@tanqory/dev-mcp 0.0.0-stage → 0.1.0

package/bundled/theme-abi/contracts/render-context.v2.d.ts

@@ -0,0 +1,849 @@
+/**
+ * Tanqory Theme Runtime ABI v2 — RenderContext and entry types.
+ *
+ * Package: @tanqory/theme-abi (planned). This file is normative: a theme
+ * compiles against it; the gateway/loader constructs exactly this object; the
+ * conformance runner (workerd) asserts both sides. The ABI OWNS the capability
+ * identifiers, the limits table and the ctx shape (J arbitration A1);
+ * capability-security-v1.md cites the `Capability` type below.
+ *
+ * Rules that the type system cannot express are repeated as JSDoc and live in
+ * theme-abi-v2.md. Where prose and this file disagree, this file wins for
+ * shapes and the prose wins for behaviour.
+ */
+
+// ───────────────────────────── versioning ─────────────────────────────────
+
+/** ABI major.minor the host speaks. A theme built for "2.x" runs on any host ≥ 2.x within major 2. */
+export type AbiVersion = `2.${number}`
+
+/** Field-type registry version (independent of the ABI; every version within an ABI major stays supported). */
+export type FieldTypeRegistryVersion = `${number}`
+
+// ───────────────────────────── capabilities ───────────────────────────────
+
+/**
+ * Every capability identifier the platform knows. `manifest.capabilities.server`
+ * is what `render()` may use; `manifest.capabilities.browser` is what the
+ * theme's hydrated code may call through `/_tq/data/*` and `/_tq/actions/*`.
+ *
+ * Security semantics (capability-security-v1.md §2) map 1:1:
+ *   data:shop          = data.shop.read        (implicit, always granted)
+ *   data:localization  = data.localization.read (implicit)
+ *   data:catalog       = data.catalog.read
+ *   data:inventory     = ProductVariant.quantityAvailable on data:catalog / data:search / recommendation answers (opt-in;
+ *                        present only when the merchant turned on "Show stock levels"; stripped by the receiver otherwise)
+ *   data:content       = data.content.read
+ *   data:search        = data.search
+ *   data:cart          = data.cart.read
+ *   data:customer      = data.customer.read     (REDACTED profile only — see CustomerSummary)
+ *   data:metaobjects, data:products.recommendations  = sub-scopes of data.content.read / data.catalog.read
+ *   actions:cart       = actions.cart.*
+ *   actions:consent    = actions.consent.*      (implicit)
+ *   actions:customer   = RESERVED. No customer action exists in this ABI (Act-1): login, logout,
+ *                        registration and recovery happen only in the Account BFF. Grants nothing.
+ *   actions:form.submit= actions.form.submit    (never browser-mintable; forms declared in manifest.forms)
+ *   network:<origin>   = the ONLY egress form; proxied, counted as a sub-request
+ *   preview:renderSection = preview-profile entry may export renderSection
+ */
+export type Capability =
+  | 'data:shop' | 'data:localization' | 'data:catalog' | 'data:content' | 'data:search'
+  | 'data:cart' | 'data:customer' | 'data:metaobjects' | 'data:products.recommendations'
+  | 'data:inventory'
+  | 'actions:cart' | 'actions:consent' | 'actions:customer' | 'actions:form.submit'
+  | `network:https://${string}`
+  | 'preview:renderSection'
+
+/**
+ * Ceiling of what may appear in `manifest.capabilities.browser` (security §2.6, A10).
+ * `data:metaobjects` is server-only; `data:products.recommendations` and `data:inventory` are browser-mintable.
+ * `theme check` and the manifest schema reject anything else.
+ */
+export type BrowserCapability =
+  | 'data:shop' | 'data:localization' | 'data:catalog' | 'data:content' | 'data:search'
+  | 'data:cart' | 'data:products.recommendations' | 'data:inventory'
+  | 'actions:cart' | 'actions:consent'
+
+/** Browser subset `tanqory theme init` scaffolds (manifest.capabilities.browser is REQUIRED and explicit — B-6). */
+export type DefaultBrowserCapability =
+  | 'data:shop' | 'data:localization' | 'data:catalog' | 'data:content' | 'data:search'
+  | 'data:cart' | 'actions:cart' | 'actions:consent'
+
+/** Browser-facing platform routes (same origin as the storefront). Wire shapes are part of the ABI. */
+export declare const PLATFORM_ROUTES: {
+  /** `GET /_tq/data/<op>?<args>` with `x-tq-csrf-fetch: 1` — ops are the DataClient method paths, e.g. `catalog.product`, `cart.get`. */
+  readonly data: '/_tq/data/'
+  /** `POST /_tq/actions/<ns>.<name>` with JSON body — e.g. `cart.addLines`, `consent.set`. */
+  readonly actions: '/_tq/actions/'
+  /** Everything under this prefix is platform-owned and never reaches the theme. */
+  readonly reserved: '/_tq/'
+  /** `GET /_tq/data/consent.get` → WireEnvelope<ConsentReadout>; browser-mintable under actions:consent. */
+  readonly consent: '/_tq/data/consent.get'
+  /** `GET /_tq/csrf` with `x-tq-csrf-fetch: 1` → CsrfTokenResponse. Token refresh (ABI §4.1, Client-3). */
+  readonly csrf: '/_tq/csrf'
+}
+
+// ───────────────────────────── route kinds ────────────────────────────────
+
+/**
+ * Platform-defined route kinds. The PLATFORM parses the URL and resolves the
+ * kind + handle + params; the theme never re-derives routing from the path.
+ *
+ * `/_tq/*` (reserved) and `/checkout*`, `/orders*`, `/api/v1/*` (platform-intercepted) never
+ * reach the isolate. `/account` and `/account/*` are NOT intercepted: they resolve to the
+ * `customer` kind, a theme-rendered shell that holds `<iframe data-tq-slot="account">` and
+ * never receives customer PII (ABI §2.1, Act-10). The Account BFF origin is the platform's.
+ */
+export type RouteKind =
+  | 'home'
+  | 'product'
+  | 'collection'
+  | 'collections'
+  | 'page'
+  | 'blog'
+  | 'article'
+  | 'search'
+  | 'cart'
+  | 'customer'
+  | 'policy'
+  | 'not_found'
+  | `custom:${string}`
+
+export interface RouteInfo {
+  kind: RouteKind
+  handle?: string
+  blogHandle?: string
+  /** Template the platform selected for this request (a key of `manifest.templates`). */
+  template: string
+  /**
+   * Decoded params, strings only. Keys the platform sets for built-in kinds (ABI §2.1):
+   *  - `tag`  — the tag in `/blogs/<blog>/tagged/<tag>`; absent without a tag filter.
