@shapio/cms 0.3.0 → 0.3.1

package/dist/config.d.ts

@@ -1,2 +1,2 @@
-import { A as ServiceFactoryContext, C as HookEvent, D as MediaUsage, E as MediaReferenceService, M as ShapioServices, N as defineConfig, O as ModelHooks, P as isHookError, S as HookError, T as JobHandlerContext, _ as ExtensionRoute, a as BeforeHookContext, b as ExtensionSite, c as ContentReadOptions, d as EXTENSION_CONTRACT_VERSION, f as EnqueueOptions, g as ExtensionJobService, h as ExtensionJobHandler, i as BeforeHook, j as ShapioConfig, k as ServiceFactory, l as ContentReadService, m as ExtensionHostConfig, n as AfterHookContext, o as BeforeHookEvent, p as EntryData, r as AfterHookEvent, s as ContentReadEntry, t as AfterHook, u as CustomServices, v as ExtensionRouteOptions, w as HookModel, x as HookEntry, y as ExtensionServices } from "./public-CGO8RBn3.js";
-export { AfterHook, AfterHookContext, AfterHookEvent, BeforeHook, BeforeHookContext, BeforeHookEvent, ContentReadEntry, ContentReadOptions, ContentReadService, CustomServices, EXTENSION_CONTRACT_VERSION, EnqueueOptions, EntryData, ExtensionHostConfig, ExtensionJobHandler, ExtensionJobService, ExtensionRoute, ExtensionRouteOptions, ExtensionServices, ExtensionSite, HookEntry, HookError, HookEvent, HookModel, JobHandlerContext, MediaReferenceService, MediaUsage, ModelHooks, ServiceFactory, ServiceFactoryContext, ShapioConfig, ShapioServices, defineConfig, isHookError };
+import { A as ServiceFactoryContext, C as HookEvent, D as MediaUsage, E as MediaReferenceService, F as defineConfig, I as isHookError, M as ShapioServices, N as ThemeDefinition, O as ModelHooks, P as ThemeTokens, S as HookError, T as JobHandlerContext, _ as ExtensionRoute, a as BeforeHookContext, b as ExtensionSite, c as ContentReadOptions, d as EXTENSION_CONTRACT_VERSION, f as EnqueueOptions, g as ExtensionJobService, h as ExtensionJobHandler, i as BeforeHook, j as ShapioConfig, k as ServiceFactory, l as ContentReadService, m as ExtensionHostConfig, n as AfterHookContext, o as BeforeHookEvent, p as EntryData, r as AfterHookEvent, s as ContentReadEntry, t as AfterHook, u as CustomServices, v as ExtensionRouteOptions, w as HookModel, x as HookEntry, y as ExtensionServices } from "./public-B7fFHMNr.js";
+export { AfterHook, AfterHookContext, AfterHookEvent, BeforeHook, BeforeHookContext, BeforeHookEvent, ContentReadEntry, ContentReadOptions, ContentReadService, CustomServices, EXTENSION_CONTRACT_VERSION, EnqueueOptions, EntryData, ExtensionHostConfig, ExtensionJobHandler, ExtensionJobService, ExtensionRoute, ExtensionRouteOptions, ExtensionServices, ExtensionSite, HookEntry, HookError, HookEvent, HookModel, JobHandlerContext, MediaReferenceService, MediaUsage, ModelHooks, ServiceFactory, ServiceFactoryContext, ShapioConfig, ShapioServices, ThemeDefinition, ThemeTokens, defineConfig, isHookError };

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","names":[],"sources":["../src/extensions/public.ts"],"sourcesContent":["import type { FastifyBaseLogger, FastifyPluginAsync, preHandlerAsyncHookHandler } from 'fastify';\nimport type { Kysely, Transaction } from 'kysely';\nimport type { DB } from '../db/types.js';\nimport type { PermissionEvaluator, Principal } from '../permissions/types.js';\nimport type { RouteAuditConfig } from '../plugins/auditDeclaration.js';\n\n// What Shapio adds to Fastify, repeated here so custom route code is typed without the server's internals.\ndeclare module 'fastify' {\n  interface FastifyRequest {\n    /** Who is calling. Anonymous unless a session cookie or API token resolved. Never null after onRequest. */\n    principal: Principal;\n    /**\n     * The request's site on a site route (custom routes are site routes): the credential's site, else the\n     * `Shapio-Site` header or `?site=`, else the primary site. Undefined on a route declaring\n     * `config.site = 'network'`.\n     */\n    site: { id: string; key: string } | undefined;\n  }\n  interface FastifyContextConfig {\n    /** Required on every mutating route: the audit action recorded on success, or `{ exempt: '<why>' }`. */\n    audit?: RouteAuditConfig;\n    /** `'network'` for a custom route that is about the whole instance rather than one site. */\n    site?: 'site' | 'network';\n  }\n}\n\n/**\n * The project extension contract (ADR 0009), imported by project authors from `@shapio/cms/config`:\n *\n * ```ts\n * import { defineConfig } from '@shapio/cms/config';\n * export const config = defineConfig({ hooks: { article: { beforePublish: (ctx) => { ... } } } });\n * ```\n *\n * Extensions are code: changing them needs a restart of Shapio (never a rebuild). Content models are never\n * configured here; they change live in the admin. This file has no runtime imports from the server, so a\n * config that imports it stays cheap to load.\n *\n * Stability: everything exported here follows semver with `EXTENSION_CONTRACT_VERSION`; Shapio's database\n * tables (reachable through `trx`) are internal and may change in any release.\n */\nexport const EXTENSION_CONTRACT_VERSION = 1;\n\nexport type BeforeHookEvent = 'beforeCreate' | 'beforeUpdate' | 'beforePublish' | 'beforeDelete';\nexport type AfterHookEvent = 'afterCreate' | 'afterUpdate' | 'afterPublish' | 'afterDelete';\nexport type HookEvent = BeforeHookEvent | AfterHookEvent;\n\n/** A site of a multi-site instance: its stable ID and its key (sites share the schema, not content). */\nexport type ExtensionSite = { id: string; key: string };\n\n/** Entry data keyed by field API key (the admin API's shape; media and relations are IDs). */\nexport type EntryData = Readonly<Record<string, unknown>>;\n\nexport type HookModel = {\n  /** Stable model ID (never changes). */\n  id: string;\n  apiKey: string;\n  label: string;\n  kind: 'collection' | 'singleton';\n  localized: boolean;\n  draftAndPublish: boolean;\n};\n\nexport type HookEntry = {\n  id: string;\n  locale: string | null;\n  /** Which head the change is about: the draft (create/update), the live version (publish), or a delete. */\n  state: 'draft' | 'published' | 'deleted';\n};\n\nexport type ContentReadOptions = {\n  locale?: string;\n  /** Read as this principal (its permissions apply). Default: Shapio itself (everything). */\n  principal?: Principal;\n};\n\nexport type ContentReadEntry = {\n  id: string;\n  locale: string;\n  status: string;\n  data: Record<string, unknown>;\n};\n\n/** Read-only access to content (drafts, as the admin API shows them). Reads committed data. */\nexport type ContentReadService = {\n  get: (modelKey: string, id: string, options?: ContentReadOptions) => Promise<ContentReadEntry>;\n  /** `query` is a delivery-style querystring, e.g. `filters[title][$contains]=a&pageSize=10`. */\n  list: (\n    modelKey: string,\n    query?: string,\n    options?: Omit<ContentReadOptions, 'locale'>,\n  ) => Promise<{ items: ContentReadEntry[]; total: number }>;\n  /** Number of (non-deleted) entries of a model. */\n  count: (modelKey: string) => Promise<number>;\n  /** The active content models (collections and singletons) of this site: shared ones and its own. */\n  models: () => Promise<HookModel[]>;\n};\n\nexport type MediaUsage = {\n  entryId: string;\n  modelId: string;\n  fieldId: string;\n  locale: string;\n  state: string;\n};\n\nexport type MediaReferenceService = {\n  /** Where an asset is used (up to 100 references, plus the total). */\n  usages: (assetId: string) => Promise<{ items: MediaUsage[]; total: number }>;\n};\n\nexport type EnqueueOptions = {\n  runAt?: Date;\n  /** Enqueueing the same key twice creates one job. */\n  idempotencyKey?: string;\n  maxAttempts?: number;\n};\n\nexport type ExtensionJobService = {\n  /** Enqueues one of the project's own jobs (`jobs` in the config), by its name without the `ext.