (or unpublished changes) shows up in the Inbox. */
+  HEALTH_STALE_DAYS: Type.TInteger;
+  INSTANCE_ID: Type.TOptional<Type.TString>;
+  /**
+   * Media storage. `local` writes under MEDIA_PATH; `s3` uses an S3-compatible service (package G). The S3
+   * settings may be set with either driver: `shapio media migrate` copies between the two.
+   */
+  STORAGE_DRIVER: Type.TEnum<["local", "s3"]>;
+  MEDIA_PATH: Type.TString;
+  STORAGE_S3_BUCKET: Type.TOptional<Type.TString>;
+  STORAGE_S3_REGION: Type.TOptional<Type.TString>;
+  STORAGE_S3_ENDPOINT: Type.TOptional<Type.TString>;
+  STORAGE_S3_ACCESS_KEY_ID: Type.TOptional<Type.TString>;
+  STORAGE_S3_SECRET_ACCESS_KEY: Type.TOptional<Type.TString>;
+  STORAGE_S3_FORCE_PATH_STYLE: Type.TBoolean;
+  /**
+   * Base URL public media is served from, with the object key appended: a CDN or public bucket domain in
+   * front of S3/R2, or a CDN whose origin is `{PUBLIC_URL}{BASE_PATH}/api/media/f`. Unset: Shapio serves it.
+   */
+  MEDIA_PUBLIC_BASE_URL: Type.TOptional<Type.TString>;
+  /** Largest file an upload may be, in bytes. */
+  MEDIA_MAX_UPLOAD_BYTES: Type.TInteger;
+  /** Comma-separated MIME types or `type/*` wildcards uploads may have (checked against the file's bytes). */
+  MEDIA_ALLOWED_TYPES: Type.TString;
+  /**
+   * The project's shapio.config.{ts,mts,js,mjs} (hooks, custom routes and services, editors, jobs; ADR 0009).
+   * Default: looked up in the working directory; none means no extensions.
+   */
+  SHAPIO_CONFIG_PATH: Type.TOptional<Type.TString>;
+  /** Outgoing email (invitations, password resets). `console` logs messages instead of sending them. */
+  EMAIL_TRANSPORT: Type.TEnum<["console", "smtp"]>;
+  /** Sender, e.g. `Shapio <cms@example.com>`. Defaults to no-reply@<PUBLIC_URL host>. */
+  EMAIL_FROM: Type.TOptional<Type.TString>;
+  SMTP_HOST: Type.TOptional<Type.TString>;
+  SMTP_PORT: Type.TInteger;
+  /** true = TLS from the first byte (port 465); false = STARTTLS when the server offers it. */
+  SMTP_SECURE: Type.TBoolean;
+  SMTP_USER: Type.TOptional<Type.TString>;
+  SMTP_PASSWORD: Type.TOptional<Type.TString>;
+  /**
+   * App users (end users of your sites and apps, package I). `true`: an app user must confirm their email
+   * before signing in (needs APP_AUTH_CONFIRM_EMAIL_URL).
+   */
+  APP_AUTH_REQUIRE_EMAIL_CONFIRMATION: Type.TBoolean;
+  /** Lifetime of an app-user access token (JWT), in seconds. Short: blocking takes effect immediately anyway. */
+  APP_AUTH_ACCESS_TOKEN_TTL_SECONDS: Type.TInteger;
+  /** Lifetime of an app-user refresh token, in days. Each refresh issues a new one (rotation). */
+  APP_AUTH_REFRESH_TOKEN_TTL_DAYS: Type.TInteger;
+  /**
+   * Page on your site that confirms an email address: Shapio emails `<url>#token=…`, the page POSTs the token
+   * to /api/app-auth/confirm-email. Unset: no confirmation emails are sent.
+   */
+  APP_AUTH_CONFIRM_EMAIL_URL: Type.TOptional<Type.TString>;
+  /** Page on your site that sets a new password from `<url>#token=…`. Unset: password reset is unavailable. */
+  APP_AUTH_RESET_PASSWORD_URL: Type.TOptional<Type.TString>;
+  /**
+   * Where OAuth sign-in may send the browser back to (comma-separated): exact origins
+   * (`https://www.example.com`) or custom-scheme prefixes for native apps (`myapp://auth`). Unset: the
+   * origins in CORS_ORIGINS plus PUBLIC_URL's.
+   */
+  APP_AUTH_RETURN_URLS: Type.TOptional<Type.TString>;
+  /** Sign in with Google (OAuth client of type "Web application"; callback `{PUBLIC_URL}{BASE_PATH}/api/app-auth/oauth/google/callback`). */
+  APP_AUTH_GOOGLE_CLIENT_ID: Type.TOptional<Type.TString>;
+  APP_AUTH_GOOGLE_CLIENT_SECRET: Type.TOptional<Type.TString>;
+  /** Sign in with GitHub (OAuth app; callback `{PUBLIC_URL}{BASE_PATH}/api/app-auth/oauth/github/callback`). */
+  APP_AUTH_GITHUB_CLIENT_ID: Type.TOptional<Type.TString>;
+  APP_AUTH_GITHUB_CLIENT_SECRET: Type.TOptional<Type.TString>;
+  /**
+   * Publishing (package H). Webhooks and deploy connections never reach private, loopback or link-local
+   * addresses unless the address is in this comma-separated CIDR list AND the webhook/connection opts in.
+   */
+  OUTBOUND_PRIVATE_NETWORK_ALLOWLIST: Type.TString;
+  /**
+   * Environment variables a deployment secret may reference as `${ENV:NAME}`, beyond those starting with
+   * SHAPIO_SECRET_ (always allowed): comma-separated names or prefixes ending in `*`, e.g. `CF_PAGES_*`.
