@shapio/cms 0.0.0-stage → 0.3.0

package/dist/public-CGO8RBn3.d.ts

@@ -0,0 +1,1185 @@
+import { FastifyBaseLogger, FastifyInstance, FastifyPluginAsync, preHandlerAsyncHookHandler } from "fastify";
+import { ColumnType, Kysely, Transaction } from "kysely";
+//#region src/db/contentData.d.ts
+/**
+ * User content values: JSONB keyed by stable field IDs. The shape is only known at runtime from the active
+ * model schema, so it is validated by Shapio's validator, never by a per-model TypeScript type.
+ */
+type ContentData = Record<string, unknown>;
+//#endregion
+//#region src/db/types.d.ts
+type Generated<T> = T extends ColumnType<infer S, infer I, infer U> ? ColumnType<S, I | undefined, U> : ColumnType<T, T | undefined, T>;
+type Int8 = ColumnType<string, bigint | number | string, bigint | number | string>;
+type Json = JsonValue;
+type JsonArray = JsonValue[];
+type JsonObject = {
+  [x: string]: JsonValue | undefined;
+};
+type JsonPrimitive = boolean | number | string | null;
+type JsonValue = JsonArray | JsonObject | JsonPrimitive;
+type Timestamp = ColumnType<Date, Date | string, Date | string>;
+interface AdminInvitations {
+  accepted_at: Timestamp | null;
+  created_at: Generated<Timestamp>;
+  email: string;
+  expires_at: Timestamp;
+  id: Generated<string>;
+  invited_by: string | null;
+  revoked_at: Timestamp | null;
+  role_assignments: Generated<Json>;
+  token_hash: string | null;
+  updated_at: Generated<Timestamp>;
+}
+interface AdminRolePermissions {
+  action: string;
+  condition: string | null;
+  created_at: Generated<Timestamp>;
+  field_ids: string[] | null;
+  id: Generated<string>;
+  model_id: string | null;
+  role_id: string;
+  updated_at: Generated<Timestamp>;
+}
+interface AdminRoles {
+  created_at: Generated<Timestamp>;
+  description: Generated<string>;
+  id: Generated<string>;
+  is_system: Generated<boolean>;
+  key: string;
+  kind: Generated<string>;
+  name: string;
+  updated_at: Generated<Timestamp>;
+  version: Generated<number>;
+}
+interface AdminSessions {
+  admin_user_id: string;
+  created_at: Generated<Timestamp>;
+  csrf_secret: string;
+  expires_at: Timestamp;
+  id: Generated<string>;
+  ip: string | null;
+  last_seen_at: Generated<Timestamp>;
+  revoked_at: Timestamp | null;
+  rotation_required: Generated<boolean>;
+  token_hash: string;
+  updated_at: Generated<Timestamp>;
+  user_agent: string | null;
+}
+interface AdminUserRoles {
+  admin_user_id: string;
+  created_at: Generated<Timestamp>;
+  id: Generated<string>;
+  role_id: string;
+  site_id: string | null;
+  updated_at: Generated<Timestamp>;
+}
+interface AdminUsers {
+  created_at: Generated<Timestamp>;
+  email: string;
+  id: Generated<string>;
+  last_login_at: Timestamp | null;
+  name: Generated<string>;
+  password_changed_at: Generated<Timestamp>;
+  password_hash: string;
+  status: Generated<string>;
+  updated_at: Generated<Timestamp>;
+}
+interface ApiTokens {
+  created_at: Generated<Timestamp>;
+  created_by: string | null;
+  expires_at: Timestamp | null;
+  id: Generated<string>;
+  last_used_at: Timestamp | null;
+  name: string;
+  revoked_at: Timestamp | null;
+  role_id: string;
+  site_id: string | null;
+  token_hash: string;
+  token_prefix: string;
+  updated_at: Generated<Timestamp>;
+}
+interface AppLoginCodes {
+  app_user_id: string;
+  code_challenge: string;
+  code_hash: string;
+  created_at: Generated<Timestamp>;
+  expires_at: Timestamp;
+  id: Generated<string>;
+  used_at: Timestamp | null;
+}
+interface AppOauthAccounts {
+  app_user_id: string;
+  created_at: Generated<Timestamp>;
+  email: string | null;
+  id: Generated<string>;
+  provider: string;
+  provider_user_id: string;
+  site_id: string;
+  updated_at: Generated<Timestamp>;
+}
+interface AppPasswordResets {
+  app_user_id: string;
+  created_at: Generated<Timestamp>;
+  email: string;
+  expires_at: Timestamp;
+  id: Generated<string>;
+  token_hash: string | null;
+  updated_at: Generated<Timestamp>;
+  used_at: Timestamp | null;
+}
+interface AppRefreshTokens {
+  app_user_id: string;
+  created_at: Generated<Timestamp>;
+  expires_at: Timestamp;
+  family_id: string;
+  id: Generated<string>;
+  ip: string | null;
+  reuse_grace_used_at: Timestamp | null;
+  revoked_at: Timestamp | null;
+  revoked_reason: string | null;
+  token_hash: string;
+  used_at: Timestamp | null;
+  user_agent: string | null;
+}
+interface AppRolePermissions {
+  action: string;
+  condition: string | null;
+  created_at: Generated<Timestamp>;
+  field_ids: string[] | null;
+  id: Generated<string>;
+  model_id: string | null;
+  role_id: string;
+  updated_at: Generated<Timestamp>;
+}
+interface AppRoles {
+  created_at: Generated<Timestamp>;