` prefix. */\n  enqueue: (\n    name: string,\n    payload?: Record<string, unknown>,\n    options?: EnqueueOptions,\n  ) => Promise<{ id: string; created: boolean }>;\n};\n\n/**\n * What Shapio offers extensions. Deliberately small; everything else goes through `trx` or HTTP.\n *\n * Content and media are per site. The services handed to a hook read the hook's site; the services given to\n * routes, jobs and service factories read the primary site. Use `forSite` for another one (in a custom\n * route: `services.forSite(request.site)`).\n */\nexport type ShapioServices = {\n  /** The site `content` and `media` read. */\n  site: ExtensionSite;\n  /** The same services reading another site. */\n  forSite: (site: ExtensionSite) => ShapioServices;\n  content: ContentReadService;\n  media: MediaReferenceService;\n  jobs: ExtensionJobService;\n  logger: FastifyBaseLogger;\n};\n\n/**\n * Your own services, by name. Augment it for typed access everywhere services appear:\n *\n * ```ts\n * declare module '@shapio/cms/config' {\n *   interface CustomServices { stats: StatsService }\n * }\n * ```\n */\n// eslint-disable-next-line @typescript-eslint/no-empty-object-type -- augmented by projects\nexport interface CustomServices {}\n\nexport type ExtensionServices = ShapioServices & CustomServices;\n\ntype HookContextBase = {\n  /** The site the entry belongs to; `services` read this site. */\n  site: ExtensionSite;\n  model: HookModel;\n  entry: HookEntry;\n  locale: string | null;\n  /** The document after the change (absent for deletes). */\n  data: EntryData | undefined;\n  /** The document before the change: the previous draft (update) or the live version (publish). */\n  before: EntryData | undefined;\n  /** Who made the change (an admin, an API token, an app user, or Shapio itself for scheduled work). */\n  principal: Principal;\n  services: ExtensionServices;\n  logger: FastifyBaseLogger;\n  /** Aborted when Shapio shuts down. */\n  signal: AbortSignal;\n};\n\n/**\n * `before*` hooks run INSIDE the write's transaction, before it commits. Throw `HookError` (or call\n * `reject`) to abort the write with 422 `HOOK_REJECTED`; nothing of the write is kept. Other errors abort it\n * too, as a 500. Database work through `trx` commits or rolls back with the write.\n */\nexport type BeforeHookContext = HookContextBase & {\n  event: BeforeHookEvent;\n  trx: Transaction<DB>;\n  reject: (message: string, details?: Record<string, unknown>) => never;\n};\n\n/**\n * `after*` hooks run AFTER the write committed, as a job (retried with backoff on error, never rolling the\n * write back). Database work through `trx` is exactly once: it commits together with the record that the\n * hook ran. Other side effects (HTTP calls) are at least once: make them idempotent with `idempotencyKey`.\n */\nexport type AfterHookContext = HookContextBase & {\n  event: AfterHookEvent;\n  trx: Transaction<DB>;\n  /** The outbox event the hook runs for. */\n  eventId: string;\n  /** `<eventId>:<hook name>`: stable across retries. */\n  idempotencyKey: string;\n  attempt: number;\n};\n\nexport type BeforeHook = (context: BeforeHookContext) => Promise<void> | void;\nexport type AfterHook = (context: AfterHookContext) => Promise<void> | void;\n\nexport type ModelHooks = { [E in BeforeHookEvent]?: BeforeHook } & { [E in AfterHookEvent]?: AfterHook };\n\nexport type ServiceFactoryContext = {\n  /** Kysely on Shapio's database. Shapio's own tables are internal and may change between releases. */\n  db: Kysely<DB>;\n  config: ExtensionHostConfig;\n  logger: FastifyBaseLogger;\n  /** Shapio's services plus the custom services declared before this one. */\n  services: ExtensionServices;\n};\n\nexport type ExtensionHostConfig = {\n  nodeEnv: 'development' | 'production' | 'test';\n  /** PUBLIC_URL origin, without a trailing slash. */\n  publicUrl: string;\n  basePath: string;\n  /** The directory holding shapio.config and extensions/. */\n  projectDir: string;\n};\n\nexport type ServiceFactory = (context: ServiceFactoryContext) => unknown;\n\n/** Options every custom route plugin receives (also available as `app.ext`). */\nexport type ExtensionRouteOptions = {\n  services: ExtensionServices;\n  /** Shapio's permission evaluator: `permissions.evaluate(request.principal, { action, modelId })`. */\n  permissions: PermissionEvaluator;\n  logger: FastifyBaseLogger;\n  /** preHandler: 401/403 unless the caller is an admin user or an admin API token. */\n  requireAdmin: preHandlerAsyncHookHandler;\n};\n\nexport type ExtensionRoute = {\n  /** Mounted at `/api/ext/<prefix>` (under BASE_PATH). Lower-case letters, digits and dashes. */\n  prefix: string;\n  plugin: FastifyPluginAsync<ExtensionRouteOptions>;\n};\n\nexport type JobHandlerContext = {\n  jobId: string;\n  payload: Record<string, unknown>;\n  attempt: number;\n  maxAttempts: number;\n  idempotencyKey: string | null;\n  services: ExtensionServices;\n  logger: FastifyBaseLogger;\n  signal: AbortSignal;\n};\n\n/** Throw to retry with backoff; the return value (JSON) is stored as the job result. */\nexport type ExtensionJobHandler = (context: JobHandlerContext) => Promise<unknown>;\n\nexport type ShapioConfig = {\n  /** Lifecycle hooks by model API ID (or stable model UUID); `*` runs for every model. */\n  hooks?: Record<string, ModelHooks>;\n  routes?: ExtensionRoute[];\n  /** Constructed once at startup, in order, and shared by hooks, routes and jobs. */\n  services?: Record<string, ServiceFactory>;\n  /** Custom field editor modules: file names inside `extensions/editors/` (built ES modules). */\n  editors?: string[];\n  /** Job handlers by name; registered as `ext.<name>`. */\n  jobs?: Record<string, ExtensionJobHandler>;\n};\n\n/** Identity helper for completion and type checking in `shapio.config.ts`. */\nexport const defineConfig = (config: ShapioConfig): ShapioConfig => config;\n\nconst HOOK_ERROR_BRAND = Symbol.for('shapio.HookError');\n\n/**\n * Thrown by a `before*` hook to reject a write: the API answers 422 with code `HOOK_REJECTED`, this message\n * and the details. Recognised by a brand, not `instanceof`, so a copy of this class loaded from another\n * path (a project's own `node_modules`) works the same.\n */\nexport class HookError extends Error {\n  readonly details: Record<string, unknown> | undefined;\n  readonly [HOOK_ERROR_BRAND] = true;\n\n  constructor(message: string, details?: Record<string, unknown>) {\n    super(message);\n    this.name = 'HookError';\n    this.details = details;\n  }\n}\n\nexport const isHookError = (error: unknown): error is HookError =>\n  typeof error === 'object' &&\n  error !== null &&\n  (error as Record<symbol, unknown>)[HOOK_ERROR_BRAND] === true;\n"],"mappings":";;;;;;;;;;;;;;;;AAyCA,MAAa,6BAA6B;;AAsO1C,MAAa,gBAAgB,WAAuC;AAEpE,MAAM,mBAAmB,OAAO,IAAI,kBAAkB;;;;;;AAOtD,IAAa,YAAb,cAA+B,MAAM;CACnC;CACA,CAAU,oBAAoB;CAE9B,YAAY,SAAiB,SAAmC;EAC9D,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,UAAU;CACjB;AACF;AAEA,MAAa,eAAe,UAC1B,OAAO,UAAU,YACjB,UAAU,QACT,MAAkC,sBAAsB"}
