@voltro/cms 0.86.0 → 0.88.0

package/dist/build.d.ts

@@ -0,0 +1,3063 @@
+import { ApiWorkload } from '@voltro/protocol';
+import { DataStore } from '@voltro/database';
+import { Effect } from 'effect';
+import { PluginHttpRoute } from '@voltro/protocol';
+import { PluginHttpRouteByteStream } from '@voltro/protocol';
+import { PluginHttpRouteRequest } from '@voltro/protocol';
+import { PluginHttpRouteResult } from '@voltro/protocol';
+import { PluginHttpRouteStream } from '@voltro/protocol';
+import { PluginHttpRouteStreamRequest } from '@voltro/protocol';
+import { PublicApiDescriptor } from '@voltro/protocol/rest';
+import { RenditionDerivation } from '@voltro/plugin-storage';
+import { RestCache } from '@voltro/protocol/rest';
+import { RestCors } from '@voltro/protocol/rest';
+import { RestGuard } from '@voltro/protocol/rest';
+import { RestMethod } from '@voltro/protocol/rest';
+import { RestRateLimit } from '@voltro/protocol/rest';
+import { RestRouteContext } from '@voltro/protocol/rest';
+import { RestRouteDescriptor } from '@voltro/protocol/rest';
+import { RestRouteExample } from '@voltro/protocol/rest';
+import { RestRouteProjection } from '@voltro/protocol/rest';
+import { Schema } from 'effect';
+import { StorageCustodyShape } from '@voltro/plugin-storage';
+import { TableLike } from '@voltro/database';
+import { YieldableError } from 'effect/Cause';
+
+/** Region receipts must have been produced by real region staging adapters.
+ * This atomically changes the logical head only; no CMS publication/audit row
+ * is modified and no old set or monotone safety row is removed. */
+export declare const activateOutputSet: (tx: DataStore, supplied: OutputActivationSet, options: {
+    readonly probe: OutputActivationProbe;
+    readonly keys: ReadonlyArray<RenderReadKey>;
+    readonly now: number;
+    readonly receipts: ReadonlyArray<OutputRegionReceipt>;
+    readonly regionKeys: Readonly<Record<string, ReadonlyArray<RenderReadKey>>>;
+    readonly admit: OutputActivationAdmission;
+    readonly readRoutes: OutputActivationRouteInventory;
+}) => Promise<OutputActivationMarker>;
+
+/** Validate against the captured policy, not a live purpose or a cookie version. */
+export declare const admitSnapshotPresentation: (purposes: ReadonlyArray<SnapshotConsentPurpose>, supplied: unknown) => SnapshotPresentation;
+
+/** Declares the original-file field of a versioned asset document. It does
+ * not imply ingestion, creative approval, rights or public delivery fitness. */
+declare interface AssetConfig {
+    readonly file: string;
+}
+
+/** Which fields carry a type's availability. Validated by `defineContentType`. */
+declare interface AvailabilityConfig {
+    /** A date or datetime field: usable up to (excluding) this moment. */
+    readonly until?: string;
+    /** A boolean field: `true` withdraws the document at once. */
+    readonly blocked?: string;
+    /** A date or datetime field: usable from this moment on. */
+    readonly from?: string;
+    /** A list-of-text field of territory codes (ISO 3166-1 alpha-2): usable only there. Empty: everywhere. */
+    readonly territories?: string;
+    /** A list-of-text field of channels (`web`, `app`, `print`, …): usable only on these. Empty: on every channel. */
+    readonly channels?: string;
+    /** A list-of-text field of purposes (`editorial`, `advertising`, …): usable only for these. Empty: for every purpose. */
+    readonly purposes?: string;
+}
+
+/** Persist the actual admitted deploy after its artifact/contract check. A
+ * policy change uses the same CAS and lock as deployment, even for same app. */
+export declare const bindOutputDeployment: (tx: DataStore, suppliedScope: OutputActivationScope, input: {
+    readonly expectedRevision: number;
+    readonly app: OutputActivationManifest["app"];
+    readonly renderPolicyDigest: string;
+}) => Promise<OutputDeployment>;
+
+/** One independently resumable publication stream. Tenant must be explicit. */
+declare interface ChangeFeedScope {
+    readonly tenantId: string;
+    readonly site: string;
+    readonly environment: string;
+}
+
+export declare const CMS_OUTPUT_DEPLOY_SCOPE = "cms:deploy";
+
+export declare interface CmsAdmittedPublicDocument extends CmsPublicOutputFile {
+    readonly admission: CmsPublicDocumentAdmission;
+    readonly source?: unknown;
+}
+
+export declare interface CmsApplicationBuildSnapshotsOptions extends Omit<CmsBuildSnapshotsOptions, 'code' | 'app' | 'execution' | 'routeDiscovery'> {
+    /** Trusted server catalog of independently admitted retained applications.