+  description: Generated<string>;
+  id: Generated<string>;
+  is_system: Generated<boolean>;
+  key: string;
+  name: string;
+  updated_at: Generated<Timestamp>;
+  version: Generated<number>;
+}
+interface AppUserRoles {
+  app_user_id: string;
+  created_at: Generated<Timestamp>;
+  role_id: string;
+  site_id: string;
+}
+interface AppUsers {
+  blocked_at: Timestamp | null;
+  confirmed_at: Timestamp | null;
+  created_at: Generated<Timestamp>;
+  deleted_at: Timestamp | null;
+  email: string;
+  id: Generated<string>;
+  last_login_at: Timestamp | null;
+  name: Generated<string>;
+  password_changed_at: Timestamp | null;
+  password_hash: string | null;
+  site_id: string;
+  token_version: Generated<number>;
+  updated_at: Generated<Timestamp>;
+}
+interface AssistRuns {
+  action: string;
+  actor_id: string;
+  actor_type: string;
+  created_at: Generated<Timestamp>;
+  duration_ms: Generated<number>;
+  error_code: string | null;
+  finished_at: Timestamp | null;
+  id: Generated<string>;
+  input_tokens: Generated<number>;
+  job_id: string | null;
+  model: string;
+  output_tokens: Generated<number>;
+  provider: string;
+  rule: string | null;
+  site_id: string;
+  status: string;
+}
+interface AuditEvents {
+  action: string;
+  actor_id: string | null;
+  actor_type: string;
+  id: Generated<string>;
+  ip: string | null;
+  metadata: Generated<Json>;
+  occurred_at: Generated<Timestamp>;
+  outcome: string;
+  request_id: string | null;
+  seq: Generated<Int8>;
+  site_id: string | null;
+  target_id: string | null;
+  target_type: string | null;
+}
+interface ChangeSetItems {
+  action: string | null;
+  change_set_id: string;
+  created_at: Generated<Timestamp>;
+  entry_id: string | null;
+  error: string | null;
+  id: Generated<string>;
+  kind: string;
+  locale: string | null;
+  model_id: string | null;
+  position: number;
+  schema_draft_id: string | null;
+  ship_state: Json | null;
+  site_id: string;
+  source_revision_id: string | null;
+  status: Generated<string>;
+}
+interface ChangeSets {
+  acknowledge_breaking: Generated<boolean>;
+  acknowledge_destructive: Generated<boolean>;
+  created_at: Generated<Timestamp>;
+  created_by: string | null;
+  created_by_token: string | null;
+  deployment_connection_id: string | null;
+  deployment_run_id: string | null;
+  description: Generated<string>;
+  error: Json | null;
+  id: Generated<string>;
+  restore_of_seq: Int8 | null;
+  restore_report: Generated<Json>;
+  schedule_job_id: string | null;
+  scheduled_by: string | null;
+  scheduled_by_token: string | null;
+  scheduled_for: Timestamp | null;
+  schema_version_after: number | null;
+  ship_job_id: string | null;
+  ship_mode: string | null;
+  ship_phase: string | null;
+  ship_requested_by: string | null;
+  ship_requested_by_token: string | null;
+  shipped_at: Timestamp | null;
+  shipped_seq: Int8 | null;
+  site_id: string;
+  source: Generated<string>;
+  status: Generated<string>;
+  title: string;
+  updated_at: Generated<Timestamp>;
+  version: Generated<number>;
+}
+interface ContentHealthFindings {
+  details: Generated<Json>;
+  entry_id: string;
+  first_seen_at: Generated<Timestamp>;
+  id: Generated<string>;
+  last_seen_at: Generated<Timestamp>;
+  locale: string;
+  model_id: string;
+  path: string | null;
+  resolved_at: Timestamp | null;
+  rule: string;
+  severity: string;
+  site_id: string;
+  subject: Generated<string>;
+}
+interface ContentRevisions {
+  author_id: string | null;
+  author_type: string;
+  created_at: Generated<Timestamp>;
+  data: ContentData;
+  entry_id: string;
+  id: Generated<string>;
+  locale: string;
+  parent_revision_id: string | null;
+  reason: string;
+  schema_revision_id: string;
+}
+interface DeploymentConnections {
+  allow_private_network: Generated<boolean>;
+  created_at: Generated<Timestamp>;
+  created_by: string | null;
+  debounce_seconds: Generated<number>;
+  delivery_role_id: string | null;
+  enabled: Generated<boolean>;
+  id: Generated<string>;
+  name: string;
+  preview_url_template: string | null;
+  provider: string;
+  secret_env_refs: Generated<Json>;
+  secrets_encrypted: string;
+  settings: Generated<Json>;
+  site_id: string;
+  trigger_policy: Generated<string[]>;
+  updated_at: Generated<Timestamp>;
+  version: Generated<number>;
+}
+interface DeploymentRuns {
+  change_set_id: string | null;
+  connection_id: string;
+  created_at: Generated<Timestamp>;
+  created_by: string | null;
+  error: string | null;
+  finished_at: Timestamp | null;
+  id: Generated<string>;
+  job_id: string | null;
+  log_url: string | null;
+  provider_ref: string | null;
+  retry_of: string | null;
+  schema_version: number | null;
+  site_url: string | null;