+{"version":3,"file":"config.js","names":[],"sources":["../src/extensions/public.ts"],"sourcesContent":["import type { ThemeToken } from '@shapio/schema';\nimport type { FastifyBaseLogger, FastifyPluginAsync, preHandlerAsyncHookHandler } from 'fastify';\nimport type { Kysely, Transaction } from 'kysely';\nimport type { DB } from '../db/types.js';\nimport type { PermissionEvaluator, Principal } from '../permissions/types.js';\nimport type { RouteAuditConfig } from '../plugins/auditDeclaration.js';\n\n// What Shapio adds to Fastify, repeated here so custom route code is typed without the server's internals.\ndeclare module 'fastify' {\n  interface FastifyRequest {\n    /** Who is calling. Anonymous unless a session cookie or API token resolved. Never null after onRequest. */\n    principal: Principal;\n    /**\n     * The request's site on a site route (custom routes are site routes): the credential's site, else the\n     * `Shapio-Site` header or `?site=`, else the primary site. Undefined on a route declaring\n     * `config.site = 'network'`.\n     */\n    site: { id: string; key: string } | undefined;\n  }\n  interface FastifyContextConfig {\n    /** Required on every mutating route: the audit action recorded on success, or `{ exempt: '<why>' }`. */\n    audit?: RouteAuditConfig;\n    /** `'network'` for a custom route that is about the whole instance rather than one site. */\n    site?: 'site' | 'network';\n  }\n}\n\n/**\n * The project extension contract (ADR 0009), imported by project authors from `@shapio/cms/config`:\n *\n * ```ts\n * import { defineConfig } from '@shapio/cms/config';\n * export const config = defineConfig({ hooks: { article: { beforePublish: (ctx) => { ... } } } });\n * ```\n *\n * Extensions are code: changing them needs a restart of Shapio (never a rebuild). Content models are never\n * configured here; they change live in the admin. This file has no runtime imports from the server, so a\n * config that imports it stays cheap to load.\n *\n * Stability: everything exported here follows semver with `EXTENSION_CONTRACT_VERSION`; Shapio's database\n * tables (reachable through `trx`) are internal and may change in any release.\n */\nexport const EXTENSION_CONTRACT_VERSION = 1;\n\nexport type BeforeHookEvent = 'beforeCreate' | 'beforeUpdate' | 'beforePublish' | 'beforeDelete';\nexport type AfterHookEvent = 'afterCreate' | 'afterUpdate' | 'afterPublish' | 'afterDelete';\nexport type HookEvent = BeforeHookEvent | AfterHookEvent;\n\n/** A site of a multi-site instance: its stable ID and its key (sites share the schema, not content). */\nexport type ExtensionSite = { id: string; key: string };\n\n/** Entry data keyed by field API key (the admin API's shape; media and relations are IDs). */\nexport type EntryData = Readonly<Record<string, unknown>>;\n\nexport type HookModel = {\n  /** Stable model ID (never changes). */\n  id: string;\n  apiKey: string;\n  label: string;\n  kind: 'collection' | 'singleton';\n  localized: boolean;\n  draftAndPublish: boolean;\n};\n\nexport type HookEntry = {\n  id: string;\n  locale: string | null;\n  /** Which head the change is about: the draft (create/update), the live version (publish), or a delete. */\n  state: 'draft' | 'published' | 'deleted';\n};\n\nexport type ContentReadOptions = {\n  locale?: string;\n  /** Read as this principal (its permissions apply). Default: Shapio itself (everything). */\n  principal?: Principal;\n};\n\nexport type ContentReadEntry = {\n  id: string;\n  locale: string;\n  status: string;\n  data: Record<string, unknown>;\n};\n\n/** Read-only access to content (drafts, as the admin API shows them). Reads committed data. */\nexport type ContentReadService = {\n  get: (modelKey: string, id: string, options?: ContentReadOptions) => Promise<ContentReadEntry>;\n  /** `query` is a delivery-style querystring, e.g. `filters[title][$contains]=a&pageSize=10`. */\n  list: (\n    modelKey: string,\n    query?: string,\n    options?: Omit<ContentReadOptions, 'locale'>,\n  ) => Promise<{ items: ContentReadEntry[]; total: number }>;\n  /** Number of (non-deleted) entries of a model. */\n  count: (modelKey: string) => Promise<number>;\n  /** The active content models (collections and singletons) of this site: shared ones and its own. */\n  models: () => Promise<HookModel[]>;\n};\n\nexport type MediaUsage = {\n  entryId: string;\n  modelId: string;\n  fieldId: string;\n  locale: string;\n  state: string;\n};\n\nexport type MediaReferenceService = {\n  /** Where an asset is used (up to 100 references, plus the total). */\n  usages: (assetId: string) => Promise<{ items: MediaUsage[]; total: number }>;\n};\n\nexport type EnqueueOptions = {\n  runAt?: Date;\n  /** Enqueueing the same key twice creates one job. */\n  idempotencyKey?: string;\n  maxAttempts?: number;\n};\n\nexport type ExtensionJobService = {\n  /** Enqueues one of the project's own jobs (`jobs` in the config), by its name without the `ext.` prefix. */\n  enqueue: (\n    name: string,\n    payload?: Record<string, unknown>,\n    options?: EnqueueOptions,\n  ) => Promise<{ id: string; created: boolean }>;\n};\n\n/**\n * What Shapio offers extensions. Deliberately small; everything else goes through `trx` or HTTP.\n *\n * Content and media are per site. The services handed to a hook read the hook's site; the services given to\n * routes, jobs and service factories read the primary site. Use `forSite` for another one (in a custom\n * route: `services.forSite(request.site)`).\n */\nexport type ShapioServices = {\n  /** The site `content` and `media` read. */\n  site: ExtensionSite;\n  /** The same services reading another site. */\n  forSite: (site: ExtensionSite) => ShapioServices;\n  content: ContentReadService;\n  media: MediaReferenceService;\n  jobs: ExtensionJobService;\n  logger: FastifyBaseLogger;\n};\n\n/**\n * Your own services, by name. Augment it for typed access everywhere services appear:\n *\n * ```ts\n * declare module '@shapio/cms/config' {\n *   interface CustomServices { stats: StatsService }\n * }\n * ```\n */\n// eslint-disable-next-line @typescript-eslint/no-empty-object-type -- augmented by projects\nexport interface CustomServices {}\n\nexport type ExtensionServices = ShapioServices & CustomServices;\n\ntype HookContextBase = {\n  /** The site the entry belongs to; `services` read this site. */\n  site: ExtensionSite;\n  model: HookModel;\n  entry: HookEntry;\n  locale: string | null;\n  /** The document after the change (absent for deletes). */\n  data: EntryData | undefined;\n  /** The document before the change: the previous draft (update) or the live version (publish). */\n  before: EntryData | undefined;\n  /** Who made the change (an admin, an API token, an app user, or Shapio itself for scheduled work). */\n  principal: Principal;\n  services: ExtensionServices;\n  logger: FastifyBaseLogger;\n  /** Aborted when Shapio shuts down. */\n  signal: AbortSignal;\n};\n\n/**\n * `before*` hooks run INSIDE the write's transaction, before it commits. Throw `HookError` (or call\n * `reject`) to abort the write with 422 `HOOK_REJECTED`; nothing of the write is kept. Other errors abort it\n * too, as a 500. Database work through `trx` commits or rolls back with the write.\n */\nexport type BeforeHookContext = HookContextBase & {\n  event: BeforeHookEvent;\n  trx: Transaction<DB>;\n  reject: (message: string, details?: Record<string, unknown>) => never;\n};\n\n/**\n * `after*` hooks run AFTER the write committed, as a job (retried with backoff on error, never rolling the\n * write back). Database work through `trx` is exactly once: it commits together with the record that the\n * hook ran. Other side effects (HTTP calls) are at least once: make them idempotent with `idempotencyKey`.