+   */
+  SECRET_ENV_ALLOWLIST: Type.TString;
+  OUTBOUND_TIMEOUT_MS: Type.TInteger;
+  /** Cloudflare API base for the Cloudflare Pages adapter (tests point it at a local fake). */
+  CLOUDFLARE_API_URL: Type.TString;
+  CLOUDFLARE_DASHBOARD_URL: Type.TString;
+  /** GitHub REST API base for schema write-back (GitHub Enterprise Server: https://host/api/v3). */
+  GITHUB_API_URL: Type.TString;
+  /** Vercel REST API base for the Vercel adapter's deployment status (tests point it at a local fake). */
+  VERCEL_API_URL: Type.TString;
+  /** Netlify API base for the Netlify adapter's builds and deploy status (tests point it at a local fake). */
+  NETLIFY_API_URL: Type.TString;
+  /** GraphQL at /api/graphql (package J). Shares REST's permissions, filters and page-size limits. */
+  GRAPHQL_ENABLED: Type.TBoolean;
+  GRAPHQL_MAX_DEPTH: Type.TInteger;
+  /** Estimated cost ceiling per query: each field costs 1, multiplied by enclosing page sizes and lists. */
+  GRAPHQL_MAX_COMPLEXITY: Type.TInteger;
+  /** GraphiQL for admins at /api/graphql/playground (self-hosted assets). */
+  GRAPHQL_PLAYGROUND_ENABLED: Type.TBoolean;
+  /** Let anonymous callers and app users introspect the schema. Admins and API tokens always can. */
+  GRAPHQL_PUBLIC_INTROSPECTION: Type.TBoolean;
+  /** Count which fields delivery reads use, per token (counts only, never payloads; stays on this server). */
+  USAGE_TRACKING: Type.TBoolean;
+  /** Days of field-usage counters to keep. */
+  USAGE_RETENTION_DAYS: Type.TInteger;
+  /** How often each instance writes its in-memory usage counters to the database. */
+  USAGE_FLUSH_INTERVAL_MS: Type.TInteger;
+  /**
+   * Editor assists (alt text, summaries, translation, rewrites, schema drafts) with your own model provider.
+   * Unset (the default): assist is off and nothing is ever sent to a model provider. `openai-compatible`
+   * covers Ollama, LM Studio and vLLM (set AI_BASE_URL). See documentation/assist.md.
+   */
+  AI_PROVIDER: Type.TOptional<Type.TEnum<["anthropic", "openai", "openai-compatible"]>>;
+  /** The model name the provider expects, e.g. a model ID or `llama3.2-vision`. Required with AI_PROVIDER. */
+  AI_MODEL: Type.TOptional<Type.TString>;
+  /** The provider API key. Required for `anthropic` and `openai`; optional for `openai-compatible`. */
+  AI_API_KEY: Type.TOptional<Type.TString>;
+  /**
+   * The provider's API base including its version path, e.g. `http://127.0.0.1:11434/v1` for Ollama
+   * (Shapio appends `/chat/completions` or `/messages`). Required for `openai-compatible`; overrides the public
+   * endpoint for the others. Loopback and private addresses are allowed: this is operator configuration.
+   */
+  AI_BASE_URL: Type.TOptional<Type.TString>;
+  /** Most tokens one model response may use. */
+  AI_MAX_TOKENS: Type.TInteger;
+  /** Timeout of each request to the model provider. */
+  AI_TIMEOUT_MS: Type.TInteger;
+  /** Assist requests per minute and admin (or admin API token). */
+  AI_RATE_LIMIT_MAX: Type.TInteger;
+}>;
+type RawConfig = Static<typeof configSchema>;
+//#endregion
+//#region src/config/assist.d.ts
+type AiProvider = NonNullable<RawConfig['AI_PROVIDER']>;
+/** The model provider assist talks to. Never logged: `apiKey` is a secret. */
+type AssistProviderConfig = {
+  provider: AiProvider;
+  model: string;
+  apiKey: string | undefined;
+  /** API base including the version path, without a trailing slash. */
+  baseUrl: string;
+  maxTokens: number;
+  timeoutMs: number;
+};
+/** Editor assists (plan agentic-ecosystem §A0, §I). `provider` undefined = assist is off. */
+type AssistConfig = {
+  provider: AssistProviderConfig | undefined;
+  /** Assist requests per minute and actor. */
+  rateLimitMax: number;
+};
+//#endregion
+//#region src/config/graphql.d.ts
+/** The GraphQL endpoint (package J, ADR 0006). */
+type GraphqlConfig = {
+  /** Serve `/api/graphql`. */
+  enabled: boolean;
+  /** Deepest field nesting a query may have. */
+  maxDepth: number;
+  /** Highest estimated cost a query may have (schema/codegen/graphql/complexity.ts). */
+  maxComplexity: number;
+  /** Serve GraphiQL at `/api/graphql/playground` (admin principals only). */
+  playgroundEnabled: boolean;
+  /** Allow schema introspection for anonymous callers and app users (admins and API tokens always may). */
+  publicIntrospection: boolean;
+};
+//#endregion
+//#region src/config/publishing.d.ts
+/** Outbound requests (webhooks, deploy hooks, provider APIs) and provider endpoints (package H). */
+type PublishingConfig = {
+  /**
+   * CIDRs (or single IPs) that webhooks and deployment connections may reach although they are private,
+   * loopback or link-local. Each webhook or connection must also opt in (`allowPrivateNetwork`).