+  snapshot_seq: Int8 | null;
+  status: Generated<string>;
+  status_rank: Generated<number>;
+  timeline: Generated<Json>;
+  trigger: string;
+  triggered_at: Timestamp | null;
+  updated_at: Generated<Timestamp>;
+}
+interface EditorPresence {
+  admin_user_id: string;
+  entry_id: string;
+  last_seen_at: Generated<Timestamp>;
+  locale: string | null;
+  model_id: string;
+  started_at: Generated<Timestamp>;
+  tab_id: string;
+}
+interface EmailConfirmations {
+  app_user_id: string;
+  created_at: Generated<Timestamp>;
+  email: string;
+  expires_at: Timestamp;
+  id: Generated<string>;
+  token_hash: string | null;
+  updated_at: Generated<Timestamp>;
+  used_at: Timestamp | null;
+}
+interface Entries {
+  created_at: Generated<Timestamp>;
+  created_by_admin_id: string | null;
+  deleted_at: Timestamp | null;
+  id: Generated<string>;
+  model_id: string;
+  owner_app_user_id: string | null;
+  site_id: string;
+  updated_at: Generated<Timestamp>;
+}
+interface EntryHeads {
+  autosaved_at: Timestamp | null;
+  change_seq: Generated<Int8>;
+  created_at: Generated<Timestamp>;
+  data: ContentData;
+  entry_id: string;
+  locale: string;
+  model_id: string;
+  revision_id: string;
+  site_id: string;
+  state: string;
+  updated_at: Generated<Timestamp>;
+  version: Generated<number>;
+}
+interface ExtensionHookRuns {
+  completed_at: Generated<Timestamp>;
+  event_id: string;
+  hook: string;
+  job_id: string | null;
+}
+interface FieldReads {
+  day: Timestamp;
+  field_path: string;
+  last_read_at: Timestamp;
+  model_id: string;
+  principal_key: string;
+  reads: Generated<Int8>;
+  selection: string;
+  site_id: string;
+}
+interface Jobs {
+  attempts: Generated<number>;
+  checkpoint: Json | null;
+  created_at: Generated<Timestamp>;
+  finished_at: Timestamp | null;
+  id: Generated<string>;
+  idempotency_key: string | null;
+  last_error: string | null;
+  locked_by: string | null;
+  locked_until: Timestamp | null;
+  max_attempts: Generated<number>;
+  payload: Generated<Json>;
+  priority: Generated<number>;
+  result: Json | null;
+  run_at: Generated<Timestamp>;
+  status: Generated<string>;
+  type: string;
+  updated_at: Generated<Timestamp>;
+}
+interface Locales {
+  code: string;
+  created_at: Generated<Timestamp>;
+  fallbacks: Generated<string[]>;
+  is_default: Generated<boolean>;
+  label: string;
+  updated_at: Generated<Timestamp>;
+}
+interface MediaAssets {
+  alt: Generated<string>;
+  caption: Generated<string>;
+  checksum_sha256: string | null;
+  created_at: Generated<Timestamp>;
+  created_by: string | null;
+  deleted_at: Timestamp | null;
+  focal_x: number | null;
+  focal_y: number | null;
+  folder_id: string | null;
+  height: number | null;
+  id: string;
+  mime_type: string;
+  original_filename: string;
+  processing_error: string | null;
+  site_id: string;
+  size_bytes: Int8;
+  status: Generated<string>;
+  storage_driver: string;
+  storage_key: string;
+  updated_at: Generated<Timestamp>;
+  version: Generated<number>;
+  visibility: Generated<string>;
+  width: number | null;
+}
+interface MediaFolders {
+  created_at: Generated<Timestamp>;
+  created_by: string | null;
+  id: Generated<string>;
+  name: string;
+  parent_id: string | null;
+  site_id: string;
+  updated_at: Generated<Timestamp>;
+  version: Generated<number>;
+}
+interface MediaReferences {
+  asset_id: string;
+  created_at: Generated<Timestamp>;
+  entry_id: string;
+  field_id: string;
+  locale: string;
+  model_id: string;
+  state: string;
+}
+interface MediaUploadGrants {
+  asset_id: string;
+  consumed_at: Timestamp | null;
+  created_at: Generated<Timestamp>;
+  created_by: string | null;
+  created_by_principal: string;
+  declared_mime_type: string;
+  expires_at: Timestamp;
+  folder_id: string | null;
+  id: Generated<string>;
+  kind: string;
+  max_size_bytes: Int8;
+  original_filename: string;
+  site_id: string;
+  status: Generated<string>;
+  storage_driver: string;
+  storage_key: string;
+  visibility: string;
+}
+interface MediaVariants {
+  asset_id: string;
+  checksum_sha256: string | null;
+  created_at: Generated<Timestamp>;
+  error: string | null;
+  format: string;
+  height: number | null;
+  id: Generated<string>;
+  mime_type: string;
+  name: string;
+  size_bytes: Int8 | null;
+  status: Generated<string>;
+  storage_key: string | null;
+  updated_at: Generated<Timestamp>;
+  width: number | null;
+}
+interface ModelActiveVersions {
+  activated_at: Generated<Timestamp>;
+  model_id: string;
+  revision_id: string;
+  schema_version: number;
+  version: number;
+}
+interface Models {
+  api_key: string;
+  created_at: Generated<Timestamp>;
+  deleted_at: Timestamp | null;
+  id: string;