+     * Unknown pins must refuse. Never derive a filesystem root, compiler or
+     * import permission directly from this comparison supplied by a request. */
+    readonly resolveApplication: (pin: CmsBuildSnapshotApplicationPin) => Promise<CmsBuildSnapshotPreparedApplication>;
+}
+
+export declare interface CmsBuildApplicationAdmission {
+    readonly deploymentId: string;
+    readonly archiveId: string;
+    readonly application: CmsBuildSnapshotApplicationPin;
+}
+
+export declare interface CmsBuildApplicationCatalog {
+    readonly admit: (input: CmsBuildApplicationAdmission & {
+        readonly credential: string;
+    }, bytes: AsyncIterable<Uint8Array>) => Effect.Effect<CmsBuildApplicationAdmission, CmsOutputDeploymentUnavailable>;
+    /** Recover the original admission after a lost acknowledgement. This checks
+     * current deployment authority and native custody, without renewing it. */
+    readonly inspect: (input: {
+        readonly credential: string;
+        readonly deploymentId: string;
+    }) => Effect.Effect<CmsBuildApplicationAdmission, CmsOutputDeploymentUnavailable>;
+    /** Internal trusted server lookup, intended for createCmsApplicationBuildSnapshots. */
+    readonly resolveApplication: (pin: CmsBuildSnapshotApplicationPin) => Promise<CmsBuildSnapshotPreparedApplication>;
+    /** Internal metadata lookup for server-owned asset providers. It returns no
+     * filesystem root and grants no read, execution or publication authority. */
+    readonly readApplication: (identity: Pick<CmsBuildSnapshotApplicationPin, 'inputsId' | 'executionId'>) => Promise<Omit<CmsBuildApplicationAdmission, 'deploymentId'>>;
+}
+
+export declare interface CmsBuildApplicationCatalogOptions {
+    readonly store: DataStore;
+    readonly scope: OutputActivationScope;
+    /** Server-owned receiver: verify the complete native application archive,
+     * compare the separately admitted pin, and recheck authorization at bounded
+     * IO boundaries and before making custody reopenable. Never import in host. */
+    readonly receive: (input: CmsBuildApplicationAdmission, bytes: AsyncIterable<Uint8Array>, authorize: () => Promise<void>, signal: AbortSignal) => Promise<CmsBuildSnapshotPreparedApplication>;
+    /** Fixed private archive roots. Every reopen verifies the original bytes;
+     * a catalog row alone never supplies an executable implementation. */
+    readonly open: (input: Omit<CmsBuildApplicationAdmission, 'deploymentId'>) => Promise<CmsBuildSnapshotPreparedApplication>;
+    /** Verify native archive custody without loading application declarations or
+     * executing code. The server fixes the storage root; the caller fixes only
+     * the original archive/pin comparison. */
+    readonly verify: (input: Omit<CmsBuildApplicationAdmission, 'deploymentId'>, authorize: () => Promise<void>, signal: AbortSignal) => Promise<void>;
+    readonly now?: () => number;
+}
+
+export declare const cmsBuildApplicationRest: (service: Pick<CmsBuildApplicationCatalog, "admit" | "inspect">, options: {
+    readonly maxBodyBytes: number;
+}) => {
+    routes: {
+        guards: RestGuard[];
+        maxBodyBytes: number;
+        publicApiDescriptor?: PublicApiDescriptor;
+        method: RestMethod;
+        path: string;
+        input?: Schema.Codec<Record<string, unknown>, any, never, never>;
+        output: Schema.Codec<unknown, any, never, never>;
+        handler: (input: Record<string, unknown>, ctx: RestRouteContext) => unknown;
+        mapFailure?: (error: unknown, request: Pick< PluginHttpRouteRequest, "method" | "path" | "query">) => unknown;
+        summary?: string;
+        description?: string;
+        example?: RestRouteExample;
+        operationId?: string;
+        tags?: ReadonlyArray<string>;
+        projection?: RestRouteProjection;
+        deprecated?: string;
+        sunset?: string;
+        version?: `v${number}`;
+        cors?: RestCors;
+        credentials?: "bearer";
+        rateLimit?: RestRateLimit;
+        streaming?: boolean;
+        etag?: boolean;
+        cache?: RestCache;
+    }[];
+    httpRoutes: (PluginHttpRoute | {
+        handle: (req: PluginHttpRouteRequest) => Promise<{
+            headers: {
+                'www-authenticate'?: string;
+                'cache-control': string;
+                pragma: string;
+                vary: string;
+            };
+            status: number;
+            body?: string | Uint8Array;
+            contentType?: string;
+            stream?: PluginHttpRouteStream;
+            cause?: unknown;
+            byteStream?: PluginHttpRouteByteStream;
+        }>;
+        workload?: ApiWorkload;
+        restContract?: RestRouteDescriptor<any, any>;
+        method: "*" | "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
+        answersOtherMethods?: boolean | undefined;
+        path: string;
+        match?: "prefix" | "exact";
+        handleStream?: (req: PluginHttpRouteStreamRequest) => Promise<PluginHttpRouteResult>;
+        maxBodyBytes?: number;
+        originGuard?: "exempt";
+        cors?: RestCors;
+        credentials?: "bearer";
+    })[];
+};
+
+export declare class CmsBuildApplicationUploadUnavailable extends CmsBuildApplicationUploadUnavailable_base {
+}
+
+declare const CmsBuildApplicationUploadUnavailable_base: Schema.Class<CmsBuildApplicationUploadUnavailable, Schema.TaggedStruct<"CmsBuildApplicationUploadUnavailable", {
+    readonly reason: Schema.Literals<readonly ["input", "authority", "transfer", "response", "aborted"]>;
+}>, YieldableError>;
+
+/** An expected retained application is a comparison, never a provider selection. */
+export declare interface CmsBuildSnapshotApplicationPin {
+    readonly code: SnapshotAppCodePin;
+    readonly inputsId: string;
+    readonly executionId: string;
+}
+
+export declare interface CmsBuildSnapshotApplicationSource {
+    readonly format: 'voltro.app.build-inputs/v1';
+    readonly entries: () => Iterable<{
+        readonly key: string;
+        readonly value: Readonly<Record<string, unknown>>;
+    }> | AsyncIterable<{
+        readonly key: string;
+        readonly value: Readonly<Record<string, unknown>>;
+    }>;
+}
+
+export declare interface CmsBuildSnapshotCaptureRequest {
+    readonly apiKey: string;
+    readonly attemptId: string;
+    readonly releaseId: string;
+    /** Refuse a different server-prepared application before creating an attempt. */
+    readonly expectedApplication?: CmsBuildSnapshotApplicationPin;
+}
+
+export declare interface CmsBuildSnapshotGrant {
+    readonly id: string;
+    readonly token: string;
+    readonly expiresAt: number;
+    readonly consumerId: string;
+    readonly buildId: string;
+    readonly snapshotId: string;
+    readonly snapshotDigest: string;
+    /** Bounded catalog from the same independently verified retained app.