+   *  - `path` — the part after `/account/` on the `customer` kind (no leading slash); absent for `/account`.
+   *  - `page` (collection, collections, blog, search) and `sort` (collection, search) — the query values as received.
+   *  - `q` — on kind `search`, the search query as received (decoded, untrimmed); absent when the query key is
+   *    absent. Shopper-typed text: treat it as untrusted and escape it on output.
+   * Custom routes add their `:param` captures. Handles are NOT params (`handle`, `blogHandle`).
+   */
+  params: Readonly<Record<string, string>>
+  /**
+   * `https://` + the canonical host + the route's one canonical path. No port, no query, no fragment
+   * (ABI §2.4). Nothing in it comes from the request except which route matched, so it is safe to print
+   * in `<link rel="canonical">`.
+   */
+  canonical: string
+}
+
+// ───────────────────────────── locale / market ────────────────────────────
+
+export interface LocaleInfo {
+  /** BCP-47 language tag the platform resolved (e.g. "th", "en-US"). */
+  language: string
+  /** ISO 3166-1 alpha-2, the same value as `x-tq-country` (`ZZ` when unknown). Reading it marks the render personalised; declare `vary: ['x-tq-country']` to keep it cacheable (ABI §5.1). */
+  country: string
+  market: string
+  /** `locale.currency` is the market's configured currency. It is NOT guaranteed to be the currency of any amount in `ctx.data`: a market the platform cannot price from stored state is answered in the shop's base currency (storefront-query-v1 §2.3.6). A theme MUST format every amount from that amount's own `Money.currencyCode` and MUST NOT format with `locale.currency`. */
+  currency: string
+  availableLanguages: readonly string[]
+  timeZone: string
+  /** Optional (independent assessment 2026-10-07): script direction of `language`. Absent ⇒ theme assumes 'ltr'. Resolves `start`/`end` in text_alignment (registry 2). */
+  direction?: 'ltr' | 'rtl'
+  /**
+   * Optional, alpha.12 (storefront-query rev 2.23 §8.8): the store's active markets, ordered by `id`, for a country /
+   * currency selector. Absent when the gateway does not know them. Per-store, not per-shopper: reading it does not
+   * personalise. A selector switches with `?country=<CC>` (and `?locale=<language>`), ABI §2 "Market and language selection".
+   */
+  markets?: readonly MarketInfo[]
+}
+
+/** One active market of the store (alpha.12). `currency` is the market's configured currency (the same caveat as `LocaleInfo.currency`). */
+export interface MarketInfo {
+  id: string
+  currency: string
+  /** ISO 3166-1 alpha-2 codes the market serves. */
+  countries: readonly string[]
+  /** Languages the market offers; empty ⇒ every language in `availableLanguages`. */
+  languages: readonly string[]
+}
+
+// ───────────────────────────── consent ────────────────────────────────────
+
+/** Read-back of the platform consent cookie (security §2.3 `ctx.consent`). Reading it marks the render personalised. */
+export interface ConsentState {
+  known: boolean
+  analytics: boolean
+  marketing: boolean
+  functional: boolean
+  region?: string
+}
+
+/**
+ * Body of `GET /_tq/data/consent.get` (owner approval 2026-10-07). Browser-mintable under
+ * `actions:consent`; always `Cache-Control: private, no-store`, `Vary: Cookie`.
+ */
+export type ConsentReadout = ConsentState & { bannerRequired: boolean }
+
+// ───────────────────────────── content ────────────────────────────────────
+
+export interface ContentNode {
+  type: string
+  /** Pattern ^[A-Za-z0-9][A-Za-z0-9._-]*$ . REQUIRED. */
+  id: string
+  settings?: Readonly<Record<string, unknown>>
+  blocks?: readonly ContentNode[]
+  /** Editor-only flag honoured by the platform: a disabled node is REMOVED before the doc reaches render(). */
+  disabled?: boolean
+}
+
+export interface RegionDoc {
+  region: string
+  sections: readonly ContentNode[]
+}
+
+/** Fully resolved page document; shared regions already merged by the platform. */
+export interface PageDoc {
+  contentVersion: number
+  template: string
+  regions: readonly RegionDoc[]
+  meta?: Readonly<{ title?: string; description?: string; image?: string; noindex?: boolean }>
+}
+
+export interface ContentContext {
+  /** ContentRevision digest ("sha256:<hex>"). Use in cache hints, never in markup. */
+  revision: string
+  contentVersion: number
+  page: PageDoc
+  settings: Readonly<Record<string, unknown>>
+}
+
+// ───────────────────────────── assets ─────────────────────────────────────
+
+export interface ClientAssetEntry {
+  /** Relative to `client/` (= assets.base), never begins with `client/` or `/`, e.g. "assets/main-1a2b3c4d.js". URL = `${assets.base}/${file}`; artifact path = `client/${file}`. css[]/imports[] use the same base. */
+  file: string
+  kind: 'script' | 'style' | 'font' | 'image' | 'other'
+  /** Hydration root. 0 or 1 script entries per profile (zero-JS themes have none). */
+  isEntry?: boolean
+  css?: readonly string[]
+  imports?: readonly string[]
+  size: number
+  /** "sha256:<hex>" */
+  digest: string
+  /** SRI value "sha256-<base64>" */
+  integrity: string
+}
+
+export interface AssetsContext {
+  /** Absolute origin+prefix, never ends with "/". Immutable per artifact. */
+  base: string
+  manifest: Readonly<Record<string, ClientAssetEntry>>
+}
+
+// ───────────────────────────── data ───────────────────────────────────────
+
+/**
+ * Capability-scoped query client. NO URL, NO token, NO query string. Every
+ * method is a persisted query the platform ships per ABI minor (sets retained
+ * for every minor within the major). Results are cached per
+ * (store, dataVersion, query, args) by the host.
+ *
+ * Counting (limits §8): each method call = 1 data call unless served from the
+ * request-scoped memo (same op+args). A ROUND is the set of calls started before
+ * any of them resolves — `Promise.all([...])` and concurrently-suspended React
+ * trees are one round; a call issued after an earlier call's result is a new
+ * round. Streaming does not reset counters. Exceeding a limit throws
+ * DataLimitError; if the response has already started streaming the host
+ * aborts the body, marks the response not-cacheable and sets `x-tq-degraded: data_limit`.