+  kind: string;
+  site_id: string | null;
+  updated_at: Generated<Timestamp>;
+}
+interface OutboxEvents {
+  aggregate_id: string;
+  aggregate_type: string;
+  created_at: Generated<Timestamp>;
+  dispatch_attempts: Generated<number>;
+  dispatched_at: Timestamp | null;
+  event_id: Generated<string>;
+  id: Generated<Int8>;
+  last_dispatch_error: string | null;
+  payload: Generated<Json>;
+  site_id: string | null;
+  type: string;
+}
+interface PasswordResets {
+  admin_user_id: string;
+  created_at: Generated<Timestamp>;
+  expires_at: Timestamp;
+  id: Generated<string>;
+  token_hash: string | null;
+  updated_at: Generated<Timestamp>;
+  used_at: Timestamp | null;
+}
+interface PreviewTokens {
+  connection_id: string | null;
+  created_at: Generated<Timestamp>;
+  created_by: string;
+  delivery_role_id: string | null;
+  entry_id: string;
+  expires_at: Timestamp;
+  id: Generated<string>;
+  last_used_at: Timestamp | null;
+  locale: string | null;
+  model_id: string;
+  revoked_at: Timestamp | null;
+  site_id: string;
+  token_hash: string;
+  token_prefix: string;
+}
+interface PublicationLog {
+  entry_id: string;
+  from_seq: Int8;
+  id: Generated<Int8>;
+  locale: string;
+  model_id: string;
+  published_at: Generated<Timestamp>;
+  revision_id: string;
+  site_id: string;
+  to_seq: Int8 | null;
+}
+interface PublicationSnapshots {
+  actor_id: string | null;
+  actor_type: string | null;
+  change_set_id: string | null;
+  created_at: Generated<Timestamp>;
+  schema_version: number | null;
+  seq: Int8;
+  site_id: string;
+  source: string;
+}
+interface PublicationState {
+  last_seq: Generated<Int8>;
+  site_id: string;
+}
+interface RelationEdges {
+  field_id: string;
+  locale: string;
+  position: number;
+  source_entry_id: string;
+  state: string;
+  target_entry_id: string;
+}
+interface ScheduledPublications {
+  action: string;
+  created_at: Generated<Timestamp>;
+  created_by: string | null;
+  created_by_token: string | null;
+  entry_id: string;
+  error: string | null;
+  executed_at: Timestamp | null;
+  id: Generated<string>;
+  job_id: string | null;
+  locale: string;
+  model_id: string;
+  run_at: Timestamp;
+  site_id: string;
+  snapshot_seq: Int8 | null;
+  status: Generated<string>;
+  updated_at: Generated<Timestamp>;
+}
+interface SchemaChangeJobs {
+  change_set_id: string | null;
+  created_at: Generated<Timestamp>;
+  error: Json | null;
+  finished_at: Timestamp | null;
+  from_revision_id: string | null;
+  id: Generated<string>;
+  job_id: string | null;
+  model_id: string | null;
+  plan: Generated<Json>;
+  requested_by_id: string | null;
+  requested_by_type: string;
+  status: Generated<string>;
+  target_id: string;
+  target_type: string;
+  to_revision_id: string | null;
+  updated_at: Generated<Timestamp>;
+}
+interface SchemaDrafts {
+  api_key: string;
+  base_version: number | null;
+  change_set_id: string;
+  created_at: Generated<Timestamp>;
+  definition: Json | null;
+  definition_id: string;
+  id: Generated<string>;
+  kind: string;
+  shared: Generated<boolean>;
+  updated_at: Generated<Timestamp>;
+  updated_by_id: string | null;
+  updated_by_type: string;
+  version: Generated<number>;
+}
+interface SchemaRevisions {
+  created_at: Generated<Timestamp>;
+  created_by_id: string | null;
+  created_by_type: string;
+  definition: Json;
+  hash: string;
+  id: Generated<string>;
+  model_id: string;
+  parent_revision_id: string | null;
+  version: number;
+}
+interface SchemaSettings {
+  id: Generated<boolean>;
+  read_only: Generated<boolean>;
+  read_only_reason: string | null;
+  updated_at: Generated<Timestamp>;
+  updated_by_id: string | null;
+  updated_by_type: string | null;
+}
+interface SetupTokens {
+  created_at: Generated<Timestamp>;
+  id: Generated<string>;
+  superseded_at: Timestamp | null;
+  token_hash: string;
+  updated_at: Generated<Timestamp>;
+  used_at: Timestamp | null;
+}
+interface SiteAppRoles {
+  audience: string;
+  created_at: Generated<Timestamp>;
+  role_id: string;
+  site_id: string;
+}
+interface Sites {
+  created_at: Generated<Timestamp>;
+  id: Generated<string>;
+  is_primary: Generated<boolean>;
+  key: string;
+  name: string;
+  updated_at: Generated<Timestamp>;
+  version: Generated<number>;
+}
+interface SystemSettings {
+  key: string;
+  updated_at: Generated<Timestamp>;
+  value: string;
+}
+interface SystemVersions {
+  id: Generated<boolean>;
+  permissions_version: Generated<number>;
+  schema_version: Generated<number>;
+  updated_at: Generated<Timestamp>;
+}
+interface TokenReads {
+  day: Timestamp;
+  last_read_at: Timestamp;
+  last_snapshot: Int8 | null;
+  principal_key: string;
+  requests: Generated<Int8>;