+   */
+  privateNetworkAllowlist: string[];
+  /** SECRET_ENV_ALLOWLIST: extra variable names or `PREFIX*` patterns `${ENV:NAME}` may name (SHAPIO_SECRET_* always). */
+  secretEnvAllowlist: string[];
+  /** Timeout for one outbound request, connect to last byte. */
+  outboundTimeoutMs: number;
+  /** Cloudflare API base (no trailing slash); the token is only ever sent here. */
+  cloudflareApiUrl: string;
+  /** Cloudflare dashboard base, for links to a deployment's build log. */
+  cloudflareDashboardUrl: string;
+  /** GitHub REST API base (no trailing slash); set it for GitHub Enterprise Server. */
+  githubApiUrl: string;
+  /** Vercel REST API base (no trailing slash); the Vercel API token is only ever sent here. */
+  vercelApiUrl: string;
+  /** Netlify API base (no trailing slash); the Netlify API token is only ever sent here. */
+  netlifyApiUrl: string;
+};
+//#endregion
+//#region src/config/usage.d.ts
+/** Field usage from delivery traffic (plan developer-face §5). */
+type UsageConfig = {
+  /** Count delivery reads per field and principal. */
+  enabled: boolean;
+  /** Days of daily counters the retention job keeps. */
+  retentionDays: number;
+  /** How often the in-memory counters are written (one multi-row upsert per table). */
+  flushIntervalMs: number;
+};
+//#endregion
+//#region src/config/index.d.ts
+type NodeEnv = RawConfig['NODE_ENV'];
+type WorkerMode = RawConfig['WORKER_MODE'];
+type TlsConfig = {
+  mode: 'off';
+} | {
+  mode: 'files';
+  certFile: string;
+  keyFile: string;
+  reloadIntervalMs: number;
+};
+type S3StorageConfig = {
+  bucket: string;
+  region: string | undefined;
+  endpoint: string | undefined;
+  accessKeyId: string | undefined;
+  secretAccessKey: string | undefined;
+  forcePathStyle: boolean;
+};
+type StorageConfig = {
+  /** Where new uploads go. Existing assets are read from the driver recorded on each asset. */
+  driver: 'local' | 's3';
+  mediaPath: string;
+  /** Set whenever STORAGE_S3_BUCKET is, whatever the driver (for `shapio media migrate`). */
+  s3: S3StorageConfig | undefined;
+  /** CDN or public bucket base for public media, without a trailing slash; undefined = served by Shapio. */
+  publicBaseUrl: string | undefined;
+  maxUploadBytes: number;
+  /** MIME types or `type/*` wildcards, lower case. */
+  allowedTypes: string[];
+};
+type EmailConfig = {
+  transport: 'console';
+  from: string;
+} | {
+  transport: 'smtp';
+  from: string;
+  host: string;
+  port: number;
+  secure: boolean;
+  user: string | undefined;
+  password: string | undefined;
+};
+type OAuthClientConfig = {
+  clientId: string;
+  clientSecret: string;
+};
+type AppAuthConfig = {
+  requireEmailConfirmation: boolean;
+  accessTokenTtlSeconds: number;
+  refreshTokenTtlMs: number;
+  confirmEmailUrl: string | undefined;
+  resetPasswordUrl: string | undefined;
+  /** APP_AUTH_RETURN_URLS as listed (origins or custom-scheme prefixes); undefined = CORS_ORIGINS + PUBLIC_URL. */
+  returnUrls: string[] | undefined;
+  /** Configured OAuth providers only. */
+  oauth: {
+    google: OAuthClientConfig | undefined;
+    github: OAuthClientConfig | undefined;
+  };
+};
+type AppConfig = {
+  nodeEnv: NodeEnv;
+  instanceId: string;
+  server: {
+    host: string;
+    port: number;
+    /** Plain-HTTP listener that redirects to HTTPS; undefined = none. */
+    httpPort: number | undefined;
+    trustProxy: boolean | number;
+    /** Origin without a trailing slash, e.g. `https://cms.example.com`. */
+    publicUrl: string;
+    /** `''` at the root, otherwise `/cms` (leading slash, no trailing slash). */
+    basePath: string;
+  };
+  tls: TlsConfig;
+  log: {
+    level: RawConfig['LOG_LEVEL'];
+    pretty: boolean;
+  };
+  database: {
+    url: string;
+    poolMax: number;
+    migrateOnStart: boolean;
+  };
+  /** `listen`: use LISTEN/NOTIFY to refresh schema caches early (correctness never depends on it). */
+  schema: {
+    listen: boolean;
+  };
+  http: {
+    corsOrigins: string[];
+    rateLimitMax: number;
+    rateLimitWindowMs: number;
+    /** Public media files get their own, higher limit (pages load many images). */
+    mediaRateLimitMax: number;
+  };
+  sessionSecret: string | undefined;
+  /** First-run setup: `requireToken` = the endpoint also needs the one-time token logged at boot. */
+  setup: {
+    requireToken: boolean;
+  };
+  worker: {
+    mode: WorkerMode;
+    concurrency: number;
+    pollIntervalMs: number;
+    leaseMs: number;
+  };
+  shutdownTimeoutMs: number;
+  /** The daily `system.retention` job prunes finished bookkeeping older than this. */
+  retention: {
+    days: number;
+  };
+  storage: StorageConfig;
+  /** Project extensions (ADR 0009): an explicit config file, else the working directory is searched. */
+  extensions: {
+    configPath: string | undefined;
+  };
+  email: EmailConfig;
+  /** App users (end users of the user's sites and apps): sign-in, tokens, OAuth. */
+  appAuth: AppAuthConfig;
+  /** Outbound requests and provider endpoints for webhooks and deployments. */
+  publishing: PublishingConfig;
+  /** The GraphQL endpoint and its limits. */
+  graphql: GraphqlConfig;
+  /** Field usage counters from delivery traffic. */
+  usage: UsageConfig;
+  /** Content health rules (the Inbox). */
+  health: {
+    staleDays: number;
+  };
+  /** Editor assists with the operator's own model provider; off unless AI_PROVIDER is set. */
+  assist: AssistConfig;
+};
+type EnvSource = Record<string, string | undefined>;
+/**
+ * Validates the environment against the config schema and the cross-field rules, and returns typed
+ * config. Throws (listing every problem) so startup fails fast.