+ */
+export interface DataClient {
+  /** Opaque to themes. The store's published read-model version (storefront-query-v1 §7): it advances only when a theme-visible answer could differ, at most once per 5 s per store. Use it in cache hints only; never parse it, compare it or put it in markup. */
+  readonly dataVersion: string
+
+  /** ONE call for a page: shop, menus, the route's primary resource, and `resolve: true` setting refs. */
+  snapshot(opts?: SnapshotOptions): Promise<PageSnapshot>
+
+  shop: {
+    get(): Promise<Shop>
+    menus(handles?: readonly string[]): Promise<readonly Menu[]>
+    policies(): Promise<readonly Policy[]>
+    /** Merchant tracking pixels. In ABI 2.x the data plane returns an empty list: merchant pixel code is not delivered to themes (storefront-query-v1 §2.2.4) until the owner decides the merchant-pixel execution model. A theme MUST render correctly with `pixels` empty and MUST NOT assume a non-empty list on any host. */
+    pixels(): Promise<readonly Pixel[]>
+  }
+  localization: {
+    /** Translation bundle for `ctx.locale.language`, merged with the merchant's dashboard overrides. */
+    strings(language?: string): Promise<Readonly<Record<string, string>>>
+  }
+  catalog: {
+    /** `collections: true` ⇒ the answer carries `Product.collections` (ABI 2.x additive, 2026-10-13). */
+    product(handle: string, opts?: { variantsFirst?: number; collections?: boolean }): Promise<Product | null>
+    products(args: ProductsArgs): Promise<Connection<Product>>
+    collection(handle: string, opts?: CollectionProductsArgs): Promise<Collection | null>
+    collections(args?: { first?: number; after?: string }): Promise<Connection<Collection>>
+    /** data:search. `sortKey`/`reverse` order the `products` connection only (ABI 2.x additive, 2026-10-13); absent ⇒ RELEVANCE, the order before they existed. */
+    search(args: { query: string; first?: number; after?: string; types?: readonly ('product' | 'article' | 'page' | 'collection')[]; sortKey?: SearchSortKey; reverse?: boolean }): Promise<SearchResult>
+    /** data:search */
+    predictive(query: string, limit?: number): Promise<PredictiveResult>
+    /** data:products.recommendations */
+    recommendations(productHandle: string, intent?: 'related' | 'complementary', limit?: number): Promise<readonly Product[]>
+  }
+  content: {
+    page(handle: string): Promise<Page | null>
+    blog(handle: string, opts?: { articlesFirst?: number; after?: string; tag?: string }): Promise<Blog | null>
+    article(blogHandle: string, handle: string): Promise<Article | null>
+    policy(handle: string): Promise<Policy | null>
+    template(name: string): Promise<PageDoc | null>
+    /** data:metaobjects */
+    metaobjects(type: string, args?: { first?: number; after?: string }): Promise<Connection<Metaobject>>
+  }
+  /** data:cart — the current shopper's cart (identity from the platform cookie; never visible). Forces `private`. */
+  cart: {
+    get(): Promise<Cart | null>
+  }
+  /**
+   * data:customer — CONSERVATIVE DEFAULT pending owner decision D6 (A2).
+   * Only the redacted profile. Orders, addresses, full email/phone are NOT a
+   * theme capability; the Account BFF renders them inside the account slot iframe on the
+   * theme's `/account*` shell (`customer` kind). Forces `private`.
+   */
+  customer: {
+    current(): Promise<CustomerSummary | null>
+    /** Hosted sign-in / sign-out URLs (Account BFF). Pure getters — allowed during GET render, no capability needed. */
+    loginUrl(returnTo?: string): string
+    logoutUrl(returnTo?: string): string
+    /** Hosted account-area URL for links the theme renders. */
+    /**
+     * Account BFF URL. Use as a link, or as the `src` of
+     * `<iframe data-tq-slot="account" sandbox="allow-scripts allow-forms allow-same-origin">`
+     * (owner approval 2026-10-07). The frame is the only frame-src origin; PII stays inside it (D6).
+     */
+    accountUrl(path?: 'orders' | 'addresses' | 'profile'): string
+    /** Account BFF registration / password-recovery URLs. Pure getters; credentials never pass through theme code. */
+    registerUrl(returnTo?: string): string
+    recoverUrl(returnTo?: string): string
+  }
+}
+
+export interface SnapshotOptions {
+  resolve?: 'all' | 'none' | readonly string[]
+  pageSize?: { products?: number; articles?: number; collections?: number }
+  /** ABI 2.x additive (2026-10-13): the `collection` route's primary resource carries `Collection.filters`. Ignored on every other route and on refs. */
+  facets?: boolean
+  /** ABI 2.x additive (2026-10-13): the `product` route's primary resource carries `Product.collections`. Ignored on every other route and on refs. */
+  productCollections?: boolean
+}
+
+export interface PageSnapshot {
+  /** Never null: `data:shop` is implicit and always in the effective capability set (ABI §3, X-14). */
+  shop: Shop
+  /** Never null, for the same reason. */
+  menus: Readonly<Record<string, Menu>>
+  resource:
+    | { kind: 'product'; product: Product | null }
+    | { kind: 'collection'; collection: Collection | null }
+    | { kind: 'collections'; collections: Connection<Collection> | null }
+    | { kind: 'page'; page: Page | null }
+    | { kind: 'blog'; blog: Blog | null }
+    /** A denied primary resource has EVERY member null: here both `article` and `blog`. */
+    | { kind: 'article'; article: Article | null; blog: Blog | null }
+    | { kind: 'policy'; policy: Policy | null }
+    | { kind: 'search'; result: SearchResult | null }
+    | { kind: 'cart'; cart: Cart | null }
+    | { kind: 'customer'; customer: CustomerSummary | null }
+    | { kind: 'home' | 'not_found' | `custom:${string}`; resource?: undefined }
+  /** key = `${nodeId}.${settingKey}`. Refs whose capability is denied are OMITTED (not null). Ref kinds are exactly the registry's resource field types; `policy` and `metaobject` are not ref kinds. */
+  refs: Readonly<Record<string, Product | Collection | Menu | Page | Blog | Article | null>>
+  /** Never null. In ABI 2.x the data plane returns an empty list: merchant pixel code is not delivered to themes (storefront-query-v1 §2.2.4) until the owner decides the merchant-pixel execution model. A theme MUST render correctly with `pixels` empty and MUST NOT assume a non-empty list on any host. */
+  pixels: readonly Pixel[]
+  /** Parts that are `null` because the home cell could not be reached, as opposed to absent data or a denied capability (storefront-query-v1 §10.3). Absent when nothing was unavailable. */
+  unavailable?: readonly ('cart' | 'customer')[]
+  /**
+   * snapshot() NEVER throws CapabilityError (independent assessment 2026-10-07): a primary
+   * resource whose capability is not granted is returned as `null` (search: `result: null`),
+   * denied refs are omitted, and every capability that caused an omission is listed here.