\n */\nexport type AfterHookContext = HookContextBase & {\n  event: AfterHookEvent;\n  trx: Transaction<DB>;\n  /** The outbox event the hook runs for. */\n  eventId: string;\n  /** `<eventId>:<hook name>`: stable across retries. */\n  idempotencyKey: string;\n  attempt: number;\n};\n\nexport type BeforeHook = (context: BeforeHookContext) => Promise<void> | void;\nexport type AfterHook = (context: AfterHookContext) => Promise<void> | void;\n\nexport type ModelHooks = { [E in BeforeHookEvent]?: BeforeHook } & { [E in AfterHookEvent]?: AfterHook };\n\nexport type ServiceFactoryContext = {\n  /** Kysely on Shapio's database. Shapio's own tables are internal and may change between releases. */\n  db: Kysely<DB>;\n  config: ExtensionHostConfig;\n  logger: FastifyBaseLogger;\n  /** Shapio's services plus the custom services declared before this one. */\n  services: ExtensionServices;\n};\n\nexport type ExtensionHostConfig = {\n  nodeEnv: 'development' | 'production' | 'test';\n  /** PUBLIC_URL origin, without a trailing slash. */\n  publicUrl: string;\n  basePath: string;\n  /** The directory holding shapio.config and extensions/. */\n  projectDir: string;\n};\n\nexport type ServiceFactory = (context: ServiceFactoryContext) => unknown;\n\n/** Options every custom route plugin receives (also available as `app.ext`). */\nexport type ExtensionRouteOptions = {\n  services: ExtensionServices;\n  /** Shapio's permission evaluator: `permissions.evaluate(request.principal, { action, modelId })`. */\n  permissions: PermissionEvaluator;\n  logger: FastifyBaseLogger;\n  /** preHandler: 401/403 unless the caller is an admin user or an admin API token. */\n  requireAdmin: preHandlerAsyncHookHandler;\n};\n\nexport type ExtensionRoute = {\n  /** Mounted at `/api/ext/<prefix>` (under BASE_PATH). Lower-case letters, digits and dashes. */\n  prefix: string;\n  plugin: FastifyPluginAsync<ExtensionRouteOptions>;\n};\n\nexport type JobHandlerContext = {\n  jobId: string;\n  payload: Record<string, unknown>;\n  attempt: number;\n  maxAttempts: number;\n  idempotencyKey: string | null;\n  services: ExtensionServices;\n  logger: FastifyBaseLogger;\n  signal: AbortSignal;\n};\n\n/** Throw to retry with backoff; the return value (JSON) is stored as the job result. */\nexport type ExtensionJobHandler = (context: JobHandlerContext) => Promise<unknown>;\n\n/**\n * A colour theme for the admin: token values for a light variant, a dark variant, or both. Every UI token is\n * required in a variant; the `brand-*` tokens may be left out (Shapio's are used). Values are `#rrggbb`\n * (contrast is checked by `shapio extensions check`), `#rgb`, `#rrggbbaa`, or `rgb()`, `hsl()`, `oklch()`,\n * `oklab()` with plain arguments.\n */\nexport type ThemeTokens = Partial<Record<ThemeToken, string>>;\n\nexport type ThemeDefinition = {\n  /** Lower-case letters, digits and dashes; not a built-in theme's key. Saved in each browser's setting. */\n  key: string;\n  /** Shown in the theme menu (not translated). */\n  name: string;\n  description?: string;\n  light?: ThemeTokens;\n  dark?: ThemeTokens;\n};\n\nexport type ShapioConfig = {\n  /** Lifecycle hooks by model API ID (or stable model UUID); `*` runs for every model. */\n  hooks?: Record<string, ModelHooks>;\n  routes?: ExtensionRoute[];\n  /** Constructed once at startup, in order, and shared by hooks, routes and jobs. */\n  services?: Record<string, ServiceFactory>;\n  /** Custom field editor modules: file names inside `extensions/editors/` (built ES modules). */\n  editors?: string[];\n  /** Job handlers by name; registered as `ext.<name>`. */\n  jobs?: Record<string, ExtensionJobHandler>;\n  /** Admin colour themes, listed after the built-in ones in the theme menu. */\n  themes?: ThemeDefinition[];\n};\n\n/** Identity helper for completion and type checking in `shapio.config.ts`. */\nexport const defineConfig = (config: ShapioConfig): ShapioConfig => config;\n\nconst HOOK_ERROR_BRAND = Symbol.for('shapio.HookError');\n\n/**\n * Thrown by a `before*` hook to reject a write: the API answers 422 with code `HOOK_REJECTED`, this message\n * and the details. Recognised by a brand, not `instanceof`, so a copy of this class loaded from another\n * path (a project's own `node_modules`) works the same.\n */\nexport class HookError extends Error {\n  readonly details: Record<string, unknown> | undefined;\n  readonly [HOOK_ERROR_BRAND] = true;\n\n  constructor(message: string, details?: Record<string, unknown>) {\n    super(message);\n    this.name = 'HookError';\n    this.details = details;\n  }\n}\n\nexport const isHookError = (error: unknown): error is HookError =>\n  typeof error === 'object' &&\n  error !== null &&\n  (error as Record<symbol, unknown>)[HOOK_ERROR_BRAND] === true;\n"],"mappings":";;;;;;;;;;;;;;;;AA0CA,MAAa,6BAA6B;;AA0P1C,MAAa,gBAAgB,WAAuC;AAEpE,MAAM,mBAAmB,OAAO,IAAI,kBAAkB;;;;;;AAOtD,IAAa,YAAb,cAA+B,MAAM;CACnC;CACA,CAAU,oBAAoB;CAE9B,YAAY,SAAiB,SAAmC;EAC9D,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,UAAU;CACjB;AACF;AAEA,MAAa,eAAe,UAC1B,OAAO,UAAU,YACjB,UAAU,QACT,MAAkC,sBAAsB"}

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { A as ServiceFactoryContext, C as HookEvent, D as MediaUsage, E as MediaReferenceService, F as PermissionEvaluator, I as Principal, L as DB, M as ShapioServices, N as defineConfig, O as ModelHooks, P as isHookError, R as OutboxEvents, S as HookError, T as JobHandlerContext, _ as ExtensionRoute, a as BeforeHookContext, b as ExtensionSite, c as ContentReadOptions, d as EXTENSION_CONTRACT_VERSION, f as EnqueueOptions, g as ExtensionJobService, h as ExtensionJobHandler, i as BeforeHook, j as ShapioConfig, k as ServiceFactory, l as ContentReadService, m as ExtensionHostConfig, n as AfterHookContext, o as BeforeHookEvent, p as EntryData, r as AfterHookEvent, s as ContentReadEntry, t as AfterHook, u as CustomServices, v as ExtensionRouteOptions, w as HookModel, x as HookEntry, y as ExtensionServices, z as ContentData } from "./public-CGO8RBn3.js";
+import { A as ServiceFactoryContext, B as Database, C as HookEvent, D as MediaUsage, E as MediaReferenceService, F as defineConfig, G as DataType, H as OutboxEvents, I as isHookError, J as SchemaChange, K as JsonValue, L as PermissionEvaluator, M as ShapioServices, N as ThemeDefinition, O as ModelHooks, P as ThemeTokens, R as PermissionExecutor, S as HookError, T as JobHandlerContext, U as ContentData, V as DB, W as ComponentDefinition, _ as ExtensionRoute, a as BeforeHookContext, b as ExtensionSite, c as ContentReadOptions, d as EXTENSION_CONTRACT_VERSION, f as EnqueueOptions, g as ExtensionJobService, h as ExtensionJobHandler, i as BeforeHook, j as ShapioConfig, k as ServiceFactory, l as ContentReadService, m as ExtensionHostConfig, n as AfterHookContext, o as BeforeHookEvent, p as EntryData, q as ModelDefinition, r as AfterHookEvent, s as ContentReadEntry, t as AfterHook, u as CustomServices, v as ExtensionRouteOptions, w as HookModel, x as HookEntry, y as ExtensionServices, z as Principal } from "./public-B7fFHMNr.js";
 import { FastifyBaseLogger, FastifyInstance } from "fastify";
 import { Kysely, Selectable, Transaction } from "kysely";
 import { Static, Type } from "typebox";
@@ -35,6 +35,11 @@ declare const configSchema: Type.TObject<{
   HTTP_PORT: Type.TOptional<Type.TInteger>;
   DATABASE_URL: Type.TString;
   DATABASE_POOL_MAX: Type.TInteger;
+  /**
+   * How long a request waits for a free pooled connection (PostgreSQL and MySQL) before it fails with
+   * 503 `DATABASE_BUSY` and a logged error, instead of queueing forever. SQLite never waits for one.