+     * This describes public presentation classes, never a person's consent. */
+    readonly consentPurposes: ReadonlyArray<SnapshotConsentPurpose>;
+}
+
+export declare interface CmsBuildSnapshotOpenRequest {
+    readonly apiKey: string;
+    readonly snapshot: CmsBuildSnapshotPin;
+    /** Original grant proof plus freshly authenticated same-parent credential. */
+    readonly resume?: {
+        readonly token: string;
+        readonly buildId: string;
+    };
+}
+
+export declare interface CmsBuildSnapshotPin {
+    readonly id: string;
+    readonly digest: string;
+}
+
+export declare interface CmsBuildSnapshotPreparedApplication extends CmsBuildSnapshotApplicationPin {
+    readonly app: CmsBuildSnapshotApplicationSource;
+    readonly execution: SnapshotAppExecution;
+    readonly routeDiscovery: unknown;
+}
+
+export declare interface CmsBuildSnapshotReadRequest {
+    readonly snapshot: CmsBuildSnapshotPin;
+    readonly token: string;
+    readonly consumerId: string;
+    readonly buildId: string;
+    readonly host: string;
+    readonly path: string;
+    readonly presentation?: SnapshotPresentation;
+}
+
+export declare interface CmsBuildSnapshotRedirectOutput {
+    readonly artifactId: string;
+    readonly count: number;
+}
+
+export declare type CmsBuildSnapshotRedirectRequest = CmsBuildSnapshotSafetyRequest & {
+    readonly safety: {
+        readonly artifactId: string;
+    };
+    readonly targets: ReadonlyArray<SnapshotRedirectTargetDocuments>;
+};
+
+export declare interface CmsBuildSnapshotRendered {
+    readonly html: string;
+    readonly head: string;
+    /** Complete private document for a retained production web build, otherwise null. */
+    readonly document: string | null;
+    /** Private artifact identity, never permission to activate or serve it. */
+    readonly artifactId: string | null;
+}
+
+/** Mount httpRoutes through the existing raw plugin HTTP seam. Pass routes to
+ * openapiPlugin for the exact same schemas. Do not also register routes in the
+ * app's generic restRoutes collection: its authentication and idempotency cache
+ * are separate from this scoped credential exchange and can cache grant tokens.
+ * The service verifies every credential; no Subject supplied by HTTP grants it
+ * authority. There is no ambient live-content or general database capability. */
+export declare const cmsBuildSnapshotRest: (service: CmsBuildSnapshots) => {
+    routes: {
+        guards: RestGuard[];
+        maxBodyBytes: number;
+        publicApiDescriptor?: PublicApiDescriptor;
+        method: RestMethod;
+        path: string;
+        input?: Schema.Codec<Record<string, unknown>, any, never, never>;
+        output: Schema.Codec<unknown, any, never, never>;
+        handler: (input: Record<string, unknown>, ctx: RestRouteContext) => unknown;
+        mapFailure?: (error: unknown, request: Pick< PluginHttpRouteRequest, "method" | "path" | "query">) => unknown;
+        summary?: string;
+        description?: string;
+        example?: RestRouteExample;
+        operationId?: string;
+        tags?: ReadonlyArray<string>;
+        projection?: RestRouteProjection;
+        deprecated?: string;
+        sunset?: string;
+        version?: `v${number}`;
+        cors?: RestCors;
+        credentials?: "bearer";
+        rateLimit?: RestRateLimit;
+        streaming?: boolean;
+        etag?: boolean;
+        cache?: RestCache;
+    }[];
+    httpRoutes: {
+        handle: (req: PluginHttpRouteRequest) => Promise<{
+            headers: {
+                'www-authenticate'?: string;
+                'cache-control': string;
+                pragma: string;
+                vary: string;
+            };
+            status: number;
+            body?: string | Uint8Array;
+            contentType?: string;
+            stream?: PluginHttpRouteStream;
+            cause?: unknown;
+            byteStream?: PluginHttpRouteByteStream;