+   * Individual methods (catalog.search, cart.get, …) still throw CapabilityError.
+   */
+  denied: readonly Capability[]
+}
+
+// ───────────────────────────── actions ────────────────────────────────────
+
+/**
+ * Typed mutations, platform-mediated (security §2.3).
+ *
+ * During a GET render ONLY `cart.create` and `consent.set` are callable
+ * (idempotent, token-bound `via:"ssr"`); any other method throws
+ * ActionNotAllowedInRender. During a VALID native form POST (ABI §1) the server subset is
+ * callable: cart.*, consent.set, form.submit. On a form POST that failed the CSRF or origin
+ * check `ctx.actions` is `undefined` and `ctx.request.formError` is set (Act-2).
+ * From the browser, `POST /_tq/actions/<ns>.<name>` accepts ONLY actions:cart and
+ * actions:consent ops; form.submit and any customer op are `not_browser_mintable` (Act-5).
+ * There is no customer action in this ABI (Act-1).
+ */
+export interface Actions {
+  cart: {
+    create(input?: { lines?: readonly CartLineInput[]; attributes?: Readonly<Record<string, string>>; note?: string }): Promise<Cart>
+    addLines(lines: readonly CartLineInput[], version: number): Promise<CartResult>
+    updateLines(lines: readonly { id: string; quantity?: number; attributes?: Readonly<Record<string, string>> }[], version: number): Promise<CartResult>
+    removeLines(lineIds: readonly string[], version: number): Promise<CartResult>
+    updateNote(note: string, version: number): Promise<CartResult>
+    applyDiscountCode(code: string, version: number): Promise<CartResult>
+    removeDiscountCode(code: string, version: number): Promise<CartResult>
+    /** email + country only. */
+    setBuyerIdentity(input: { email?: string; countryCode?: string }, version: number): Promise<CartResult>
+    /** Platform checkout URL; the theme redirects. Checkout never renders in the theme. */
+    checkoutUrl(): Promise<string>
+  }
+  consent: {
+    set(input: { analytics: boolean; marketing: boolean; functional: boolean; region?: string }): Promise<ConsentState>
+  }
+  /** actions:form.submit — `formId` ∈ manifest.forms; fields allowlisted per form; ≤ 8 KiB (8192 bytes); routed to the merchant inbox via Notify. Server-side (POST) only. */
+  form: {
+    submit(formId: string, fields: Readonly<Record<string, string>>): Promise<{ ok: true } | { ok: false; reason: 'invalid' | 'rate_limited' | 'unknown_form' }>
+  }
+}
+
+// ───────────────────────────── browser wire (/_tq/*) ──────────────────────
+// Independent assessment 2026-10-07 (encoding); CSRF model: owner approval 2026-10-07 (ABI §4.1).
+
+/** CSRF names (ABI §4.1). Enforced by the gateway; the token never appears in ctx. */
+export declare const CSRF: {
+  /** HttpOnly `__Host-` cookie with the per-browser secret; unreadable by theme JS. */
+  readonly cookie: '__Host-tq-csrf'
+  /** Request header carrying the token on fetch() to /_tq/actions/*. */
+  readonly header: 'x-tq-csrf'
+  /** <meta name> the gateway injects (after the cache) holding the token for the client wrapper. */
+  readonly meta: 'tq-csrf'
+  /** Hidden CSRF field the gateway injects (post-cache) into <form data-tq-form>. Theme never renders it. */
+  readonly formField: '_tq_csrf'
+  /** Hidden field naming the form, ALSO injected by the gateway from data-tq-form. Theme never renders it. */
+  readonly formIdField: '_tq_form'
+  /**
+   * Same-origin marker, value `1`, sent on EVERY `/_tq/` GET: each /_tq/data/<op> call and the token
+   * fetch (ABI §4, Client-6). Required on GET /_tq/csrf; on /_tq/data it supplies the same-origin
+   * signal for a browser that sends no `Sec-Fetch-Site`. No signal ⇒ 403 `csrf_failed`. The name is
+   * kept from Client-3 although the header is no longer specific to the token fetch.
+   */
+  readonly fetchHeader: 'x-tq-csrf-fetch'
+}
+
+/**
+ * 200 body of GET /_tq/csrf: exactly this object, NOT a WireEnvelope. `token` is 43 base64url
+ * characters. Every failure of that route uses the failure form of WireEnvelope.
+ */
+export interface CsrfTokenResponse {
+  readonly token: string
+}
+
+/**
+ * Per-render CSP hash headers the THEME asserts (ABI §5, Csp-2). The host never computes a hash for
+ * theme-emitted inline content.
+ *  - x-tq-csp-script-hash: accepted ONLY if the value is in the signed statement's
+ *    `predicate.inlineScriptHashes` (fixed at build time from src/inline/*.js). Dynamic executable
+ *    inline scripts are impossible; per-request data goes in <script type="application/json">.
+ *  - x-tq-csp-style-hash: accepted within fixed host constants (CSP_STYLE_BOUNDS). Exceeding either
+ *    is the ABI error `csp_style_budget` (security §6.4a).
+ * The gateway merges accepted values into the CSP and strips both headers. No 'unsafe-inline' exists.
+ */
+export type CspHashHeader = 'x-tq-csp-script-hash' | 'x-tq-csp-style-hash'
+
+/** Fixed host constants (ABI §5). NOT limits-table rows: changing them does not bump limitsVersion. */
+export declare const CSP_STYLE_BOUNDS: {
+  readonly maxHashesPerRender: 16
+  readonly maxInlineStyleBytesPerRender: 16384
+  readonly errorCode: 'csp_style_budget'
+}
+
+/**
+ * Cap on the `a` parameter of GET /_tq/data/<op> (ABI §4, Client-2). One limit stated twice:
+ * 3072 bytes of canonical JSON encode to exactly 4096 base64url characters. Over it: 400
+ * `invalid_argument`. A fixed host constant, NOT a limits-table row.