+   */
+  DATABASE_POOL_ACQUIRE_TIMEOUT_MS: Type.TInteger;
   MIGRATE_ON_START: Type.TBoolean;
   /**
    * LISTEN for schema-change notifications to refresh caches early. Turn off where LISTEN does not work
@@ -343,6 +348,7 @@ type AppConfig = {
   database: {
     url: string;
     poolMax: number;
+    acquireTimeoutMs: number;
     migrateOnStart: boolean;
   };
   /** `listen`: use LISTEN/NOTIFY to refresh schema caches early (correctness never depends on it). */
@@ -420,222 +426,6 @@ type SiteRef = {
   key: string;
 };
 //#endregion
-//#region ../../packages/schema/dist/index.d.ts
-//#endregion
-//#region src/types/dataTypes.d.ts
-/** Every stored data type. A field's data type is separate from the editor that renders it (brief §2.5). */
-declare const DATA_TYPES: readonly ["string", "text", "richtext", "number", "integer", "decimal", "biginteger", "boolean", "date", "datetime", "time", "enum", "json", "slug", "email", "url", "uid", "media", "relation", "component", "dynamiczone"];
-type DataType = (typeof DATA_TYPES)[number];
-//#endregion
-//#region src/types/json.d.ts
-type JsonPrimitive = string | number | boolean | null;
-type JsonValue = JsonPrimitive | JsonValue[] | {
-  [key: string]: JsonValue;
-};
-declare const SETTINGS_SCHEMAS: {
-  string: Type.TObject<{
-    pattern: Type.TOptional<Type.TString>;
-    minLength: Type.TOptional<Type.TInteger>;
-    maxLength: Type.TOptional<Type.TInteger>;
-  }>;
-  text: Type.TObject<{
-    minLength: Type.TOptional<Type.TInteger>;
-    maxLength: Type.TOptional<Type.TInteger>;
-  }>;
-  richtext: Type.TObject<{
-    formatVersion: Type.TOptional<Type.TInteger>;
-    maxLength: Type.TOptional<Type.TInteger>;
-  }>;
-  number: Type.TObject<{
-    min: Type.TOptional<Type.TNumber>;
-    max: Type.TOptional<Type.TNumber>;
-  }>;
-  integer: Type.TObject<{
-    min: Type.TOptional<Type.TInteger>;
-    max: Type.TOptional<Type.TInteger>;
-  }>;
-  decimal: Type.TObject<{
-    precision: Type.TOptional<Type.TInteger>;
-    scale: Type.TOptional<Type.TInteger>;
-    min: Type.TOptional<Type.TString>;
-    max: Type.TOptional<Type.TString>;
-  }>;
-  biginteger: Type.TObject<{
-    min: Type.TOptional<Type.TString>;
-    max: Type.TOptional<Type.TString>;
-  }>;
-  boolean: Type.TObject<{}>;
-  date: Type.TObject<{
-    min: Type.TOptional<Type.TString>;
-    max: Type.TOptional<Type.TString>;
-  }>;
-  datetime: Type.TObject<{
-    min: Type.TOptional<Type.TString>;
-    max: Type.TOptional<Type.TString>;
-  }>;
-  time: Type.TObject<{
-    min: Type.TOptional<Type.TString>;
-    max: Type.TOptional<Type.TString>;
-  }>;
-  enum: Type.TObject<{
-    values: Type.TArray<Type.TObject<{
-      value: Type.TString;
-      label: Type.TString;
-    }>>;
-    multiple: Type.TOptional<Type.TBoolean>;
-  }>;
-  json: Type.TObject<{}>;
-  slug: Type.TObject<{
-    sourceFieldId: Type.TOptional<Type.TString>;
-    minLength: Type.TOptional<Type.TInteger>;
-    maxLength: Type.TOptional<Type.TInteger>;
-  }>;
-  email: Type.TObject<{}>;
-  url: Type.TObject<{
-    protocols: Type.TOptional<Type.TArray<Type.TEnum<["http", "https", "mailto", "tel"]>>>;
-  }>;
-  uid: Type.TObject<{
-    minLength: Type.TOptional<Type.TInteger>;
-    maxLength: Type.TOptional<Type.TInteger>;
-  }>;
-  media: Type.TObject<{
-    min: Type.TOptional<Type.TInteger>;
-    max: Type.TOptional<Type.TInteger>;
-    multiple: Type.TOptional<Type.TBoolean>;
-    allowedKinds: Type.TOptional<Type.TArray<Type.TEnum<["image", "video", "audio", "document", "other"]>>>;
-  }>;
-  relation: Type.TObject<{
-    min: Type.TOptional<Type.TInteger>;
-    max: Type.TOptional<Type.TInteger>;
-    target: Type.TString;
-    cardinality: Type.TEnum<["one", "many"]>;
-  }>;
-  component: Type.TObject<{
-    min: Type.TOptional<Type.TInteger>;
-    max: Type.TOptional<Type.TInteger>;
-    component: Type.TString;
-    repeatable: Type.TOptional<Type.TBoolean>;
-  }>;
-  dynamiczone: Type.TObject<{
-    min: Type.TOptional<Type.TInteger>;
-    max: Type.TOptional<Type.TInteger>;
-    components: Type.TArray<Type.TString>;
-  }>;
-};
-type SettingsSchemas = typeof SETTINGS_SCHEMAS;
-/** Settings as authored (defaults may be missing). */
-type DataTypeSettingsInput = { [T in DataType]: Static<SettingsSchemas[T]>; };
-/** Settings after normalization: the defaulted keys are always present. */
-type DataTypeSettings = Omit<DataTypeSettingsInput, 'richtext' | 'enum' | 'media' | 'component'> & {
-  richtext: DataTypeSettingsInput['richtext'] & {
-    formatVersion: number;
-  };
-  enum: DataTypeSettingsInput['enum'] & {
-    multiple: boolean;
-  };
-  media: DataTypeSettingsInput['media'] & {
-    multiple: boolean;
-  };
-  component: DataTypeSettingsInput['component'] & {
-    repeatable: boolean;
-  };
-};
-//#endregion
-//#region src/types/definitions.d.ts
-declare const MODEL_KINDS: readonly ["collection", "singleton"];
-type ModelKind = (typeof MODEL_KINDS)[number];
-declare const SORT_DIRECTIONS: readonly ["asc", "desc"];
-type SortDirection = (typeof SORT_DIRECTIONS)[number];
-type EditorChoice = {
-  id: string;
-  options: Record<string, JsonValue>;
-};
-type FieldBase = {
-  id: string;
-  apiKey: string;
-  label: string;
-  description?: string;
-  required: boolean;
-  localized: boolean;
-  public: boolean;
-  unique: boolean;
-  filterable: boolean;
-  sortable: boolean;
-  deprecated: boolean;
-  defaultValue?: JsonValue;
-  editor: EditorChoice;
-};
-/** A normalized field. Narrow on `type` to get typed `settings`. */
-type FieldDefinition<T extends DataType = DataType> = { [K in T]: FieldBase & {
-  type: K;
-  settings: DataTypeSettings[K];
-}; }[T];
-type FieldGroup = {
-  id: string;
-  label: string;
-  fieldIds: string[];
-};
-type ModelDisplay = {
-  titleFieldId?: string;
-  listFieldIds?: string[];
-  defaultSort?: {
-    fieldId: string;
-    direction: SortDirection;
-  };
-  groups?: FieldGroup[];
-  canvasFieldIds?: string[];
-  coverFieldId?: string;
-  stripFieldIds?: string[];
-};
-type ComponentDisplay = {
-  titleFieldId?: string;
-  groups?: FieldGroup[];
-};
-type ModelDefinition = {
-  id: string;
-  kind: ModelKind;
-  apiKey: string;
-  /**
-   * Present on collections (filled by normalizing), absent on singletons. Read it through `routeKeyOf`,
-   * which also covers a stored definition that predates plural API IDs.