+ */
+export declare const loadConfig: (env?: EnvSource) => AppConfig;
+//#endregion
+//#region src/appAuth/oauth/types.d.ts
+/** OAuth providers app users can sign in with (build plan §7, decision 6). */
+declare const OAUTH_PROVIDERS: readonly ["google", "github"];
+type OAuthProviderId = (typeof OAUTH_PROVIDERS)[number];
+/** Where a provider lives. Real endpoints by default; tests point them at a local fake. */
+type OAuthEndpoints = {
+  authorize: string;
+  token: string;
+  userInfo: string;
+  /** GitHub only: the account's email addresses with their verification state. */
+  emails?: string;
+};
+//#endregion
+//#region src/services/actorContext.d.ts
+/** The site a request or job is about (sites plan §H): its stable ID and its key. */
+type SiteRef = {
+  id: string;
+  key: string;
+};
+//#endregion
+//#region ../../packages/schema/dist/index.d.ts
+//#endregion
+//#region src/types/dataTypes.d.ts
+/** Every stored data type. A field's data type is separate from the editor that renders it (brief §2.5). */
+declare const DATA_TYPES: readonly ["string", "text", "richtext", "number", "integer", "decimal", "biginteger", "boolean", "date", "datetime", "time", "enum", "json", "slug", "email", "url", "uid", "media", "relation", "component", "dynamiczone"];
+type DataType = (typeof DATA_TYPES)[number];
+//#endregion
+//#region src/types/json.d.ts
+type JsonPrimitive = string | number | boolean | null;
+type JsonValue = JsonPrimitive | JsonValue[] | {
+  [key: string]: JsonValue;
+};
+declare const SETTINGS_SCHEMAS: {
+  string: Type.TObject<{
+    pattern: Type.TOptional<Type.TString>;
+    minLength: Type.TOptional<Type.TInteger>;
+    maxLength: Type.TOptional<Type.TInteger>;
+  }>;
+  text: Type.TObject<{
+    minLength: Type.TOptional<Type.TInteger>;
+    maxLength: Type.TOptional<Type.TInteger>;
+  }>;
+  richtext: Type.TObject<{
+    formatVersion: Type.TOptional<Type.TInteger>;
+    maxLength: Type.TOptional<Type.TInteger>;
+  }>;
+  number: Type.TObject<{
+    min: Type.TOptional<Type.TNumber>;
+    max: Type.TOptional<Type.TNumber>;
+  }>;
+  integer: Type.TObject<{
+    min: Type.TOptional<Type.TInteger>;
+    max: Type.TOptional<Type.TInteger>;
+  }>;
+  decimal: Type.TObject<{
+    precision: Type.TOptional<Type.TInteger>;
+    scale: Type.TOptional<Type.TInteger>;
+    min: Type.TOptional<Type.TString>;
+    max: Type.TOptional<Type.TString>;
+  }>;
+  biginteger: Type.TObject<{
+    min: Type.TOptional<Type.TString>;
+    max: Type.TOptional<Type.TString>;
+  }>;
+  boolean: Type.TObject<{}>;
+  date: Type.TObject<{
+    min: Type.TOptional<Type.TString>;
+    max: Type.TOptional<Type.TString>;
+  }>;
+  datetime: Type.TObject<{
+    min: Type.TOptional<Type.TString>;
+    max: Type.TOptional<Type.TString>;
+  }>;
+  time: Type.TObject<{
+    min: Type.TOptional<Type.TString>;
+    max: Type.TOptional<Type.TString>;
+  }>;
+  enum: Type.TObject<{
+    values: Type.TArray<Type.TObject<{
+      value: Type.TString;
+      label: Type.TString;
+    }>>;
+    multiple: Type.TOptional<Type.TBoolean>;
+  }>;
+  json: Type.TObject<{}>;
+  slug: Type.TObject<{
+    sourceFieldId: Type.TOptional<Type.TString>;
+    minLength: Type.TOptional<Type.TInteger>;
+    maxLength: Type.TOptional<Type.TInteger>;
+  }>;
+  email: Type.TObject<{}>;
+  url: Type.TObject<{
+    protocols: Type.TOptional<Type.TArray<Type.TEnum<["http", "https", "mailto", "tel"]>>>;
+  }>;
+  uid: Type.TObject<{
+    minLength: Type.TOptional<Type.TInteger>;
+    maxLength: Type.TOptional<Type.TInteger>;
+  }>;
+  media: Type.TObject<{
+    min: Type.TOptional<Type.TInteger>;
+    max: Type.TOptional<Type.TInteger>;
+    multiple: Type.TOptional<Type.TBoolean>;
+    allowedKinds: Type.TOptional<Type.TArray<Type.TEnum<["image", "video", "audio", "document", "other"]>>>;
+  }>;
+  relation: Type.TObject<{
+    min: Type.TOptional<Type.TInteger>;
+    max: Type.TOptional<Type.TInteger>;
+    target: Type.TString;
+    cardinality: Type.TEnum<["one", "many"]>;
+  }>;
+  component: Type.TObject<{
+    min: Type.TOptional<Type.TInteger>;
+    max: Type.TOptional<Type.TInteger>;
+    component: Type.TString;
+    repeatable: Type.TOptional<Type.TBoolean>;
+  }>;
+  dynamiczone: Type.TObject<{
+    min: Type.TOptional<Type.TInteger>;
+    max: Type.TOptional<Type.TInteger>;
+    components: Type.TArray<Type.TString>;
+  }>;
+};
+type SettingsSchemas = typeof SETTINGS_SCHEMAS;
+/** Settings as authored (defaults may be missing). */
+type DataTypeSettingsInput = { [T in DataType]: Static<SettingsSchemas[T]>; };
+/** Settings after normalization: the defaulted keys are always present. */
+type DataTypeSettings = Omit<DataTypeSettingsInput, 'richtext' | 'enum' | 'media' | 'component'> & {
+  richtext: DataTypeSettingsInput['richtext'] & {
+    formatVersion: number;
+  };
+  enum: DataTypeSettingsInput['enum'] & {
+    multiple: boolean;
+  };
+  media: DataTypeSettingsInput['media'] & {
+    multiple: boolean;
+  };
+  component: DataTypeSettingsInput['component'] & {
+    repeatable: boolean;
+  };
+};
+//#endregion
+//#region src/types/definitions.d.ts
+declare const MODEL_KINDS: readonly ["collection", "singleton"];
+type ModelKind = (typeof MODEL_KINDS)[number];
+declare const SORT_DIRECTIONS: readonly ["asc", "desc"];