+        }>;
+        workload?: ApiWorkload;
+        restContract?: RestRouteDescriptor<any, any>;
+        method: "*" | "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
+        answersOtherMethods?: boolean | undefined;
+        path: string;
+        match?: "prefix" | "exact";
+        handleStream?: (req: PluginHttpRouteStreamRequest) => Promise< PluginHttpRouteResult>;
+        maxBodyBytes?: number;
+        originGuard?: "exempt";
+        cors?: RestCors;
+        credentials?: "bearer";
+    }[];
+};
+
+export declare interface CmsBuildSnapshots {
+    readonly capture: (request: CmsBuildSnapshotCaptureRequest) => Effect.Effect<CmsBuildSnapshotPin & {
+        readonly expiresAt: number;
+    }, CmsBuildSnapshotUnavailable>;
+    readonly open: (request: CmsBuildSnapshotOpenRequest) => Effect.Effect<CmsBuildSnapshotGrant, CmsBuildSnapshotUnavailable>;
+    readonly read: (request: CmsBuildSnapshotReadRequest) => Effect.Effect<SnapshotRouteRead | null, CmsBuildSnapshotUnavailable>;
+    readonly readBinding: (request: CmsBuildSnapshotReadRequest & {
+        readonly binding: string;
+    }) => Effect.Effect<SnapshotBindingRead | null, CmsBuildSnapshotUnavailable>;
+    readonly readTree: (request: CmsBuildSnapshotReadRequest & {
+        readonly name: string;
+    }) => Effect.Effect<SnapshotTreeData, CmsBuildSnapshotUnavailable>;
+    readonly render: (request: CmsBuildSnapshotReadRequest) => Effect.Effect<CmsBuildSnapshotRendered | null, CmsBuildSnapshotUnavailable>;
+    readonly renderSafety: (request: CmsBuildSnapshotSafetyRequest) => Effect.Effect<CmsBuildSnapshotSafetyOutput, CmsBuildSnapshotUnavailable>;
+    readonly renderRedirects: (request: CmsBuildSnapshotRedirectRequest) => Effect.Effect<CmsBuildSnapshotRedirectOutput, CmsBuildSnapshotUnavailable>;
+    readonly renderSeo: (request: CmsBuildSnapshotSeoRequest) => Effect.Effect<CmsBuildSnapshotSeoOutput, CmsBuildSnapshotUnavailable>;
+}
+
+export declare interface CmsBuildSnapshotSafetyOutput {
+    readonly artifactId: string;
+    readonly generation: number;
+    readonly entryCount: number;
+}
+
+export declare type CmsBuildSnapshotSafetyRequest = Omit<CmsBuildSnapshotReadRequest, 'path' | 'presentation'> & {
+    readonly documents: SnapshotSeoDocumentsSelection;
+};
+
+export declare interface CmsBuildSnapshotSeoOutput {
+    readonly sitemapArtifactId: string;
+    readonly robotsArtifactId: string;
+    readonly urlCount: number;
+}
+
+export declare type CmsBuildSnapshotSeoRequest = Omit<CmsBuildSnapshotReadRequest, 'path' | 'presentation'> & {
+    readonly documents?: SnapshotSeoDocumentsSelection;
+    readonly safety?: {
+        readonly artifactId: string;
+    };
+};
+
+export declare interface CmsBuildSnapshotsOptions {
+    readonly store: DataStore;
+    readonly scope: ChangeFeedScope;
+    /** Immutable server configuration, matching the retained application's definitions. */
+    readonly application: SnapshotCaptureApplicationDefinition;
+    readonly code: SnapshotAppCodePin;
+    /** Prepared before SQL capture: iteration must not execute application code. */
+    readonly app: CmsBuildSnapshotApplicationSource;
+    readonly routeDiscovery: unknown;
+    readonly execution: SnapshotAppExecution;
+    readonly custody: StorageCustodyShape;
+    readonly alias: string;
+    readonly requiredScope: string;
+    readonly snapshotTtlMs: number;
+    readonly maxMediaBytes: number;
+    readonly key: RenderReadKey;
+    readonly verificationKeys?: ReadonlyArray<RenderReadKey>;
+    readonly output?: {
+        readonly provider: SnapshotOutputProvider;
+        readonly use: SnapshotMediaUse;
+        readonly maxBytes: number;
+    };
+    readonly now?: () => number;
+}
+
+/** Add these server-only records to the API schema alongside the CMS content,
+ * publication/site/asset tables and the configured storage plugin's tables.