+ */
+export declare const BROWSER_DATA_ARGS: {
+  readonly maxBytes: 3072
+  readonly maxEncodedChars: 4096
+}
+
+/**
+ * Longest `<op>` of /_tq/data/<op> and longest `<ns>.<name>` of /_tq/actions/<ns>.<name>, in
+ * characters (ABI §4.2, Client-4). A longer name is `unknown_op`. A fixed constant, NOT a limits row.
+ */
+export declare const WIRE_NAME_MAX_LENGTH: 64
+
+/**
+ * Largest value the reference client reports for a `Retry-After` header, in seconds (ABI §4.2,
+ * Client-5). A larger header value is clamped to this. The gateway's own default is 60.
+ */
+export declare const RETRY_AFTER_MAX_SECONDS: 3600
+
+/**
+ * The shim's host channel (ABI §10, Shim-7). Set by the shim on every isolate response after the
+ * theme's headers; stripped by the gateway before the shared cache and the shopper. The value is
+ * base64url(JCS(record)) with `v: 1`; members are the shim package's `HostRecordV1`.
+ */
+export declare const HOST_RECORD: {
+  readonly header: 'x-tq-host-record'
+  readonly version: 1
+  readonly maxBytes: 16384
+}
+
+/**
+ * Error codes a /_tq/* response may carry — reuse of capability-security §6.4a plus action reasons.
+ *  - `rate_limited` and `budget_exhausted` are both 429 and both carry `Retry-After` (seconds).
+ *  - `csrf_failed` (403) also covers a failed origin check; there is no separate code (ABI §4.1).
+ */
+export type WireErrorCode =
+  | 'capability_denied' | 'preview_channel' | 'not_allowed_in_render' | 'budget_exhausted'
+  | 'limit_subrequests' | 'rate_limited' | 'invalid_argument' | 'unknown_op'
+  | 'cart_version_conflict' | 'csrf_failed' | 'unavailable' | 'not_browser_mintable'
+
+/** Every /_tq/data and /_tq/actions response body. HTTP status mirrors `ok` (2xx / 4xx / 5xx). */
+export type WireEnvelope<T> =
+  | { ok: true; data: T; dataVersion: string }
+  | { ok: false; error: { code: WireErrorCode; message?: string; requestId: string; refusal?: CartRefusal }; data?: T }
+
+/** POST /_tq/actions/<ns>.<name> request body (application/json, ≤ 8 KiB). */
+export interface WireActionBody<A = unknown> { v: 2; args: A }
+
+/**
+ * Optimistic concurrency: a stale `version` returns the current cart, never throws.
+ * `refusal` (alpha.13, Cart-1): on `reason: 'invalid'` only, when the home cell said WHY in a way the platform
+ * recognises. Optional: a theme that ignores it shows its generic message, as before.
+ */
+export type CartResult =
+  | { ok: true; cart: Cart }
+  | { ok: false; reason: 'cart_version_conflict'; cart: Cart }
+  | { ok: false; reason: 'invalid'; refusal?: CartRefusal }
+  | { ok: false; reason: 'rate_limited' | 'unavailable' }
+
+/**
+ * Why the home cell refused a cart write (alpha.13, Cart-1). Carried by `CartResult` (`reason: 'invalid'`) and by
+ * the failure `WireEnvelope` of `cart.create` (`error.code: 'invalid_argument'`). Never a free-text message: the
+ * theme words it in the shopper's language. A theme MUST treat an unknown `code` as no refusal at all (more codes
+ * may be added in a minor).
+ *  - `cart_limit_exceeded`: the write would put more of one product in the cart than the merchant's
+ *    "Maximum quantity per product" allows. `maxQuantity` is that limit (an integer ≥ 1) when the platform knows it.
+ *    Nothing about stock is implied: the limit exists so that a cart does not reveal stock.
+ */
+export interface CartRefusal { code: 'cart_limit_exceeded'; maxQuantity?: number }
+
+// ───────────────────────────── cache / log / misc ─────────────────────────
+
+/**
+ * Request headers the gateway forwards (security B-2, verbatim). The Request
+ * handed to render() is CONSTRUCTED from this allowlist (B3); no other header
+ * is ever present — in particular not cookie, authorization, referer,
+ * cf-connecting-ip, x-forwarded-*.
+ */
+export type AllowedRequestHeader =
+  | 'accept' | 'accept-language' | 'user-agent' | 'host' | 'traceparent'
+  | 'sec-ch-ua' | 'sec-ch-ua-mobile' | 'sec-ch-ua-platform'
+  | 'x-tq-country' | 'x-tq-market' | 'x-tq-locale'
+
+/**
+ * Personalising inputs (ABI §2 "Personalisation marking"). A render is personalised when it reads any
+ * allowlisted request header except `host`, `x-tq-market`, `x-tq-locale` (so `accept` and
+ * `traceparent` personalise too), reads `ctx.locale.country`, `request.hasCart`,
+ * `request.isSignedIn` or `ctx.consent`, receives shopper data from `ctx.data`, or calls any
+ * `ctx.actions` method. Reads are tracked by host getters; destructuring counts as a read.
+ *
+ * `VaryKey` lists what `cache.hint({ vary })` ACCEPTS. Only a CACHEABLE DIMENSION makes the response
+ * storable (ABI §5.1). In 2.x that is `x-tq-country` alone (it also covers `ctx.locale.country`).
+ * Declaring any other key is allowed and yields `private, no-store`. The type is unchanged.
+ */
+export type VaryKey =
+  | 'accept-language' | 'user-agent' | 'sec-ch-ua' | 'sec-ch-ua-mobile' | 'sec-ch-ua-platform' | 'x-tq-country'
+  | 'hasCart' | 'isSignedIn' | 'consent'
+
+/**
+ * The BASE cache key is owned by SiteRelease: `host|path|market|locale|releaseId|dataVersion`.
+ * `x-tq-market` / `x-tq-locale` are therefore base identity, never VaryKeys; `vary` only APPENDS.