+type SortDirection = (typeof SORT_DIRECTIONS)[number];
+type EditorChoice = {
+  id: string;
+  options: Record<string, JsonValue>;
+};
+type FieldBase = {
+  id: string;
+  apiKey: string;
+  label: string;
+  description?: string;
+  required: boolean;
+  localized: boolean;
+  public: boolean;
+  unique: boolean;
+  filterable: boolean;
+  sortable: boolean;
+  deprecated: boolean;
+  defaultValue?: JsonValue;
+  editor: EditorChoice;
+};
+/** A normalized field. Narrow on `type` to get typed `settings`. */
+type FieldDefinition<T extends DataType = DataType> = { [K in T]: FieldBase & {
+  type: K;
+  settings: DataTypeSettings[K];
+}; }[T];
+type FieldGroup = {
+  id: string;
+  label: string;
+  fieldIds: string[];
+};
+type ModelDisplay = {
+  titleFieldId?: string;
+  listFieldIds?: string[];
+  defaultSort?: {
+    fieldId: string;
+    direction: SortDirection;
+  };
+  groups?: FieldGroup[];
+  canvasFieldIds?: string[];
+  coverFieldId?: string;
+  stripFieldIds?: string[];
+};
+type ComponentDisplay = {
+  titleFieldId?: string;
+  groups?: FieldGroup[];
+};
+type ModelDefinition = {
+  id: string;
+  kind: ModelKind;
+  apiKey: string;
+  /**
+   * Present on collections (filled by normalizing), absent on singletons. Read it through `routeKeyOf`,
+   * which also covers a stored definition that predates plural API IDs.
+   */
+  pluralApiKey?: string;
+  label: string;
+  description?: string;
+  localized: boolean;
+  draftAndPublish: boolean;
+  fields: FieldDefinition[];
+  display: ModelDisplay;
+};
+type ComponentDefinition = {
+  id: string;
+  kind: 'component';
+  apiKey: string;
+  label: string;
+  description?: string;
+  category?: string;
+  icon?: string;
+  fields: FieldDefinition[];
+  display: ComponentDisplay;
+};
+//#endregion
+//#region src/diff/types.d.ts
+declare const CHANGE_KINDS: readonly ["definition.added", "definition.removed", "definition.apiKey", "definition.pluralApiKey", "definition.metadata", "model.kind", "model.localized", "model.draftAndPublish", "field.added", "field.removed", "field.order", "field.apiKey", "field.metadata", "field.editor", "field.type", "field.required", "field.localized", "field.public", "field.deprecated", "field.unique", "field.filterable", "field.sortable", "field.settings"];
+type ChangeKind = (typeof CHANGE_KINDS)[number];
+/**
+ * One difference between two versions of a definition. `property` names the changed property for
+ * `*.metadata` (`label`, `description`, ...) and `field.settings` (the settings key); `from`/`to` hold the
+ * old and new values (absent when the side does not exist).
+ */
+type SchemaChange = {
+  kind: ChangeKind;
+  definitionId: string;
+  fieldId?: string;
+  property?: string;
+  from?: JsonValue;
+  to?: JsonValue;
+};
+//#endregion
+//#region src/content/model.d.ts
+/** A collection or singleton resolved from a pinned snapshot, with what writes need to know about it. */
+type ContentModel = {
+  definition: ModelDefinition;
+  /** Per-model version at the pinned snapshot (re-checked at commit). */
+  version: number;
+  revisionId: string;
+  /** Components reachable from the model (directly or through other components), with their versions. */
+  components: ReadonlyMap<string, {
+    definition: ComponentDefinition;
+    version: number;
+  }>;
+};
+//#endregion
+//#region src/content/hooks.d.ts
+/**
+ * Lifecycle hook points (ADR 0009). The content services call every hook point inside the owning
+ * transaction; a hook that throws aborts the write. This registry is the engine only: the extension
+ * runtime (extensions/hooks.ts) registers project hooks on it, running `before*` hooks right here in the
+ * transaction and turning `after*` hook points into an outbox event, so project `after*` hooks run after
+ * commit as jobs and can never roll the write back.
+ */
+declare const BEFORE_EVENTS: readonly ["beforeCreate", "beforeUpdate", "beforePublish", "beforeDelete"];
+declare const AFTER_EVENTS: readonly ["afterCreate", "afterUpdate", "afterPublish", "afterDelete"];
+type BeforeEvent = (typeof BEFORE_EVENTS)[number];
+type AfterEvent = (typeof AFTER_EVENTS)[number];
+type LifecycleEvent = BeforeEvent | AfterEvent;
+type LifecycleContext = {
+  trx: Transaction<DB>;
+  /** The site the entry belongs to (sites plan §H; ADR 0009 note). */
+  site: SiteRef;
+  model: ContentModel;
+  entryId: string;
+  locale: string | null;
+  /** The document in storage form (keyed by field IDs); absent for deletes. */
+  data?: Readonly<ContentData>;
+  /** The document before the change (the previous draft, or the live version being replaced). */
+  before?: Readonly<ContentData>;
+  actor: Principal;
+};
+type LifecycleHook = (context: LifecycleContext) => Promise<void> | void;
+type ContentHooks = {
+  on: (event: LifecycleEvent, hook: LifecycleHook) => () => void;
+  run: (event: LifecycleEvent, context: LifecycleContext) => Promise<void>;
+};
+//#endregion
+//#region src/db/index.d.ts
+type Database = Kysely<DB>;
+//#endregion
+//#region src/extensions/editorManifest.d.ts
+/**
+ * The custom field editors a project installs (ADR 0009): built ES modules in `extensions/editors/*.js`,
+ * listed by file name in the project's `shapio.config` (`editors: [...]`, loaded by extensions/loader.ts).