+ * They contain private state and are never a public delivery projection. */
+export declare const cmsBuildSnapshotTables: ReadonlyArray<TableLike>;
+
+/** Closed boundary error: never serializes a database/provider error or input. */
+export declare class CmsBuildSnapshotUnavailable extends CmsBuildSnapshotUnavailable_base {
+}
+
+declare const CmsBuildSnapshotUnavailable_base: Schema.Class<CmsBuildSnapshotUnavailable, Schema.TaggedStruct<"CmsBuildSnapshotUnavailable", {
+    readonly reason: Schema.Literals<readonly ["configuration", "credential", "capture", "grant", "read", "render"]>;
+}>, YieldableError>;
+
+/** Dedicated render-read bearer exchange. Mount only httpRoutes in the raw
+ * plugin HTTP seam and use routes for OpenAPI/client generation. The existing
+ * private/no-store transport never caches authority or borrows a Subject. */
+export declare const cmsDocumentAssemblyRest: (service: ReturnType<typeof createSnapshotDocumentAssembly>) => {
+    routes: {
+        guards: RestGuard[];
+        maxBodyBytes: number;
+        publicApiDescriptor?: PublicApiDescriptor;
+        method: RestMethod;
+        path: string;
+        input?: Schema.Codec<Record<string, unknown>, any, never, never>;
+        output: Schema.Codec<unknown, any, never, never>;
+        handler: (input: Record<string, unknown>, ctx: RestRouteContext) => unknown;
+        mapFailure?: (error: unknown, request: Pick< PluginHttpRouteRequest, "method" | "path" | "query">) => unknown;
+        summary?: string;
+        description?: string;
+        example?: RestRouteExample;
+        operationId?: string;
+        tags?: ReadonlyArray<string>;
+        projection?: RestRouteProjection;
+        deprecated?: string;
+        sunset?: string;
+        version?: `v${number}`;
+        cors?: RestCors;
+        credentials?: "bearer";
+        rateLimit?: RestRateLimit;
+        streaming?: boolean;
+        etag?: boolean;
+        cache?: RestCache;
+    }[];
+    httpRoutes: {
+        handle: (req: PluginHttpRouteRequest) => Promise<{
+            headers: {
+                'www-authenticate'?: string;
+                'cache-control': string;
+                pragma: string;
+                vary: string;
+            };
+            status: number;
+            body?: string | Uint8Array;
+            contentType?: string;
+            stream?: PluginHttpRouteStream;
+            cause?: unknown;
+            byteStream?: PluginHttpRouteByteStream;
+        }>;
+        workload?: ApiWorkload;
+        restContract?: RestRouteDescriptor<any, any>;
+        method: "*" | "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
+        answersOtherMethods?: boolean | undefined;
+        path: string;
+        match?: "prefix" | "exact";
+        handleStream?: (req: PluginHttpRouteStreamRequest) => Promise< PluginHttpRouteResult>;
+        maxBodyBytes?: number;
+        originGuard?: "exempt";
+        cors?: RestCors;
+        credentials?: "bearer";
+    }[];
+};
+
+export declare interface CmsNativeOutputDeployments extends CmsOutputDeployments {
+    readonly prepare: (input: CmsOutputTargetPreparation) => Effect.Effect<RetainedOutputActivationTarget, CmsOutputDeploymentUnavailable>;
+}
+
+export declare interface CmsNativeOutputDeploymentsOptions {
+    readonly store: DataStore;
+    readonly scope: OutputActivationScope;
+    readonly key: RenderReadKey;
+    readonly verificationKeys?: ReadonlyArray<RenderReadKey>;
+    readonly pathKeys: ReadonlyArray<RenderReadKey>;
+    readonly quorum: number;
+    readonly regions: Readonly<Record<string, {
+        readonly key: RenderReadKey;
+        readonly verificationKeys?: ReadonlyArray<RenderReadKey>;
+        /** Fixed server roots: stage all six original roles, then reopen/rehash. */
+        readonly stage: (set: OutputActivationSet) => Promise<{
+            readonly outputId: string;
+        }>;
+        readonly verify: (set: OutputActivationSet, outputId: string) => Promise<void>;
+        readonly readArtifacts: (set: OutputActivationSet, outputId: string) => Promise<Omit<OutputRouteGraphArtifacts, 'pathSets'>>;
+        readonly readRoutes: (set: OutputActivationSet, outputId: string) => ReturnType<OutputActivationRouteInventory>;
+    }>>;
+    readonly use: (target: {
+        readonly host: string;
+        readonly path: string;
+    }) => SnapshotMediaUse;
+    readonly now?: () => number;
+}
+
+/** Private server records. Declare alongside the core, publication/site and
+ * snapshot tables. They must never become public delivery projections. */
+export declare const cmsOutputActivationTables: ReadonlyArray<TableLike>;
+
+export declare interface CmsOutputDeploymentCredential {
+    readonly credential: string;
+}
+
+export declare interface CmsOutputDeploymentRequest extends CmsOutputDeploymentCredential {
+    readonly targetId: string;
+    readonly expectedRevision: number;
+    readonly expectedGeneration: number;
+    readonly mode: 'forward' | 'rollback';
+    readonly outputs: ReadonlyArray<{
+        readonly region: string;
+        readonly outputId: string;
+    }>;
+}
+
+/** Mount only through the private raw HTTP seam. Every call independently
+ * verifies an organization API key with cms:deploy and exact server-owned scope.