+  site_id: string;
+}
+interface UniqueValues {
+  entry_id: string;
+  field_id: string;
+  locale: string;
+  model_id: string;
+  site_id: string;
+  state: string;
+  value_hash: string;
+}
+interface WebhookDeliveries {
+  attempt_log: Generated<Json>;
+  attempts: Generated<number>;
+  created_at: Generated<Timestamp>;
+  delivered_at: Timestamp | null;
+  event_id: string | null;
+  event_type: string;
+  id: Generated<string>;
+  is_test: Generated<boolean>;
+  job_id: string | null;
+  last_error: string | null;
+  last_response_status: number | null;
+  payload: Json;
+  status: Generated<string>;
+  updated_at: Generated<Timestamp>;
+  webhook_id: string;
+}
+interface Webhooks {
+  allow_private_network: Generated<boolean>;
+  created_at: Generated<Timestamp>;
+  created_by: string | null;
+  enabled: Generated<boolean>;
+  events: Generated<string[]>;
+  id: Generated<string>;
+  max_attempts: Generated<number>;
+  name: string;
+  secret_encrypted: string;
+  site_id: string | null;
+  updated_at: Generated<Timestamp>;
+  url: string;
+  version: Generated<number>;
+}
+interface DB {
+  admin_invitations: AdminInvitations;
+  admin_role_permissions: AdminRolePermissions;
+  admin_roles: AdminRoles;
+  admin_sessions: AdminSessions;
+  admin_user_roles: AdminUserRoles;
+  admin_users: AdminUsers;
+  api_tokens: ApiTokens;
+  app_login_codes: AppLoginCodes;
+  app_oauth_accounts: AppOauthAccounts;
+  app_password_resets: AppPasswordResets;
+  app_refresh_tokens: AppRefreshTokens;
+  app_role_permissions: AppRolePermissions;
+  app_roles: AppRoles;
+  app_user_roles: AppUserRoles;
+  app_users: AppUsers;
+  assist_runs: AssistRuns;
+  audit_events: AuditEvents;
+  change_set_items: ChangeSetItems;
+  change_sets: ChangeSets;
+  content_health_findings: ContentHealthFindings;
+  content_revisions: ContentRevisions;
+  deployment_connections: DeploymentConnections;
+  deployment_runs: DeploymentRuns;
+  editor_presence: EditorPresence;
+  email_confirmations: EmailConfirmations;
+  entries: Entries;
+  entry_heads: EntryHeads;
+  extension_hook_runs: ExtensionHookRuns;
+  field_reads: FieldReads;
+  jobs: Jobs;
+  locales: Locales;
+  media_assets: MediaAssets;
+  media_folders: MediaFolders;
+  media_references: MediaReferences;
+  media_upload_grants: MediaUploadGrants;
+  media_variants: MediaVariants;
+  model_active_versions: ModelActiveVersions;
+  models: Models;
+  outbox_events: OutboxEvents;
+  password_resets: PasswordResets;
+  preview_tokens: PreviewTokens;
+  publication_log: PublicationLog;
+  publication_snapshots: PublicationSnapshots;
+  publication_state: PublicationState;
+  relation_edges: RelationEdges;
+  scheduled_publications: ScheduledPublications;
+  schema_change_jobs: SchemaChangeJobs;
+  schema_drafts: SchemaDrafts;
+  schema_revisions: SchemaRevisions;
+  schema_settings: SchemaSettings;
+  setup_tokens: SetupTokens;
+  site_app_roles: SiteAppRoles;
+  sites: Sites;
+  system_settings: SystemSettings;
+  system_versions: SystemVersions;
+  token_reads: TokenReads;
+  unique_values: UniqueValues;
+  webhook_deliveries: WebhookDeliveries;
+  webhooks: Webhooks;
+}
+//#endregion
+//#region src/permissions/types.d.ts
+/**
+ * Principals and policies (ADR 0005). One evaluator serves admin users, app users, tokens and anonymous
+ * callers, for REST and GraphQL alike. Package A ships the types and a deny-all evaluator; package B
+ * implements roles and the real evaluator against this interface.
+ */
+/** One role held by an admin user: on one site, or on every site (`siteId` null). */
+type RoleAssignment = {
+  roleId: string;
+  siteId: string | null;
+};
+/**
+ * An admin user narrowed to one site (sites plan §H). `roleIds`: roles assigned on this site or on every
+ * site; site actions and content actions are evaluated against them. `networkRoleIds`: roles assigned on
+ * every site only; network actions (users, roles, schema, audit, sites) are evaluated against them, so a
+ * site-only role can never reach the network. `siteId` null: a network route, where `roleIds` equals
+ * `networkRoleIds`.
+ */
+type AdminPrincipal = {
+  kind: 'admin';
+  adminUserId: string;
+  sessionId: string;
+  /** Every assignment, on any site (which sites the admin works on). */
+  assignments: readonly RoleAssignment[];
+  siteId: string | null;
+  roleIds: readonly string[];
+  networkRoleIds: readonly string[];
+};
+/**
+ * An app user: an end user of one site (sites plan §H). `roleIds`: the custom app roles assigned to the
+ * account; the roles bound to the site's `authenticated` audience (`site_app_roles`) apply on top.
+ * `siteId`: the account's site, from the access token's `site` claim; the account acts on no other site.