+ */
+export interface CacheHint {
+  /** Seconds, clamped [0, 60]: a hint may only tighten the platform default (s-maxage=60). 0 = no-store. */
+  maxAge?: number
+  /** Seconds, clamped [0, 600]: a hint may only tighten the platform default (swr=600). */
+  swr?: number
+  /** Depends on cart/customer/consent. Sticky once set. */
+  private?: boolean
+  /** ≤ 8 tags, ^[a-z0-9:_-]{1,64}$. Platform adds release/store/dataVersion tags itself. */
+  tags?: readonly string[]
+  /** Which personalising inputs this response varies on. Must be ⊆ VaryKey; unknown keys are rejected. Only cacheable dimensions (ABI §5.1) make the response storable. */
+  vary?: readonly VaryKey[]
+}
+
+export interface CacheApi {
+  /** May only TIGHTEN (shorter maxAge/swr, private, more vary keys). A hint that would loosen the platform default is ignored and logged. */
+  hint(h: CacheHint): void
+}
+
+export interface Logger {
+  debug(msg: string, fields?: Readonly<Record<string, unknown>>): void
+  info(msg: string, fields?: Readonly<Record<string, unknown>>): void
+  warn(msg: string, fields?: Readonly<Record<string, unknown>>): void
+  error(msg: string, fields?: Readonly<Record<string, unknown>>): void
+}
+
+export interface RequestInfo {
+  method: 'GET' | 'HEAD' | 'POST'
+  /**
+   * Built by the gateway, never the raw request URL (ABI §2.4): `https://` + the canonical host (the
+   * verified `rel:` host: lowercase, A-labels, no port, no trailing dot) + the resolved path + the query
+   * string exactly as received. No fragment. Identical to the `url` of the Request passed to render().
+   * The query is client-controlled: treat it as untrusted input.
+   */
+  url: string
+  /** Exactly the allowlisted headers that were present; nothing else exists on the Request either. */
+  headers: Readonly<Partial<Record<AllowedRequestHeader, string>>>
+  /** True only when a `__Host-tq-cart` cookie is present and its tag verifies (ABI §2.3, security §2.6) — never its value. A cookie whose tag fails counts as no cart. Reading marks the render personalised. */
+  hasCart: boolean
+  /** Whether a customer session exists — not who. Reading marks the render personalised. */
+  isSignedIn: boolean
+  isPreview: boolean
+  /**
+   * Owner approval 2026-10-07 (clarified for the Nova port). Present ONLY on a CSRF-verified POST
+   * from a `<form data-tq-form="<id>">`. The gateway parsed application/x-www-form-urlencoded
+   * (≤ 8 KiB, checked before the isolate), stripped `_tq_form` and `_tq_csrf`, validated the form id
+   * against manifest.forms, and kept only `manifest.forms[id].fields`. Absent on GET and on any
+   * unverified POST. The raw body is never exposed; the Request passed to render() has a null body.
+   */
+  form?: Readonly<Record<string, string>>
+  /** The validated declared-form id. Present exactly when `form` is present. */
+  formId?: string
+  /**
+   * Set when a native form POST failed the gateway's checks (Act-2): 'csrf' = token or cookie missing or
+   * mismatched; 'origin' = Origin / Sec-Fetch-Site not same-origin. The request renders as a normal page:
+   * `form` and `formId` are absent and `ctx.actions` is undefined. Absent on GET and on valid POSTs.
+   * The response is `private, no-store`.
+   */
+  formError?: 'csrf' | 'origin'
+}
+
+// ───────────────────────────── the context ────────────────────────────────
+
+/**
+ * MULTI-TENANCY (A7): an isolate MAY serve many stores for one artifactDigest.
+ * Theme code MUST NOT retain anything derived from `ctx` or `request` beyond the
+ * render that received it (no module-level caches keyed by store, no memoised
+ * snapshots, no closures stored on globalThis). Conformance suite 9 renders
+ * store A then store B in one isolate and fails on any A-derived byte in B.
+ */
+export interface RenderContext {
+  abi: AbiVersion
+  /**
+   * `serve`   — a shopper on a published host.
+   * `preview` — the editor canvas or a preview channel.
+   * `check`   — DEPRECATED and never set. Conformance renders with `serve` or `preview` so that a theme
+   *             cannot tell it is being certified (ABI §10, security v1.10.8). Kept in the type until its
+   *             removal is approved; do not branch on it.
+   */
+  mode: 'serve' | 'preview' | 'check'
+  request: RequestInfo
+  route: RouteInfo
+  locale: LocaleInfo
+  consent: ConsentState
+  content: ContentContext
+  assets: AssetsContext
+  /** Aborted on wall-clock, data-limit breach after first byte, or client disconnect. */
+  signal: AbortSignal
+  data: DataClient
+  /** `undefined` on a POST the gateway could not CSRF-verify (B6). Always defined on GET (with the SSR-allowed subset). */
+  actions: Actions | undefined
+  cache: CacheApi
+  log: Logger
+  /**
+   * Request time (ms since epoch), frozen for the whole render — a HOST WRAPPER
+   * (A4). The runtime clocks are NOT frozen: `Date.now()` and `performance.now()`
+   * are coarsened to 100 µs (security B-1). "One clock per render" is therefore a
+   * CONFORMANCE guarantee — suite 3 fails a theme whose render calls
+   * Date.now()/performance.now() — not a runtime one.
+   */
+  now(): number
+  release: { id: string; artifactDigest: string }
+  /** server grant = manifest.capabilities.server ∩ store grant (capPlan). */
+  capabilities: ReadonlySet<Capability>
+}
+
+// ───────────────────────────── entry module ───────────────────────────────
+
+export interface ThemeEntry {
+  render(request: Request, ctx: RenderContext): Promise<Response>
+  /** Equal to manifest.json file bytes minus the trailing LF after JCS canonicalisation (S3). */
+  manifest: ThemeManifest
+  /** Preview profile only. */
+  renderSection?(input: { type: string; settings: Readonly<Record<string, unknown>>; blocks?: readonly ContentNode[] }, ctx: RenderContext): Promise<Response>
+  /** Pure, synchronous; run by the platform in the sandbox at release composition, never per request. */
+  migrate?(doc: unknown, from: number, to: number): unknown
+}
+
+export interface ThemeManifest {
+  abi: AbiVersion
+  name: string
+  version: string
+  engines: { 'tanqory-abi': string; 'tanqory-field-types': FieldTypeRegistryVersion }
+  /**
+   * Security B-6: both arrays REQUIRED and explicit; browser ⊆ server and
+   * browser ⊆ BrowserCapability (never data:customer / actions:customer /
+   * actions:form.submit). The builder copies both verbatim into the signed
+   * statement; the runtime uses the statement's copy, never the manifest file.
+   * `tanqory theme init` scaffolds `browser` with DefaultBrowserCapability.