+ * No ambient Subject, build credential, request-selected provider or signer. */
+export declare const cmsOutputDeploymentRest: (service: CmsOutputDeployments) => {
+    routes: {
+        maxBodyBytes: number;
+        guards: RestGuard[];
+        publicApiDescriptor?: PublicApiDescriptor;
+        method: RestMethod;
+        path: string;
+        input?: Schema.Codec<Record<string, unknown>, any, never, never>;
+        output: Schema.Codec<unknown, any, never, never>;
+        handler: (input: Record<string, unknown>, ctx: RestRouteContext) => unknown;
+        mapFailure?: (error: unknown, request: Pick< PluginHttpRouteRequest, "method" | "path" | "query">) => unknown;
+        summary?: string;
+        description?: string;
+        example?: RestRouteExample;
+        operationId?: string;
+        tags?: ReadonlyArray<string>;
+        projection?: RestRouteProjection;
+        deprecated?: string;
+        sunset?: string;
+        version?: `v${number}`;
+        cors?: RestCors;
+        credentials?: "bearer";
+        rateLimit?: RestRateLimit;
+        streaming?: boolean;
+        etag?: boolean;
+        cache?: RestCache;
+    }[];
+    httpRoutes: {
+        handle: (req: PluginHttpRouteRequest) => Promise<{
+            headers: {
+                'www-authenticate'?: string;
+                'cache-control': string;
+                pragma: string;
+                vary: string;
+            };
+            status: number;
+            body?: string | Uint8Array;
+            contentType?: string;
+            stream?: PluginHttpRouteStream;
+            cause?: unknown;
+            byteStream?: PluginHttpRouteByteStream;
+        }>;
+        workload?: ApiWorkload;
+        restContract?: RestRouteDescriptor<any, any>;
+        method: "*" | "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
+        answersOtherMethods?: boolean | undefined;
+        path: string;
+        match?: "prefix" | "exact";
+        handleStream?: (req: PluginHttpRouteStreamRequest) => Promise< PluginHttpRouteResult>;
+        maxBodyBytes?: number;
+        originGuard?: "exempt";
+        cors?: RestCors;
+        credentials?: "bearer";
+    }[];
+};
+
+export declare interface CmsOutputDeploymentResult {
+    readonly deployment: OutputDeployment;
+    readonly activation: OutputActivationMarker;
+}
+
+export declare interface CmsOutputDeployments {
+    readonly inspect: (input: CmsOutputDeploymentCredential) => Effect.Effect<{
+        readonly revision: number;
+        readonly generation: number;
+    }, CmsOutputDeploymentUnavailable>;
+    readonly deploy: (input: CmsOutputDeploymentRequest) => Effect.Effect<CmsOutputDeploymentResult, CmsOutputDeploymentUnavailable>;
+    /** Confirm this exact current result without staging, binding or activating. */
+    readonly confirm: (input: CmsOutputDeploymentRequest) => Effect.Effect<CmsOutputDeploymentResult, CmsOutputDeploymentUnavailable>;
+    readonly bind: (input: CmsOutputDeploymentCredential & {
+        readonly deploymentId: string;
+        readonly expectedRevision: number;
+    }) => Effect.Effect<OutputDeployment, CmsOutputDeploymentUnavailable>;
+    readonly probe: (input: CmsOutputDeploymentCredential & {
+        readonly targetId: string;
+        readonly expectedGeneration: number;
+        readonly mode: 'forward' | 'rollback';
+    }) => Effect.Effect<OutputActivationProbe, CmsOutputDeploymentUnavailable>;
+    readonly observeRegion: (input: CmsOutputDeploymentCredential & {
+        readonly targetId: string;
+        readonly probe: OutputActivationProbe;
+        readonly region: string;
+        readonly outputId: string;
+    }) => Effect.Effect<OutputRegionReceipt, CmsOutputDeploymentUnavailable>;
+    readonly activate: (input: CmsOutputDeploymentCredential & {
+        readonly targetId: string;
+        readonly probe: OutputActivationProbe;
+        readonly receipts: ReadonlyArray<OutputRegionReceipt>;
+    }) => Effect.Effect<OutputActivationMarker, CmsOutputDeploymentUnavailable>;
+}
+
+export declare interface CmsOutputDeploymentsOptions {
+    readonly store: DataStore;
+    readonly scope: OutputActivationScope;
+    readonly key: RenderReadKey;
+    readonly verificationKeys?: ReadonlyArray<RenderReadKey>;
+    /** Server-owned original deployment admission, not request-supplied contracts. */
+    readonly readDeployment: (tx: DataStore, deploymentId: string) => Promise<{
+        readonly app: OutputActivationManifest['app'];
+        readonly renderPolicyDigest: string;
+    }>;
+    /** Server-owned target custody; HTTP supplies only its content identity. */
+    readonly readSet: (tx: DataStore, targetId: string) => Promise<OutputActivationSet>;
+    readonly admit: OutputActivationAdmission;
+    readonly readRoutes: OutputActivationRouteInventory;
+    readonly regions: Readonly<Record<string, {
+        readonly key: RenderReadKey;
+        readonly verificationKeys?: ReadonlyArray<RenderReadKey>;
+        /** Rehash every role/file in this exact physical output and target. */
+        readonly verify: (tx: DataStore, set: OutputActivationSet, outputId: string) => Promise<void>;
+    }>>;
+    readonly now?: () => number;
+}
+