+ */
+type AppUserPrincipal = {
+  kind: 'appUser';
+  appUserId: string;
+  siteId: string;
+  roleIds: readonly string[];
+};
+/** API tokens bind to exactly one role: an admin role or a delivery role. */
+type TokenPrincipal = {
+  kind: 'token';
+  tokenId: string;
+  scope: 'admin' | 'delivery';
+  roleId: string;
+  /**
+   * The token's site; null for a network admin token (its role applies on every site and to network
+   * actions). Delivery tokens always have a site.
+   */
+  siteId: string | null;
+};
+/**
+ * A caller without credentials. On a site route `siteId` is the request's site, and the roles bound to the
+ * site's `public` audience (`site_app_roles`) apply. Null before site resolution and on network routes,
+ * where an anonymous caller holds no role at all.
+ */
+type AnonymousPrincipal = {
+  kind: 'anonymous';
+  siteId: string | null;
+};
+/** Work Shapio does on its own behalf: scheduled jobs, migrations, the worker. Never derived from a request. */
+type SystemPrincipal = {
+  kind: 'system';
+  component: string;
+};
+type Principal = AdminPrincipal | AppUserPrincipal | TokenPrincipal | AnonymousPrincipal | SystemPrincipal;
+declare const CONTENT_ACTIONS: readonly ["read", "create", "update", "delete", "publish", "schemaManage"];
+type ContentAction = (typeof CONTENT_ACTIONS)[number];
+declare const GLOBAL_ACTIONS: readonly ["schema.create", "users.manage", "roles.manage", "audit.read", "sites.manage", "tokens.manage", "media.read", "media.write", "media.manage", "publishing.manage", "webhooks.manage", "deployments.manage", "deployments.trigger", "changes.manage", "changes.ship"];
+type GlobalAction = (typeof GLOBAL_ACTIONS)[number];
+/** Field visibility by stable field ID. `all` means every field the schema exposes to this principal kind. */
+type FieldMask = {
+  mode: 'all';
+} | {
+  mode: 'only';
+  fieldIds: readonly string[];
+};
+/** Enumerated row conditions; compiled to SQL only by content/compiler. Never free-form expressions. */
+type RowCondition = {
+  kind: 'ownedByPrincipal';
+};
+type RowFilter = RowCondition | {
+  kind: 'and';
+  filters: readonly RowFilter[];
+} | {
+  kind: 'or';
+  filters: readonly RowFilter[];
+};
+type Policy = {
+  allowed: boolean;
+  /** Extra restriction on which rows the principal may act on. `null` means no restriction. */
+  rowFilter: RowFilter | null;
+  readMask: FieldMask;
+  writeMask: FieldMask;
+};
+type PolicyRequest = {
+  action: ContentAction;
+  modelId: string;
+};
+type PermissionEvaluator = {
+  evaluate: (principal: Principal, request: PolicyRequest) => Promise<Policy>;
+  canPerform: (principal: Principal, action: GlobalAction) => Promise<boolean>;
+  /**
+   * `canPerform` for the request's site: an action in `SITE_GRANTABLE_ACTIONS` also counts the roles that
+   * apply on `siteId` when the principal acts on that site (an admin narrowed to it, a site token of it, a
+   * network token). Any other action is `canPerform`.
+   */
+  canPerformOnSite: (principal: Principal, action: GlobalAction, siteId: string) => Promise<boolean>;
+};
+//#endregion
+//#region src/plugins/auditDeclaration.d.ts
+/**
+ * Every mutating route must say how it is audited (ADR 0005, build plan §3.11):
+ * `config: { audit: { action: 'schema.activate' } }`, or `config: { audit: { exempt: '<why>' } }` for
+ * routes whose changes are recorded elsewhere (content saves are recorded as revisions).
+ */
+type RouteAuditConfig = {
+  action: string;
+} | {
+  exempt: string;
+};
+declare module 'fastify' {
+  interface FastifyContextConfig {
+    audit?: RouteAuditConfig;
+  }
+}
+//#endregion
+//#region src/extensions/public.d.ts
+declare module 'fastify' {
+  interface FastifyRequest {
+    /** Who is calling. Anonymous unless a session cookie or API token resolved. Never null after onRequest. */
+    principal: Principal;
+    /**
+     * The request's site on a site route (custom routes are site routes): the credential's site, else the
+     * `Shapio-Site` header or `?site=`, else the primary site. Undefined on a route declaring
+     * `config.site = 'network'`.
+     */
+    site: {
+      id: string;
+      key: string;
+    } | undefined;
+  }
+  interface FastifyContextConfig {
+    /** Required on every mutating route: the audit action recorded on success, or `{ exempt: '<why>' }`. */
+    audit?: RouteAuditConfig;
+    /** `'network'` for a custom route that is about the whole instance rather than one site. */
+    site?: 'site' | 'network';
+  }
+}
+/**
+ * The project extension contract (ADR 0009), imported by project authors from `@shapio/cms/config`:
+ *
+ * ```ts
+ * import { defineConfig } from '@shapio/cms/config';
+ * export const config = defineConfig({ hooks: { article: { beforePublish: (ctx) => { ... } } } });
+ * ```
+ *
+ * Extensions are code: changing them needs a restart of Shapio (never a rebuild). Content models are never
+ * configured here; they change live in the admin. This file has no runtime imports from the server, so a
+ * config that imports it stays cheap to load.