+   */
+  capabilities: {
+    server: readonly Capability[]
+    browser: readonly BrowserCapability[]
+  }
+  /** Forms usable with actions:form.submit. */
+  forms?: Readonly<Record<string, { fields: readonly string[]; title?: string }>>
+  client: {
+    /** none = zero-JS/HTMX themes (no isEntry script; hydration-parity suite skipped). */
+    hydration: 'none' | 'full' | 'partial'
+  }
+  contentVersion: number
+  routes: Readonly<Partial<Record<RouteKind, string>>> & Readonly<Record<`custom:${string}`, string>>
+  customRoutes?: Readonly<Record<string, { path: string }>>
+  templates: Readonly<Record<string, { route: RouteKind; title?: string; regions: readonly string[] }>>
+  regions: Readonly<Record<string, { title: string; scope: 'shared' | 'template'; accepts?: readonly string[]; min?: number; max?: number }>>
+  components: Readonly<Record<string, ComponentDef>>
+  settingsSchema: readonly SettingsGroup[]
+  /** Must chain, gap-free, from `minContentVersion` up to `contentVersion`. */
+  migrations?: readonly { from: number; to: number; note?: string }[]
+  /**
+   * Oldest content version this artifact's `migrate` accepts. Older docs are migrated by the
+   * platform using the PREVIOUS installed artifact's migrate chain first (S5).
+   * When absent, equals `contentVersion`; no migration chain is required.
+   * `minContentVersion > contentVersion` is invalid (`migration_range_invalid`).
+   */
+  minContentVersion?: number
+  [vendor: `x-${string}`]: unknown
+}
+
+export interface ComponentDef {
+  role: 'section' | 'block' | 'layout'
+  title: string
+  description?: string
+  category?: string
+  icon?: string
+  regions?: readonly string[]
+  parents?: readonly string[]
+  children?: readonly string[]
+  requires?: readonly RouteKind[]
+  attributes: Readonly<Record<string, FieldSpec>>
+  presets?: readonly { name?: string; settings?: Readonly<Record<string, unknown>>; blocks?: readonly ContentNode[] }[]
+  limits?: { maxBlocks?: number }
+}
+
+export interface FieldSpec {
+  /** Id in the field-type registry version named by engines["tanqory-field-types"]. Registry 1 adds generic `json` and `list`. */
+  type: string
+  label?: string
+  info?: string
+  default?: unknown
+  placeholder?: string
+  group?: string
+  min?: number
+  max?: number
+  step?: number
+  unit?: string
+  options?: readonly { value: string; label: string }[]
+  visible_if?: string | Readonly<Record<string, unknown>>
+  dynamic?: boolean
+  resolve?: boolean
+  /** `list` only: element field spec. `json` only: optional JSON Schema (draft 2020-12, ≤ 8 KB) the editor validates against. */
+  items?: FieldSpec
+  schema?: Readonly<Record<string, unknown>>
+}
+
+export interface SettingsGroup { group: string; items: readonly ({ key: string } & FieldSpec)[] }
+
+// ───────────────────────────── domain types (stable, trimmed) ────────────
+
+/** Format every amount from its own `currencyCode`, never from `locale.currency` (see LocaleInfo.currency). */
+export interface Money { amount: string; currencyCode: string }
+export interface Image { url: string; altText?: string | null; width?: number; height?: number; focal?: { x: number; y: number } }
+export interface Seo { title?: string | null; description?: string | null }
+export interface Connection<T> { nodes: readonly T[]; pageInfo: { hasNextPage: boolean; endCursor?: string | null }; totalCount?: number }
+
+/**
+ * `socialLinks` and `paymentSettings.acceptedCardBrands` (ABI 2.x additive, 2026-10-13; storefront-query rev 2.20):
+ * present only when the store has them — a theme MUST render without them. `acceptedCardBrands` is card brand NAMES
+ * only (payment marks); nothing else of the store's payment configuration reaches a theme.
+ */
+export interface Shop { name: string; description?: string | null; primaryDomain: { url: string }; brand?: { logo?: Image | null; squareLogo?: Image | null; colors?: Readonly<Record<string, string>> }; paymentSettings: { currencyCode: string; enabledPresentmentCurrencies: readonly string[]; acceptedCardBrands?: readonly CardBrand[] }; shipsToCountries: readonly string[]; socialLinks?: readonly ShopSocialLink[]; seo?: ShopSeo }
+/** alpha.12: the home page's SEO settings (Online store → Preferences: home page title, meta description, social sharing image). Each member only when the merchant set it; absent ⇒ the theme falls back to its own store data. */
+export interface ShopSeo { title?: string; description?: string; image?: Image }
+/** A public social profile link. `platform` is a lower-case network slug (`instagram`, `facebook`, `tiktok`, `x`/`twitter`, …); themes pick an icon by it and MUST fall back for an unknown one. `url` is absolute `https:`. */
+export interface ShopSocialLink { platform: string; url: string }
+export type CardBrand = 'VISA' | 'MASTERCARD' | 'AMERICAN_EXPRESS' | 'JCB' | 'DISCOVER' | 'DINERS_CLUB' | 'UNIONPAY'
+/** `url` is an origin-relative path beginning with `/`, or an absolute `https:` URL for external links. */
+export interface MenuItem { id: string; title: string; url: string; type: string; resourceHandle?: string; items: readonly MenuItem[] }
+export interface Menu { handle: string; title: string; items: readonly MenuItem[] }
+/** `url` is an absolute URL on the shop's primary domain. */
+export interface Policy { handle: string; title: string; body: string; url: string }
+export interface Pixel { id: string; code: string }
+export interface ProductOption { name: string; values: readonly string[] }
+/**
+ * Never cost/supplier. `quantityAvailable` (ABI 2.x additive, 2026-10-13; storefront-query rev 2.21): an integer 0–999
+ * (999 = "999 or more") present ONLY when (1) the release holds `data:inventory`, (2) the merchant turned on
+ * "Show stock levels on your online store", and (3) the variant's inventory is tracked and it does not continue selling
+ * when out of stock. Absent otherwise — never `0` for "unknown": a theme MUST render no stock count when it is absent.
+ * Cart lines (`CartLine.merchandise`) never carry it.