+export declare class CmsOutputDeploymentUnavailable extends CmsOutputDeploymentUnavailable_base {
+}
+
+declare const CmsOutputDeploymentUnavailable_base: Schema.Class<CmsOutputDeploymentUnavailable, Schema.TaggedStruct<"CmsOutputDeploymentUnavailable", {
+    readonly reason: Schema.Literals<readonly ["configuration", "credential", "input", "integrity", "state", "changed", "generation", "regions", "denied", "expired", "unadmitted"]>;
+}>, YieldableError>;
+
+export declare interface CmsOutputTargetPreparation extends CmsOutputDeploymentCredential {
+    readonly deploymentId: string;
+    readonly snapshot: {
+        readonly id: string;
+        readonly digest: string;
+    };
+    readonly pathSets: ReadonlyArray<{
+        readonly host: string;
+        readonly jobId: string;
+        readonly digest: string;
+    }>;
+    readonly artifacts: OutputActivationManifest['artifacts'];
+}
+
+export declare const cmsOutputTargetRest: (service: Pick<CmsNativeOutputDeployments, "prepare">) => {
+    routes: {
+        maxBodyBytes: number;
+        guards: RestGuard[];
+        publicApiDescriptor?: PublicApiDescriptor;
+        method: RestMethod;
+        path: string;
+        input?: Schema.Codec<Record<string, unknown>, any, never, never>;
+        output: Schema.Codec<unknown, any, never, never>;
+        handler: (input: Record<string, unknown>, ctx: RestRouteContext) => unknown;
+        mapFailure?: (error: unknown, request: Pick< PluginHttpRouteRequest, "method" | "path" | "query">) => unknown;
+        summary?: string;
+        description?: string;
+        example?: RestRouteExample;
+        operationId?: string;
+        tags?: ReadonlyArray<string>;
+        projection?: RestRouteProjection;
+        deprecated?: string;
+        sunset?: string;
+        version?: `v${number}`;
+        cors?: RestCors;
+        credentials?: "bearer";
+        rateLimit?: RestRateLimit;
+        streaming?: boolean;
+        etag?: boolean;
+        cache?: RestCache;
+    }[];
+    httpRoutes: {
+        handle: (req: PluginHttpRouteRequest) => Promise<{
+            headers: {
+                'www-authenticate'?: string;
+                'cache-control': string;
+                pragma: string;
+                vary: string;
+            };
+            status: number;
+            body?: string | Uint8Array;
+            contentType?: string;
+            stream?: PluginHttpRouteStream;
+            cause?: unknown;
+            byteStream?: PluginHttpRouteByteStream;
+        }>;
+        workload?: ApiWorkload;
+        restContract?: RestRouteDescriptor<any, any>;
+        method: "*" | "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
+        answersOtherMethods?: boolean | undefined;
+        path: string;
+        match?: "prefix" | "exact";
+        handleStream?: (req: PluginHttpRouteStreamRequest) => Promise< PluginHttpRouteResult>;
+        maxBodyBytes?: number;
+        originGuard?: "exempt";
+        cors?: RestCors;
+        credentials?: "bearer";
+    }[];
+};
+
+export declare interface CmsPublicBuildIdentity {
+    readonly version: 1;
+    readonly snapshotDigest: string;
+    readonly inputsId: string;
+    readonly executionId: string;
+}
+
+export declare interface CmsPublicBuildPage<T = unknown> {
+    readonly version: 1;
+    readonly build: CmsPublicBuildIdentity;
+    readonly path: string;
+    readonly page: T;
+}
+
+/** Resolve the host through the application's trusted proxy/domain policy.
+ * Request query parameters cannot choose tenant/site/environment or origin. */
+export declare const cmsPublicBuildRest: (service: CmsPublicBuilds, options: {
+    readonly host: (headers: Readonly<Record<string, string>>) => string;
+    readonly choices?: (headers: Readonly<Record<string, string>>) => ConsentChoices | undefined;
+}) => {
+    routes: RestRouteDescriptor<Record<string, unknown>, unknown>[];
+    httpRoutes: {
+        handle: (req: PluginHttpRouteRequest) => Promise<{
+            headers: {
+                'cache-control': string;
+                pragma: string;
+                vary: string;
+            };
+            status: number;
+            body?: string | Uint8Array;
+            contentType?: string;
+            stream?: PluginHttpRouteStream;
+            cause?: unknown;
+            byteStream?: PluginHttpRouteByteStream;
+        }>;
+        workload?: ApiWorkload;
+        restContract?: RestRouteDescriptor<any, any>;
+        method: "*" | "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
+        answersOtherMethods?: boolean | undefined;
+        path: string;
+        match?: "prefix" | "exact";
+        handleStream?: (req: PluginHttpRouteStreamRequest) => Promise< PluginHttpRouteResult>;
+        maxBodyBytes?: number;
+        originGuard?: "exempt";
+        cors?: RestCors;
+        credentials?: "bearer";
+    }[];
+};
+
+export declare interface CmsPublicBuilds {
+    readonly page: (input: {
+        readonly build: CmsPublicBuildIdentity;
+        readonly host: string;
+        readonly path: string;
+        readonly choices?: ConsentChoices;
+    }) => Effect.Effect<CmsPublicBuildPage, CmsPublicBuildUnavailable>;
+}
+
+export declare interface CmsPublicBuildsOptions {
+    readonly store: DataStore;