+ * Read once at startup, so installing an editor is a file copy plus a restart, never a rebuild of the
+ * admin. The admin imports each module at runtime through its import map.
+ */
+type EditorManifestEntry = {
+  /** File name inside `extensions/editors/`. */
+  file: string;
+  /** Absolute path on disk. */
+  path: string;
+  /** SHA-256 of the file (hex, shortened): the module URL changes whenever the file does. */
+  hash: string;
+};
+type EditorManifest = {
+  entries: EditorManifestEntry[];
+};
+//#endregion
+//#region src/repositories/outboxEvents.d.ts
+type OutboxEventRow = Selectable<OutboxEvents>;
+//#endregion
+//#region src/jobs/types.d.ts
+type JobLogger = FastifyBaseLogger;
+/**
+ * What a handler receives. Delivery is at least once: a handler may run again after a crash, so every
+ * side effect must be idempotent (use `id` or `idempotencyKey`) or resume from `checkpoint`.
+ */
+type JobContext = {
+  id: string;
+  type: string;
+  payload: unknown;
+  /** 1 on the first run. */
+  attempt: number;
+  maxAttempts: number;
+  idempotencyKey: string | null;
+  /** Progress saved by an earlier attempt, or null. */
+  checkpoint: unknown;
+  /** Persists progress so a retried attempt can resume. Returns false if this worker lost the lease. */
+  saveCheckpoint: (checkpoint: unknown) => Promise<boolean>;
+  /** Aborted on shutdown; long handlers should stop at the next safe point. */
+  signal: AbortSignal;
+  log: JobLogger;
+};
+/** Returns an optional JSON-serialisable result. Throw to fail the attempt; the queue retries with backoff. */
+type JobHandler = (context: JobContext) => Promise<unknown>;
+/**
+ * Turns an outbox event into follow-up work (usually by enqueueing jobs) inside the relay's transaction.
+ * Subscribers must only write to the database through `trx`; network calls belong in job handlers.
+ */
+type OutboxSubscriber = (event: OutboxEventRow, trx: Transaction<DB>) => Promise<void>;
+//#endregion
+//#region src/extensions/loader.d.ts
+type LoadedProjectConfig = {
+  /** The config file, or undefined when the project has none (no extensions). */
+  file: string | undefined;
+  /** Where `extensions/` lives: the config file's directory, else the search directory. */
+  projectDir: string;
+  config: ShapioConfig;
+};
+//#endregion
+//#region src/extensions/runtime.d.ts
+/**
+ * One process's extensions (ADR 0009): the loaded project config with its services constructed once, its
+ * hooks registered on a content hook engine, and its jobs and outbox subscriber for the worker. The API and
+ * the worker (inline or dedicated) build it from the same config, so a scheduled or release publish runs
+ * the same hooks as a REST or GraphQL one.
+ */
+type ExtensionRuntime = {
+  loaded: LoadedProjectConfig;
+  services: ExtensionServices;
+  /** The content hook engine with the project's hooks registered (empty without a config). */
+  hooks: ContentHooks;
+  routes: readonly ExtensionRoute[];
+  jobHandlers: ReadonlyArray<[string, JobHandler]>;
+  outboxSubscribers: readonly OutboxSubscriber[];
+  permissions: PermissionEvaluator;
+  /** Aborts hook `signal`s; call on shutdown. Idempotent. */
+  close: () => void;
+};
+//#endregion
+//#region src/permissions/policy.d.ts
+type ModelField = {
+  id: string;
+  public: boolean;
+};
+/**
+ * The one port from permissions to the schema registry (package D implements it from the active schema).
+ * `getModelFields`: field definitions for `public` semantics; `undefined` means the model does not exist,
+ * which denies delivery access. `hasModel`: whether a model or component ID exists, so role grants can
+ * only name real models.
+ */
+type FieldVisibilityLookup = {
+  getModelFields: (modelId: string) => Promise<readonly ModelField[] | undefined>;
+  hasModel: (modelId: string) => Promise<boolean>;
+};
+//#endregion
+//#region src/publishing/outbound/ssrf.d.ts
+/**
+ * SSRF protection for every request Shapio sends to an address an admin typed in (webhooks, deploy hooks,
+ * provider APIs). The host is resolved once, every resolved address is checked, and the connection is then
+ * pinned to the checked address (outbound/request.ts), so a DNS answer that changes between the check and
+ * the connect (DNS rebinding) cannot redirect the request. Redirects are never followed.
+ *
+ * Private, loopback, link-local, carrier-grade NAT, multicast and reserved ranges are refused unless the
+ * target opted in (`allowPrivateNetwork`) AND the address is in the operator's allowlist
+ * (OUTBOUND_PRIVATE_NETWORK_ALLOWLIST). Both are needed: an admin account alone cannot reach the internal
+ * network, and the operator's list alone does not open every webhook to it.
+ */
+type ResolvedAddress = {
+  address: string;
+  family: 4 | 6;
+};
+/** DNS resolution, injectable so tests can make a public-looking name resolve to a private address. */
+type HostResolver = (hostname: string) => Promise<ResolvedAddress[]>;
+//#endregion
+//#region src/repositories/publications.d.ts
+/**
+ * One sequence number per transaction, taken on first use: everything a batch publishes, unpublishes or
+ * converts shares it, so the batch is exactly one snapshot.