+ */
+export interface ProductVariant { id: string; title: string; sku?: string | null; availableForSale: boolean; price: Money; compareAtPrice?: Money | null; selectedOptions: readonly { name: string; value: string }[]; image?: Image | null; quantityAvailable?: number }
+/** `collections`: only when asked for (`catalog.product(…, { collections: true })`, `SnapshotOptions.productCollections`) — the collections the product is a visible member of, in `catalog.collections` order, at most 10. */
+export interface Product { id: string; handle: string; title: string; descriptionHtml: string; vendor?: string; productType?: string; tags: readonly string[]; availableForSale: boolean; featuredImage?: Image | null; images: readonly Image[]; options: readonly ProductOption[]; variants: Connection<ProductVariant>; priceRange: { minVariantPrice: Money; maxVariantPrice: Money }; compareAtPriceRange?: { minVariantPrice: Money; maxVariantPrice: Money }; seo: Seo; templateSuffix?: string | null; metafields?: Readonly<Record<string, unknown>>; collections?: readonly ProductCollectionRef[] }
+/** A collection a product belongs to (breadcrumbs, "more from"). */
+export interface ProductCollectionRef { handle: string; title: string }
+/** `filters`: only when asked for (`CollectionProductsArgs.facets`, `SnapshotOptions.facets`). */
+export interface Collection { id: string; handle: string; title: string; descriptionHtml: string; image?: Image | null; products: Connection<Product>; seo: Seo; templateSuffix?: string | null; filters?: readonly Filter[] }
+/**
+ * A facet of a collection's products (ABI 2.x additive, 2026-10-13). Counts are over the collection's products visible in
+ * the request's market, IGNORING the request's own `filters` — a value never vanishes while the shopper narrows.
+ * `id`s are stable: `filter.available`, `filter.vendor`, `filter.productType`, `filter.price`; a value's id is
+ * `${filter.id}.${value}`. `label` is an English default; themes translate by `id`.
+ * LIST / BOOLEAN: `values` (a LIST facet holds at most 100, by value). PRICE_RANGE: `values` is empty and `range`
+ * is the lowest and highest product price (`priceRange.minVariantPrice`) in the market; filter with `price.min`/`price.max`.
+ * A facet with no value is omitted.
+ */
+export interface Filter { id: string; label: string; type: 'LIST' | 'BOOLEAN' | 'PRICE_RANGE'; values: readonly FilterValue[]; range?: { min: Money; max: Money } }
+/** `input` is exactly one entry of `CollectionProductsArgs.filters` that selects this value. */
+export interface FilterValue { id: string; label: string; count: number; input: { key: string; value: string } }
+export interface Page { id: string; handle: string; title: string; body: string; seo: Seo; templateSuffix?: string | null }
+export interface Article { id: string; handle: string; title: string; excerpt?: string | null; contentHtml: string; image?: Image | null; publishedAt: string; author?: { name: string } | null; tags: readonly string[]; blog: { handle: string; title: string }; seo: Seo }
+export interface Blog { id: string; handle: string; title: string; articles: Connection<Article>; seo: Seo }
+export interface Metaobject { id: string; handle: string; type: string; fields: Readonly<Record<string, unknown>> }
+export interface SearchResult { query: string; products: Connection<Product>; articles: Connection<Article>; pages: Connection<Page>; collections: Connection<Collection> }
+export interface PredictiveResult { products: readonly Pick<Product, 'handle' | 'title' | 'featuredImage' | 'priceRange'>[]; collections: readonly Pick<Collection, 'handle' | 'title'>[]; queries: readonly string[] }
+export interface CartLineInput { merchandiseId: string; quantity: number; attributes?: Readonly<Record<string, string>> }
+export interface CartLine { id: string; quantity: number; merchandise: ProductVariant & { product: Pick<Product, 'handle' | 'title' | 'featuredImage'> }; cost: { totalAmount: Money; subtotalAmount: Money }; attributes: Readonly<Record<string, string>> }
+/** `id` is visible to theme code and is NOT a credential: knowing a cart id never grants access to the cart (security §2.6). */
+export interface Cart { id: string; version: number; totalQuantity: number; lines: readonly CartLine[]; cost: { subtotalAmount: Money; totalAmount: Money; totalTaxAmount?: Money | null }; discountCodes: readonly { code: string; applicable: boolean }[]; note?: string | null; checkoutUrl: string }
+/** Redacted (security §2.2). CONSERVATIVE DEFAULT until decision D6. */
+export interface CustomerSummary { id: string; firstName?: string | null; lastName?: string | null; emailMasked?: string | null; defaultAddress?: { city?: string | null; country: string } | null; isLoggedIn: true }
+export interface ProductsArgs { first?: number; after?: string; query?: string; sortKey?: 'TITLE' | 'PRICE' | 'CREATED_AT' | 'BEST_SELLING' | 'RELEVANCE'; reverse?: boolean }
+/** Search `products` order (ABI 2.x additive, 2026-10-13). RELEVANCE = §9.6.6; the others as `catalog.products`. */
+export type SearchSortKey = 'RELEVANCE' | 'PRICE' | 'TITLE' | 'CREATED_AT' | 'BEST_SELLING'
+/** `filters` keys: `tag`, `vendor`, `productType`, `available` (`'true'`/`'false'`), `price.min`, `price.max` (decimal amounts). `facets: true` ⇒ the answer carries `Collection.filters`. */
+export interface CollectionProductsArgs { productsFirst?: number; after?: string; sortKey?: 'MANUAL' | 'TITLE' | 'PRICE' | 'CREATED' | 'BEST_SELLING'; reverse?: boolean; filters?: readonly { key: string; value: string }[]; facets?: boolean }
+
+// ───────────────────────────── limits (export shape) ──────────────────────
+// Exported by `@tanqory/theme-abi/limits` (ABI §8). One entry per table row; the key is also the
+// conformance-report measurement `name`.
+
+/** runtime = measured per render by the runner · static = artifact bytes / manifest + content structure (suite 1) · host-policy = enforced by host/edge, never measured. */
+export type LimitClass = 'runtime' | 'static' | 'host-policy'
+
+export interface LimitSpec {
+  readonly class: LimitClass
+  /** Warn / slow-flag threshold; null where §8 shows "—". */
+  readonly budget: number | null
+  /** Kill / reject threshold; null ONLY for budget-only rows (e.g. clientInitialTransferredGzipBytes). */
+  readonly hard: number | null
+  /** Preview-only rows: exempt from signing rule 6 while suite 6 is not_applicable. */
+  readonly profile?: 'preview'
+  /** memoryBytes only: may be not_measured (runtime-enforced; known runner limitation). */
+  readonly rule6Exempt?: true
+}
+
+// ───────────────────────────── errors ─────────────────────────────────────
+
+export declare class CapabilityError extends Error { readonly capability: Capability }
+export declare class DataLimitError extends Error { readonly limit: 'dataCallsPerRender' | 'subRequestsPerRender' | 'sequentialRounds' | 'networkCalls' }
+export declare class ActionNotAllowedInRender extends Error { readonly action: string }