-   */
-  pluralApiKey?: string;
-  label: string;
-  description?: string;
-  localized: boolean;
-  draftAndPublish: boolean;
-  fields: FieldDefinition[];
-  display: ModelDisplay;
-};
-type ComponentDefinition = {
-  id: string;
-  kind: 'component';
-  apiKey: string;
-  label: string;
-  description?: string;
-  category?: string;
-  icon?: string;
-  fields: FieldDefinition[];
-  display: ComponentDisplay;
-};
-//#endregion
-//#region src/diff/types.d.ts
-declare const CHANGE_KINDS: readonly ["definition.added", "definition.removed", "definition.apiKey", "definition.pluralApiKey", "definition.metadata", "model.kind", "model.localized", "model.draftAndPublish", "field.added", "field.removed", "field.order", "field.apiKey", "field.metadata", "field.editor", "field.type", "field.required", "field.localized", "field.public", "field.deprecated", "field.unique", "field.filterable", "field.sortable", "field.settings"];
-type ChangeKind = (typeof CHANGE_KINDS)[number];
-/**
- * One difference between two versions of a definition. `property` names the changed property for
- * `*.metadata` (`label`, `description`, ...) and `field.settings` (the settings key); `from`/`to` hold the
- * old and new values (absent when the side does not exist).
- */
-type SchemaChange = {
-  kind: ChangeKind;
-  definitionId: string;
-  fieldId?: string;
-  property?: string;
-  from?: JsonValue;
-  to?: JsonValue;
-};
-//#endregion
 //#region src/content/model.d.ts
 /** A collection or singleton resolved from a pinned snapshot, with what writes need to know about it. */
 type ContentModel = {
@@ -682,9 +472,6 @@ type ContentHooks = {
   run: (event: LifecycleEvent, context: LifecycleContext) => Promise<void>;
 };
 //#endregion
-//#region src/db/index.d.ts
-type Database = Kysely<DB>;
-//#endregion
 //#region src/extensions/editorManifest.d.ts
 /**
  * The custom field editors a project installs (ADR 0009): built ES modules in `extensions/editors/*.js`,
@@ -778,13 +565,13 @@ type ModelField = {
  * only name real models.
  */
 type FieldVisibilityLookup = {
-  getModelFields: (modelId: string) => Promise<readonly ModelField[] | undefined>;
-  hasModel: (modelId: string) => Promise<boolean>;
+  getModelFields: (modelId: string, executor?: PermissionExecutor) => Promise<readonly ModelField[] | undefined>;
+  hasModel: (modelId: string, executor?: PermissionExecutor) => Promise<boolean>;
   /**
    * The site a definition belongs to: null when it is shared (or unknown). Schema management of a site's
    * definition is granted by roles held on that site (plan site-schema, rule 4).
    */
-  getModelSite: (modelId: string) => Promise<string | null>;
+  getModelSite: (modelId: string, executor?: PermissionExecutor) => Promise<string | null>;
 };
 //#endregion
 //#region src/publishing/outbound/ssrf.d.ts
@@ -1052,5 +839,5 @@ export declare const startDedicatedWorker: (config: AppConfig) => Promise<Worker
 //#region src/constants/version.d.ts
 export declare const SHAPIO_VERSION: string;
 //#endregion
-export { AfterHook, AfterHookContext, AfterHookEvent, type AppConfig, type AppDependencies, BeforeHook, BeforeHookContext, BeforeHookEvent, ContentReadEntry, ContentReadOptions, ContentReadService, CustomServices, EXTENSION_CONTRACT_VERSION, EnqueueOptions, EntryData, ExtensionHostConfig, ExtensionJobHandler, ExtensionJobService, ExtensionRoute, ExtensionRouteOptions, ExtensionServices, ExtensionSite, HookEntry, HookError, HookEvent, HookModel, JobHandlerContext, MediaReferenceService, MediaUsage, ModelHooks, type RunningServer, ServiceFactory, ServiceFactoryContext, ShapioConfig, ShapioServices, defineConfig, isHookError };
+export { AfterHook, AfterHookContext, AfterHookEvent, type AppConfig, type AppDependencies, BeforeHook, BeforeHookContext, BeforeHookEvent, ContentReadEntry, ContentReadOptions, ContentReadService, CustomServices, EXTENSION_CONTRACT_VERSION, EnqueueOptions, EntryData, ExtensionHostConfig, ExtensionJobHandler, ExtensionJobService, ExtensionRoute, ExtensionRouteOptions, ExtensionServices, ExtensionSite, HookEntry, HookError, HookEvent, HookModel, JobHandlerContext, MediaReferenceService, MediaUsage, ModelHooks, type RunningServer, ServiceFactory, ServiceFactoryContext, ShapioConfig, ShapioServices, ThemeDefinition, ThemeTokens, defineConfig, isHookError };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,3 +1,3 @@
-import { a as loadConfig, n as startServer, s as buildApp, t as startDedicatedWorker, u as SHAPIO_VERSION } from "./worker-BLXy8aRW.js";
+import { a as loadConfig, n as startServer, s as buildApp, t as startDedicatedWorker, u as SHAPIO_VERSION } from "./worker-BAmQPoTJ.js";
 import { EXTENSION_CONTRACT_VERSION, HookError, defineConfig, isHookError } from "./config.js";
 export { EXTENSION_CONTRACT_VERSION, HookError, SHAPIO_VERSION, buildApp, defineConfig, isHookError, loadConfig, startDedicatedWorker, startServer };

package/dist/{public-CGO8RBn3.d.ts → public-B7fFHMNr.d.ts}

@@ -1,5 +1,224 @@
 import { FastifyBaseLogger, FastifyInstance, FastifyPluginAsync, preHandlerAsyncHookHandler } from "fastify";
 import { ColumnType, Kysely, Transaction } from "kysely";
+import { Static, Type } from "typebox";
+//#region ../../packages/schema/dist/index.d.ts
+//#endregion
+//#region src/types/dataTypes.d.ts
+/** Every stored data type. A field's data type is separate from the editor that renders it (brief §2.5). */
+declare const DATA_TYPES: readonly ["string", "text", "richtext", "number", "integer", "decimal", "biginteger", "boolean", "date", "datetime", "time", "enum", "json", "slug", "email", "url", "uid", "media", "relation", "component", "dynamiczone"];
+type DataType = (typeof DATA_TYPES)[number];
+//#endregion
+//#region src/types/json.d.ts
+type JsonPrimitive$1 = string | number | boolean | null;
+type JsonValue$1 = JsonPrimitive$1 | JsonValue$1[] | {
+  [key: string]: JsonValue$1;
+};
+declare const SETTINGS_SCHEMAS: {
+  string: Type.TObject<{
+    pattern: Type.TOptional<Type.TString>;
+    minLength: Type.TOptional<Type.TInteger>;
+    maxLength: Type.TOptional<Type.TInteger>;
+  }>;
+  text: Type.TObject<{