+ */
+type SeqAllocator = {
+  next: () => Promise<number>;
+  /** The number if one was taken already. */
+  taken: () => number | undefined;
+};
+//#endregion
+//#region src/schema/planner/steps.d.ts
+/**
+ * Where a definition's values live inside entries: for a model, its own heads at the root; for a
+ * component, every model that embeds it, with the field-ID path from the entry root down to the component
+ * or dynamic-zone field that holds it.
+ */
+type ValueLocation = {
+  modelId: string;
+  path: string[];
+};
+/** Prerequisite work that reads or rewrites content. Run by the content ports (package E). */
+type ContentStep = {
+  kind: 'validateRequired';
+  ownerId: string;
+  fieldId: string;
+  locations: ValueLocation[];
+} | {
+  kind: 'backfill';
+  ownerId: string;
+  fieldId: string;
+  value: JsonValue;
+  locations: ValueLocation[];
+} | {
+  kind: 'validateValues';
+  ownerId: string;
+  /** Absent for definition-level rules (e.g. a singleton holds at most one entry). */
+  fieldId?: string;
+  locations: ValueLocation[];
+} | {
+  kind: 'checkUnique';
+  modelId: string;
+  fieldId: string;
+  /**
+   * The field is already unique under the active schema (its type changes): its live registry rows stay in
+   * force until activation, so the dry run stages its claims under a separate registry key and the
+   * activation swaps them in.
+   */
+  rebuild?: boolean;
+} | {
+  kind: 'convert';
+  ownerId: string;
+  change: SchemaChange;
+  locations: ValueLocation[];
+};
+type IndexStep = {
+  kind: 'buildIndex';
+  modelId: string;
+  fieldId: string;
+  fieldType: DataType;
+  /** Index layout: with the locale column (localized models) or without. Absent in older plans: localized. */
+  localized?: boolean;
+  indexName: string;
+};
+/** Work after activation, once nothing reads the old structure. */
+type FollowUpStep = IndexStep | {
+  kind: 'dropIndex';
+  indexName: string;
+} | {
+  kind: 'releaseUnique';
+  fieldId: string;
+} |
+/** Deletes a removed locale's heads, revisions and unique-registry rows (content ports). */
+{
+  kind: 'purgeLocale';
+  code: string;
+};
+//#endregion
+//#region src/schema/planner/contentPorts.d.ts
+/**
+ * What the activation transaction offers the content rewrite: one publication sequence number per affected
+ * site (sites plan §H, ADR 0010 amendment: one snapshot per affected site), each taken late, on first use,
+ * under the schema lock, and a way to defer work until a site's number is known (rolling the publication log
+ * of converted published heads after every rewrite, so the number's row lock is held as briefly as possible).
+ * A site whose content does not change takes no number.
+ */
+type ActivationContext = {
+  /** The origin site's number: the shipping change set's site (the primary site without a change set). */
+  seq: SeqAllocator;
+  /** The number of one site, for content converted on it. */
+  seqFor: (siteId: string) => SeqAllocator;
+  /** Runs `work` with the site's sequence number, after every item's rewrite, before commit. */
+  atSeq: (siteId: string, work: (seq: number) => Promise<void>) => void;
+};
+/**
+ * The planner's view of content. Content storage belongs to package E, so the planner talks to it through
+ * these ports. Until E lands, the defaults report "no content", which is exactly true: no entries exist.
+ */
+type StepOutcome = {
+  ok: true;
+  watermark?: unknown;
+} | {
+  ok: false;
+  /** Key (`stepKey`) of the step the content fails. */
+  step?: string;
+  reason: string;
+  invalidCount?: number;
+  sampleEntryIds?: string[];
+};
+type ContentStepContext = {
+  signal: AbortSignal;
+  /** Progress from an earlier attempt of this step, or null. */
+  checkpoint: unknown;
+  saveCheckpoint: (checkpoint: unknown) => Promise<boolean>;
+  log: FastifyBaseLogger;
+};
+/**
+ * A change's content steps (every prerequisite but index builds, in plan order) go through three stages
+ * (ADR 0002 pipeline): a dry run, the activation-time apply, and, if the change fails, a discard.
+ */
+type ContentMigrationPort = {
+  /**
+   * Dry run up to a watermark (resumable through the checkpoint): converts and backfills content in memory
+   * and checks it against the proposed schema, without writing content. Writes continue meanwhile under
+   * the old revision; whatever they change after the watermark is re-checked at activation.
+   */
+  run: (steps: readonly ContentStep[], context: ContentStepContext) => Promise<StepOutcome>;
+  /**
+   * Inside the activation transaction, holding the exclusive model locks: re-checks the content changed
+   * since `watermark` (the transitional write policy's final delta scan), then writes converted and
+   * backfilled values. A failure aborts the activation and rolls every write back.