+ *
+ * Stability: everything exported here follows semver with `EXTENSION_CONTRACT_VERSION`; Shapio's database
+ * tables (reachable through `trx`) are internal and may change in any release.
+ */
+declare const EXTENSION_CONTRACT_VERSION = 1;
+type BeforeHookEvent = 'beforeCreate' | 'beforeUpdate' | 'beforePublish' | 'beforeDelete';
+type AfterHookEvent = 'afterCreate' | 'afterUpdate' | 'afterPublish' | 'afterDelete';
+type HookEvent = BeforeHookEvent | AfterHookEvent;
+/** A site of a multi-site instance: its stable ID and its key (sites share the schema, not content). */
+type ExtensionSite = {
+  id: string;
+  key: string;
+};
+/** Entry data keyed by field API key (the admin API's shape; media and relations are IDs). */
+type EntryData = Readonly<Record<string, unknown>>;
+type HookModel = {
+  /** Stable model ID (never changes). */
+  id: string;
+  apiKey: string;
+  label: string;
+  kind: 'collection' | 'singleton';
+  localized: boolean;
+  draftAndPublish: boolean;
+};
+type HookEntry = {
+  id: string;
+  locale: string | null;
+  /** Which head the change is about: the draft (create/update), the live version (publish), or a delete. */
+  state: 'draft' | 'published' | 'deleted';
+};
+type ContentReadOptions = {
+  locale?: string;
+  /** Read as this principal (its permissions apply). Default: Shapio itself (everything). */
+  principal?: Principal;
+};
+type ContentReadEntry = {
+  id: string;
+  locale: string;
+  status: string;
+  data: Record<string, unknown>;
+};
+/** Read-only access to content (drafts, as the admin API shows them). Reads committed data. */
+type ContentReadService = {
+  get: (modelKey: string, id: string, options?: ContentReadOptions) => Promise<ContentReadEntry>;
+  /** `query` is a delivery-style querystring, e.g. `filters[title][$contains]=a&pageSize=10`. */
+  list: (modelKey: string, query?: string, options?: Omit<ContentReadOptions, 'locale'>) => Promise<{
+    items: ContentReadEntry[];
+    total: number;
+  }>;
+  /** Number of (non-deleted) entries of a model. */
+  count: (modelKey: string) => Promise<number>;
+  /** The active content models (collections and singletons) of this site: shared ones and its own. */
+  models: () => Promise<HookModel[]>;
+};
+type MediaUsage = {
+  entryId: string;
+  modelId: string;
+  fieldId: string;
+  locale: string;
+  state: string;
+};
+type MediaReferenceService = {
+  /** Where an asset is used (up to 100 references, plus the total). */
+  usages: (assetId: string) => Promise<{
+    items: MediaUsage[];
+    total: number;
+  }>;
+};
+type EnqueueOptions = {
+  runAt?: Date;
+  /** Enqueueing the same key twice creates one job. */
+  idempotencyKey?: string;
+  maxAttempts?: number;
+};
+type ExtensionJobService = {
+  /** Enqueues one of the project's own jobs (`jobs` in the config), by its name without the `ext.` prefix. */
+  enqueue: (name: string, payload?: Record<string, unknown>, options?: EnqueueOptions) => Promise<{
+    id: string;
+    created: boolean;
+  }>;
+};
+/**
+ * What Shapio offers extensions. Deliberately small; everything else goes through `trx` or HTTP.
+ *
+ * Content and media are per site. The services handed to a hook read the hook's site; the services given to
+ * routes, jobs and service factories read the primary site. Use `forSite` for another one (in a custom
+ * route: `services.forSite(request.site)`).
+ */
+type ShapioServices = {
+  /** The site `content` and `media` read. */
+  site: ExtensionSite;
+  /** The same services reading another site. */
+  forSite: (site: ExtensionSite) => ShapioServices;
+  content: ContentReadService;
+  media: MediaReferenceService;
+  jobs: ExtensionJobService;
+  logger: FastifyBaseLogger;
+};
+/**
+ * Your own services, by name. Augment it for typed access everywhere services appear:
+ *
+ * ```ts
+ * declare module '@shapio/cms/config' {
+ *   interface CustomServices { stats: StatsService }
+ * }
+ * ```
+ */
+interface CustomServices {}
+type ExtensionServices = ShapioServices & CustomServices;
+type HookContextBase = {
+  /** The site the entry belongs to; `services` read this site. */
+  site: ExtensionSite;
+  model: HookModel;
+  entry: HookEntry;
+  locale: string | null;
+  /** The document after the change (absent for deletes). */
+  data: EntryData | undefined;
+  /** The document before the change: the previous draft (update) or the live version (publish). */
+  before: EntryData | undefined;
+  /** Who made the change (an admin, an API token, an app user, or Shapio itself for scheduled work). */
+  principal: Principal;
+  services: ExtensionServices;
+  logger: FastifyBaseLogger;
+  /** Aborted when Shapio shuts down. */
+  signal: AbortSignal;
+};
+/**
+ * `before*` hooks run INSIDE the write's transaction, before it commits. Throw `HookError` (or call
+ * `reject`) to abort the write with 422 `HOOK_REJECTED`; nothing of the write is kept. Other errors abort it
+ * too, as a 500. Database work through `trx` commits or rolls back with the write.