+    minLength: Type.TOptional<Type.TInteger>;
+    maxLength: Type.TOptional<Type.TInteger>;
+  }>;
+  richtext: Type.TObject<{
+    formatVersion: Type.TOptional<Type.TInteger>;
+    maxLength: Type.TOptional<Type.TInteger>;
+  }>;
+  number: Type.TObject<{
+    min: Type.TOptional<Type.TNumber>;
+    max: Type.TOptional<Type.TNumber>;
+  }>;
+  integer: Type.TObject<{
+    min: Type.TOptional<Type.TInteger>;
+    max: Type.TOptional<Type.TInteger>;
+  }>;
+  decimal: Type.TObject<{
+    precision: Type.TOptional<Type.TInteger>;
+    scale: Type.TOptional<Type.TInteger>;
+    min: Type.TOptional<Type.TString>;
+    max: Type.TOptional<Type.TString>;
+  }>;
+  biginteger: Type.TObject<{
+    min: Type.TOptional<Type.TString>;
+    max: Type.TOptional<Type.TString>;
+  }>;
+  boolean: Type.TObject<{}>;
+  date: Type.TObject<{
+    min: Type.TOptional<Type.TString>;
+    max: Type.TOptional<Type.TString>;
+  }>;
+  datetime: Type.TObject<{
+    min: Type.TOptional<Type.TString>;
+    max: Type.TOptional<Type.TString>;
+  }>;
+  time: Type.TObject<{
+    min: Type.TOptional<Type.TString>;
+    max: Type.TOptional<Type.TString>;
+  }>;
+  enum: Type.TObject<{
+    values: Type.TArray<Type.TObject<{
+      value: Type.TString;
+      label: Type.TString;
+    }>>;
+    multiple: Type.TOptional<Type.TBoolean>;
+  }>;
+  json: Type.TObject<{}>;
+  slug: Type.TObject<{
+    sourceFieldId: Type.TOptional<Type.TString>;
+    minLength: Type.TOptional<Type.TInteger>;
+    maxLength: Type.TOptional<Type.TInteger>;
+  }>;
+  email: Type.TObject<{}>;
+  url: Type.TObject<{
+    protocols: Type.TOptional<Type.TArray<Type.TEnum<["http", "https", "mailto", "tel"]>>>;
+  }>;
+  uid: Type.TObject<{
+    minLength: Type.TOptional<Type.TInteger>;
+    maxLength: Type.TOptional<Type.TInteger>;
+  }>;
+  media: Type.TObject<{
+    min: Type.TOptional<Type.TInteger>;
+    max: Type.TOptional<Type.TInteger>;
+    multiple: Type.TOptional<Type.TBoolean>;
+    allowedKinds: Type.TOptional<Type.TArray<Type.TEnum<["image", "video", "audio", "document", "other"]>>>;
+  }>;
+  relation: Type.TObject<{
+    min: Type.TOptional<Type.TInteger>;
+    max: Type.TOptional<Type.TInteger>;
+    target: Type.TString;
+    cardinality: Type.TEnum<["one", "many"]>;
+  }>;
+  component: Type.TObject<{
+    min: Type.TOptional<Type.TInteger>;
+    max: Type.TOptional<Type.TInteger>;
+    component: Type.TString;
+    repeatable: Type.TOptional<Type.TBoolean>;
+  }>;
+  dynamiczone: Type.TObject<{
+    min: Type.TOptional<Type.TInteger>;
+    max: Type.TOptional<Type.TInteger>;
+    components: Type.TArray<Type.TString>;
+  }>;
+};
+type SettingsSchemas = typeof SETTINGS_SCHEMAS;
+/** Settings as authored (defaults may be missing). */
+type DataTypeSettingsInput = { [T in DataType]: Static<SettingsSchemas[T]>; };
+/** Settings after normalization: the defaulted keys are always present. */
+type DataTypeSettings = Omit<DataTypeSettingsInput, 'richtext' | 'enum' | 'media' | 'component'> & {
+  richtext: DataTypeSettingsInput['richtext'] & {
+    formatVersion: number;
+  };
+  enum: DataTypeSettingsInput['enum'] & {
+    multiple: boolean;
+  };
+  media: DataTypeSettingsInput['media'] & {
+    multiple: boolean;
+  };
+  component: DataTypeSettingsInput['component'] & {
+    repeatable: boolean;
+  };
+};
+//#endregion
+//#region src/types/definitions.d.ts
+declare const MODEL_KINDS: readonly ["collection", "singleton"];
+type ModelKind = (typeof MODEL_KINDS)[number];
+declare const SORT_DIRECTIONS: readonly ["asc", "desc"];
+type SortDirection = (typeof SORT_DIRECTIONS)[number];
+type EditorChoice = {
+  id: string;
+  options: Record<string, JsonValue$1>;
+};
+type FieldBase = {
+  id: string;
+  apiKey: string;
+  label: string;
+  description?: string;
+  required: boolean;
+  localized: boolean;
+  public: boolean;
+  unique: boolean;
+  filterable: boolean;
+  sortable: boolean;
+  deprecated: boolean;
+  defaultValue?: JsonValue$1;
+  editor: EditorChoice;
+};
+/** A normalized field. Narrow on `type` to get typed `settings`. */
+type FieldDefinition<T extends DataType = DataType> = { [K in T]: FieldBase & {
+  type: K;
+  settings: DataTypeSettings[K];
+}; }[T];
+type FieldGroup = {
+  id: string;
+  label: string;
+  fieldIds: string[];
+};
+type ModelDisplay = {
+  titleFieldId?: string;
+  listFieldIds?: string[];
+  defaultSort?: {
+    fieldId: string;
+    direction: SortDirection;
+  };
+  groups?: FieldGroup[];
+  canvasFieldIds?: string[];
+  coverFieldId?: string;
+  stripFieldIds?: string[];
+};
+type ComponentDisplay = {
+  titleFieldId?: string;
+  groups?: FieldGroup[];
+};
+type ModelDefinition = {
+  id: string;
+  kind: ModelKind;
+  apiKey: string;
+  /**
+   * Present on collections (filled by normalizing), absent on singletons. Read it through `routeKeyOf`,
+   * which also covers a stored definition that predates plural API IDs.
+   */
+  pluralApiKey?: string;
+  label: string;
+  description?: string;
+  localized: boolean;
+  draftAndPublish: boolean;
+  fields: FieldDefinition[];
+  display: ModelDisplay;
+};
+type ComponentDefinition = {
+  id: string;
+  kind: 'component';
+  apiKey: string;
+  label: string;
+  description?: string;
+  category?: string;
+  icon?: string;
+  fields: FieldDefinition[];
+  display: ComponentDisplay;
+};
+//#endregion
+//#region src/diff/types.d.ts
+declare const CHANGE_KINDS: readonly ["definition.added", "definition.removed", "definition.apiKey", "definition.pluralApiKey", "definition.metadata", "model.kind", "model.localized", "model.draftAndPublish", "field.added", "field.removed", "field.order", "field.apiKey", "field.metadata", "field.editor", "field.type", "field.required", "field.localized", "field.public", "field.deprecated", "field.unique", "field.filterable", "field.sortable", "field.settings"];
+type ChangeKind = (typeof CHANGE_KINDS)[number];
+/**
+ * One difference between two versions of a definition. `property` names the changed property for
+ * `*.metadata` (`label`, `description`, ...) and `field.settings` (the settings key); `from`/`to` hold the
+ * old and new values (absent when the side does not exist).