+   */
+  apply: (steps: readonly ContentStep[], watermark: unknown, trx: Transaction<DB>, activation: ActivationContext) => Promise<StepOutcome>;
+  /** After the change failed for good: releases what the dry run staged (unique-registry claims). Idempotent. */
+  discard: (steps: readonly ContentStep[]) => Promise<void>;
+  /** Post-activation work that touches content (e.g. dropping unique-registry rows). Idempotent. */
+  runFollowUp: (step: FollowUpStep, log: FastifyBaseLogger) => Promise<void>;
+};
+type StepImpact = {
+  affectedHeads: number;
+  invalidHeads?: number;
+};
+type ContentImpactSource = {
+  /** Heads (every locale and state) of these models. */
+  countHeads: (modelIds: readonly string[]) => Promise<number>;
+  /** How many heads a step would touch and, where cheap to know, how many would fail it. */
+  assess: (step: ContentStep) => Promise<StepImpact>;
+  /** Heads stored in one locale (impact of deleting it). */
+  countLocaleHeads: (code: string) => Promise<number>;
+};
+type SchemaContentPorts = {
+  migration: ContentMigrationPort;
+  impact: ContentImpactSource;
+};
+//#endregion
+//#region src/tls/certificates.d.ts
+type CertificatePair = {
+  key: string;
+  cert: string;
+};
+//#endregion
+//#region src/app.d.ts
+declare module 'fastify' {
+  interface FastifyInstance {
+    /** Schema facts permissions need (field visibility, model existence); see permissions/policy.ts. */
+    schemaLookup: FieldVisibilityLookup;
+    /** HMAC signing secret: SESSION_SECRET, or generated once and stored (services/signingSecret.ts). */
+    signingSecret: string;
+  }
+}
+type AppDependencies = {
+  db: Database;
+  /** A pino logger to share with the worker; otherwise one is created from config. */
+  logger?: FastifyBaseLogger;
+  /** Overrides the role-based evaluator (tests). */
+  permissions?: PermissionEvaluator;
+  /** Resolved by the server before building the app; resolved here when omitted (tests, tools). */
+  signingSecret?: string;
+  /** Field definitions for `public` semantics. Defaults to the schema registry's active schema. */
+  fieldVisibility?: FieldVisibilityLookup;
+  /** Content storage as the schema planner sees it. Defaults to the real content ports (content/ports.ts). */
+  schemaContent?: SchemaContentPorts;
+  /** Content lifecycle hooks (tests). Defaults to the extension runtime's hooks. */
+  contentHooks?: ContentHooks;
+  /**
+   * Project extensions (shapio.config), shared with the worker. Omitted: loaded here from SHAPIO_CONFIG_PATH
+   * or `projectDir`, and closed with the app.
+   */
+  extensions?: ExtensionRuntime;
+  /** LISTEN for schema changes (cache refresh). Default true; correctness never depends on it. */
+  schemaListen?: boolean;
+  /** Serve HTTPS with this certificate (from TLS_CERT_FILE/TLS_KEY_FILE). Omit for plain HTTP. */
+  tls?: CertificatePair;
+  /** OAuth provider endpoints (tests point them at a local fake). Defaults to the real providers. */
+  oauthEndpoints?: Partial<Record<OAuthProviderId, OAuthEndpoints>>;
+  /** The project directory (`shapio.config.js`, `extensions/`). Defaults to the working directory. */
+  projectDir?: string;
+  /** Overrides the custom editor manifest read from the project (tests). */
+  editorManifest?: EditorManifest;
+  /** Directory of the built admin SPA. Defaults to the bundled copy (npm) or apps/admin/dist (repo). */
+  adminDistPath?: string | null;
+  /** DNS resolution for outbound webhook/deploy requests (tests inject a controllable resolver). */
+  outboundResolver?: HostResolver;
+};
+/**
+ * Builds the Fastify app: plugins and routes, no listen(). Every route is mounted under BASE_PATH.
+ * The caller owns the database handle and closes it after `app.close()`.
+ */
+export declare const buildApp: (config: AppConfig, deps: AppDependencies) => Promise<FastifyInstance>;
+//#endregion
+//#region src/jobs/worker.d.ts
+type Worker = {
+  start: () => void;
+  /** Stops claiming, waits up to `timeoutMs` for running jobs, then aborts them and releases their leases. */
+  stop: (timeoutMs: number) => Promise<void>;
+  /** Runs one claim + relay pass; for tests and tooling. Returns the number of jobs claimed. */
+  tick: () => Promise<number>;
+  readonly runningJobIds: ReadonlySet<string>;
+};
+//#endregion
+//#region src/server.d.ts
+type RunningServer = {
+  app: FastifyInstance;
+  worker: Worker | undefined;
+  /** Port of the plain-HTTP listener that redirects to HTTPS (HTTP_PORT), when HTTPS is on. */
+  httpPort: number | undefined;
+  /** Stops the HTTP(S) servers and the worker, then closes the database pool. Idempotent. */
+  close: () => Promise<void>;
+};
+/**
+ * Starts Shapio: read the project config, migrate (under an advisory lock), set up TLS (none or certificate files), build the app,
+ * listen, and start the in-process worker when WORKER_MODE=inline. Installs signal handlers for a
+ * graceful shutdown.
+ */
+export declare const startServer: (config: AppConfig) => Promise<RunningServer>;
+//#endregion
+//#region src/worker.d.ts
+/**
+ * Runs the job worker as its own process (WORKER_MODE=dedicated on the API, `shapio worker` here).
+ * It never migrates: it refuses to start until the API has brought the schema up to date.
+ */
+export declare const startDedicatedWorker: (config: AppConfig) => Promise<Worker>;
+//#endregion
+//#region src/constants/version.d.ts
+export declare const SHAPIO_VERSION: string;
+//#endregion
+export { AfterHook, AfterHookContext, AfterHookEvent, type AppConfig, type AppDependencies, BeforeHook, BeforeHookContext, BeforeHookEvent, ContentReadEntry, ContentReadOptions, ContentReadService, CustomServices, EXTENSION_CONTRACT_VERSION, EnqueueOptions, EntryData, ExtensionHostConfig, ExtensionJobHandler, ExtensionJobService, ExtensionRoute, ExtensionRouteOptions, ExtensionServices, ExtensionSite, HookEntry, HookError, HookEvent, HookModel, JobHandlerContext, MediaReferenceService, MediaUsage, ModelHooks, type RunningServer, ServiceFactory, ServiceFactoryContext, ShapioConfig, ShapioServices, defineConfig, isHookError };
+//# sourceMappingURL=index.d.ts.map