+ */
+type BeforeHookContext = HookContextBase & {
+  event: BeforeHookEvent;
+  trx: Transaction<DB>;
+  reject: (message: string, details?: Record<string, unknown>) => never;
+};
+/**
+ * `after*` hooks run AFTER the write committed, as a job (retried with backoff on error, never rolling the
+ * write back). Database work through `trx` is exactly once: it commits together with the record that the
+ * hook ran. Other side effects (HTTP calls) are at least once: make them idempotent with `idempotencyKey`.
+ */
+type AfterHookContext = HookContextBase & {
+  event: AfterHookEvent;
+  trx: Transaction<DB>;
+  /** The outbox event the hook runs for. */
+  eventId: string;
+  /** `<eventId>:<hook name>`: stable across retries. */
+  idempotencyKey: string;
+  attempt: number;
+};
+type BeforeHook = (context: BeforeHookContext) => Promise<void> | void;
+type AfterHook = (context: AfterHookContext) => Promise<void> | void;
+type ModelHooks = { [E in BeforeHookEvent]?: BeforeHook; } & { [E in AfterHookEvent]?: AfterHook; };
+type ServiceFactoryContext = {
+  /** Kysely on Shapio's database. Shapio's own tables are internal and may change between releases. */
+  db: Kysely<DB>;
+  config: ExtensionHostConfig;
+  logger: FastifyBaseLogger;
+  /** Shapio's services plus the custom services declared before this one. */
+  services: ExtensionServices;
+};
+type ExtensionHostConfig = {
+  nodeEnv: 'development' | 'production' | 'test';
+  /** PUBLIC_URL origin, without a trailing slash. */
+  publicUrl: string;
+  basePath: string;
+  /** The directory holding shapio.config and extensions/. */
+  projectDir: string;
+};
+type ServiceFactory = (context: ServiceFactoryContext) => unknown;
+/** Options every custom route plugin receives (also available as `app.ext`). */
+type ExtensionRouteOptions = {
+  services: ExtensionServices;
+  /** Shapio's permission evaluator: `permissions.evaluate(request.principal, { action, modelId })`. */
+  permissions: PermissionEvaluator;
+  logger: FastifyBaseLogger;
+  /** preHandler: 401/403 unless the caller is an admin user or an admin API token. */
+  requireAdmin: preHandlerAsyncHookHandler;
+};
+type ExtensionRoute = {
+  /** Mounted at `/api/ext/<prefix>` (under BASE_PATH). Lower-case letters, digits and dashes. */
+  prefix: string;
+  plugin: FastifyPluginAsync<ExtensionRouteOptions>;
+};
+type JobHandlerContext = {
+  jobId: string;
+  payload: Record<string, unknown>;
+  attempt: number;
+  maxAttempts: number;
+  idempotencyKey: string | null;
+  services: ExtensionServices;
+  logger: FastifyBaseLogger;
+  signal: AbortSignal;
+};
+/** Throw to retry with backoff; the return value (JSON) is stored as the job result. */
+type ExtensionJobHandler = (context: JobHandlerContext) => Promise<unknown>;
+type ShapioConfig = {
+  /** Lifecycle hooks by model API ID (or stable model UUID); `*` runs for every model. */
+  hooks?: Record<string, ModelHooks>;
+  routes?: ExtensionRoute[];
+  /** Constructed once at startup, in order, and shared by hooks, routes and jobs. */
+  services?: Record<string, ServiceFactory>;
+  /** Custom field editor modules: file names inside `extensions/editors/` (built ES modules). */
+  editors?: string[];
+  /** Job handlers by name; registered as `ext.<name>`. */
+  jobs?: Record<string, ExtensionJobHandler>;
+};
+/** Identity helper for completion and type checking in `shapio.config.ts`. */
+declare const defineConfig: (config: ShapioConfig) => ShapioConfig;
+declare const HOOK_ERROR_BRAND: unique symbol;
+/**
+ * Thrown by a `before*` hook to reject a write: the API answers 422 with code `HOOK_REJECTED`, this message
+ * and the details. Recognised by a brand, not `instanceof`, so a copy of this class loaded from another
+ * path (a project's own `node_modules`) works the same.
+ */
+declare class HookError extends Error {
+  readonly details: Record<string, unknown> | undefined;
+  readonly [HOOK_ERROR_BRAND] = true;
+  constructor(message: string, details?: Record<string, unknown>);
+}
+declare const isHookError: (error: unknown) => error is HookError;
+//#endregion
+export { ServiceFactoryContext as A, HookEvent as C, MediaUsage as D, MediaReferenceService as E, PermissionEvaluator as F, Principal as I, DB as L, ShapioServices as M, defineConfig as N, ModelHooks as O, isHookError as P, OutboxEvents as R, HookError as S, JobHandlerContext as T, ExtensionRoute as _, BeforeHookContext as a, ExtensionSite as b, ContentReadOptions as c, EXTENSION_CONTRACT_VERSION as d, EnqueueOptions as f, ExtensionJobService as g, ExtensionJobHandler as h, BeforeHook as i, ShapioConfig as j, ServiceFactory as k, ContentReadService as l, ExtensionHostConfig as m, AfterHookContext as n, BeforeHookEvent as o, EntryData as p, AfterHookEvent as r, ContentReadEntry as s, AfterHook as t, CustomServices as u, ExtensionRouteOptions as v, HookModel as w, HookEntry as x, ExtensionServices as y, ContentData as z };
+//# sourceMappingURL=public-CGO8RBn3.d.ts.map