+ */
+type SchemaChange = {
+  kind: ChangeKind;
+  definitionId: string;
+  fieldId?: string;
+  property?: string;
+  from?: JsonValue$1;
+  to?: JsonValue$1;
+};
+declare const THEME_TOKENS: readonly ["background", "foreground", "card", "card-foreground", "popover", "popover-foreground", "primary", "primary-foreground", "primary-hover", "secondary", "secondary-foreground", "muted", "muted-foreground", "accent", "accent-foreground", "destructive", "destructive-foreground", "destructive-muted", "success", "success-muted", "warning", "warning-muted", "info", "info-muted", "border", "input", "ring", "link", "overlay", "sidebar", "sidebar-foreground", "sidebar-primary", "sidebar-primary-foreground", "sidebar-accent", "sidebar-accent-foreground", "sidebar-border", "sidebar-ring", "brand-logo", "brand-logo-foreground", "brand-letters", "brand-panel-from", "brand-panel-to", "brand-panel-foreground", "brand-panel-mark"];
+type ThemeToken = (typeof THEME_TOKENS)[number];
+//#endregion
 //#region src/db/contentData.d.ts
 /**
  * User content values: JSONB keyed by stable field IDs. The shape is only known at runtime from the active
@@ -799,6 +1018,9 @@ interface DB {
   webhooks: Webhooks;
 }
 //#endregion
+//#region src/db/index.d.ts
+type Database = Kysely<DB>;
+//#endregion
 //#region src/permissions/types.d.ts
 /**
  * Principals and policies (ADR 0005). One evaluator serves admin users, app users, tokens and anonymous
@@ -898,15 +1120,21 @@ type PolicyRequest = {
   action: ContentAction;
   modelId: string;
 };
+/**
+ * Where a permission lookup reads its durable version checks (and any reload): the open transaction when
+ * the caller is inside one, so the lookup never waits for a second pooled connection while it holds one
+ * (an exhausted pool would then wait forever). Omitted: the pool.
+ */
+type PermissionExecutor = Database;
 type PermissionEvaluator = {
-  evaluate: (principal: Principal, request: PolicyRequest) => Promise<Policy>;
-  canPerform: (principal: Principal, action: GlobalAction) => Promise<boolean>;
+  evaluate: (principal: Principal, request: PolicyRequest, executor?: PermissionExecutor) => Promise<Policy>;
+  canPerform: (principal: Principal, action: GlobalAction, executor?: PermissionExecutor) => Promise<boolean>;
   /**
    * `canPerform` for the request's site: an action in `SITE_GRANTABLE_ACTIONS` also counts the roles that
    * apply on `siteId` when the principal acts on that site (an admin narrowed to it, a site token of it, a
    * network token). Any other action is `canPerform`.
    */
-  canPerformOnSite: (principal: Principal, action: GlobalAction, siteId: string) => Promise<boolean>;
+  canPerformOnSite: (principal: Principal, action: GlobalAction, siteId: string, executor?: PermissionExecutor) => Promise<boolean>;
 };
 //#endregion
 //#region src/plugins/auditDeclaration.d.ts
@@ -1155,6 +1383,22 @@ type JobHandlerContext = {
 };
 /** Throw to retry with backoff; the return value (JSON) is stored as the job result. */
 type ExtensionJobHandler = (context: JobHandlerContext) => Promise<unknown>;
+/**
+ * A colour theme for the admin: token values for a light variant, a dark variant, or both. Every UI token is
+ * required in a variant; the `brand-*` tokens may be left out (Shapio's are used). Values are `#rrggbb`
+ * (contrast is checked by `shapio extensions check`), `#rgb`, `#rrggbbaa`, or `rgb()`, `hsl()`, `oklch()`,
+ * `oklab()` with plain arguments.
+ */
+type ThemeTokens = Partial<Record<ThemeToken, string>>;
+type ThemeDefinition = {
+  /** Lower-case letters, digits and dashes; not a built-in theme's key. Saved in each browser's setting. */
+  key: string;
+  /** Shown in the theme menu (not translated). */
+  name: string;
+  description?: string;
+  light?: ThemeTokens;
+  dark?: ThemeTokens;
+};
 type ShapioConfig = {
   /** Lifecycle hooks by model API ID (or stable model UUID); `*` runs for every model. */
   hooks?: Record<string, ModelHooks>;
@@ -1165,6 +1409,8 @@ type ShapioConfig = {
   editors?: string[];
   /** Job handlers by name; registered as `ext.<name>`. */
   jobs?: Record<string, ExtensionJobHandler>;
+  /** Admin colour themes, listed after the built-in ones in the theme menu. */
+  themes?: ThemeDefinition[];
 };
 /** Identity helper for completion and type checking in `shapio.config.ts`. */
 declare const defineConfig: (config: ShapioConfig) => ShapioConfig;
@@ -1181,5 +1427,5 @@ declare class HookError extends Error {
 }
 declare const isHookError: (error: unknown) => error is HookError;
 //#endregion
-export { ServiceFactoryContext as A, HookEvent as C, MediaUsage as D, MediaReferenceService as E, PermissionEvaluator as F, Principal as I, DB as L, ShapioServices as M, defineConfig as N, ModelHooks as O, isHookError as P, OutboxEvents as R, HookError as S, JobHandlerContext as T, ExtensionRoute as _, BeforeHookContext as a, ExtensionSite as b, ContentReadOptions as c, EXTENSION_CONTRACT_VERSION as d, EnqueueOptions as f, ExtensionJobService as g, ExtensionJobHandler as h, BeforeHook as i, ShapioConfig as j, ServiceFactory as k, ContentReadService as l, ExtensionHostConfig as m, AfterHookContext as n, BeforeHookEvent as o, EntryData as p, AfterHookEvent as r, ContentReadEntry as s, AfterHook as t, CustomServices as u, ExtensionRouteOptions as v, HookModel as w, HookEntry as x, ExtensionServices as y, ContentData as z };
-//# sourceMappingURL=public-CGO8RBn3.d.ts.map
+export { ServiceFactoryContext as A, Database as B, HookEvent as C, MediaUsage as D, MediaReferenceService as E, defineConfig as F, DataType as G, OutboxEvents as H, isHookError as I, SchemaChange as J, JsonValue$1 as K, PermissionEvaluator as L, ShapioServices as M, ThemeDefinition as N, ModelHooks as O, ThemeTokens as P, PermissionExecutor as R, HookError as S, JobHandlerContext as T, ContentData as U, DB as V, ComponentDefinition as W, ExtensionRoute as _, BeforeHookContext as a, ExtensionSite as b, ContentReadOptions as c, EXTENSION_CONTRACT_VERSION as d, EnqueueOptions as f, ExtensionJobService as g, ExtensionJobHandler as h, BeforeHook as i, ShapioConfig as j, ServiceFactory as k, ContentReadService as l, ExtensionHostConfig as m, AfterHookContext as n, BeforeHookEvent as o, EntryData as p, ModelDefinition as q, AfterHookEvent as r, ContentReadEntry as s, AfterHook as t, CustomServices as u, ExtensionRouteOptions as v, HookModel as w, HookEntry as x, ExtensionServices as y, Principal as z };
+//# sourceMappingURL=public-B7fFHMNr.d.ts.map