+    readonly scope: OutputActivationScope;
+    readonly keys: ReadonlyArray<RenderReadKey>;
+    readonly regionKeys: Readonly<Record<string, ReadonlyArray<RenderReadKey>>>;
+    readonly region: string;
+    readonly admit: OutputServingAdmission;
+    /** Trusted artifact adapter: select only the serialized public presentation
+     * produced with this exact document/route. Rehash physical custody and reject
+     * unknown targets. Never implement this with a live delivery query. */
+    /** Verify the captured policy and complete class inventory in this exact region. */
+    readonly readPresentations: (tx: DataStore, set: OutputActivationSet, receipt: OutputRegionReceipt) => Promise<CmsPublicPresentations>;
+    readonly readPage: (tx: DataStore, set: OutputActivationSet, receipt: OutputRegionReceipt, target: CmsPublicPresentationTarget) => Promise<{
+        readonly found: false;
+    } | {
+        readonly found: true;
+        readonly page: unknown;
+    }>;
+}
+
+declare class CmsPublicBuildUnavailable extends Error {
+    readonly reason: 'identity' | 'request' | 'changed' | 'not-found' | 'denied' | 'transport';
+    readonly _tag = "CmsPublicBuildUnavailable";
+    constructor(reason: 'identity' | 'request' | 'changed' | 'not-found' | 'denied' | 'transport');
+}
+
+/** Current server admission for a private render using an already-public
+ * document. Compare the whole pin before and after rendering; no HTTP route
+ * publishes it and it grants no mutation or private CMS read authority. */
+export declare interface CmsPublicDocumentAdmission {
+    readonly setId: string;
+    readonly generation: number;
+    readonly safetyGeneration: number;
+    readonly region: string;
+    readonly outputId: string;
+    readonly snapshotDigest: string;
+    readonly app: OutputActivationSet['manifest']['app'];
+    readonly target: CmsPublicPresentationTarget;
+}
+
+export declare interface CmsPublicOutputAsset extends CmsPublicOutputFile {
+    readonly uses: ReadonlyArray<{
+        readonly documentUrl: string;
+        readonly rights: unknown;
+        readonly presentation: SnapshotPresentation;
+    }>;
+}
+
+export declare interface CmsPublicOutputControl extends CmsPublicOutputFile {
+    /** Verified generation of the same receipted region's complete deny role. */
+    readonly safetyGeneration: number;
+    readonly uses: ReadonlyArray<{
+        readonly documentUrl: string;
+        readonly media: CmsPublicOutputDocument['media'];
+    }>;
+}
+
+export declare interface CmsPublicOutputDocument extends CmsPublicOutputFile {
+    /** Invoke only for the page-only transport, after current document admission. */
+    readonly projectPage: () => unknown;
+    /** Verified provider-specific presentation provenance. Kept server-side. */
+    readonly source?: unknown;
+    readonly media: ReadonlyArray<{
+        readonly digest: string;
+        readonly rights: unknown;
+    }>;
+}
+
+export declare interface CmsPublicOutputFile {
+    readonly bytes: Uint8Array;
+    readonly digest: string;
+    readonly contentType: string;
+}
+
+/** Explicit public document mounts preserve the application's API/auth routes.
+ * These mounts serve the anonymous captured basis, never personalized content. */
+export declare const cmsPublicOutputHttp: (service: Pick<CmsPublicOutputs, "document" | "asset" | "control"> & Partial<Pick<CmsPublicOutputs, "redirect">>, options: {
+    readonly host: (headers: Readonly<Record<string, string>>) => string;
+    readonly choices?: (headers: Readonly<Record<string, string>>) => ConsentChoices | undefined;
+    readonly documents: ReadonlyArray<{
+        readonly path: string;
+        readonly match: "prefix" | "exact";
+    }>;
+    /** Explicitly reserve sitemap.xml, robots.txt and the sitemap shard directory. */
+    readonly controls?: boolean;
+    /** Resolve approved redirects before document reads, including explicit
+     * method-preserving non-GET responses on these document mounts. */
+    readonly redirects?: boolean;
+}) => ReadonlyArray<PluginHttpRoute>;
+
+export declare interface CmsPublicOutputRedirect {
+    readonly status: 301 | 302 | 307 | 308 | 404 | 410;
+    readonly location: string | null;
+}
+
+export declare interface CmsPublicOutputs extends CmsPublicBuilds {
+    readonly redirect: (input: {
+        readonly host: string;
+        readonly path: string;
+        readonly choices?: ConsentChoices;
+    }) => Effect.Effect<CmsPublicOutputRedirect, CmsPublicBuildUnavailable>;
+    readonly document: (input: {
+        readonly host: string;
+        readonly path: string;
+        readonly choices?: ConsentChoices;
+    }) => Effect.Effect<CmsPublicOutputFile, CmsPublicBuildUnavailable>;
+    /** Server-only source and current activation pin, with the same rights admission as document(). */
+    readonly admittedDocument: (input: {
+        readonly host: string;
+        readonly path: string;
+        readonly choices?: ConsentChoices;
+    }) => Effect.Effect<CmsAdmittedPublicDocument, CmsPublicBuildUnavailable>;
+    readonly asset: (input: {
+        readonly host: string;
+        readonly path: string;
+        readonly choices?: ConsentChoices;
+    }) => Effect.Effect<CmsPublicOutputFile, CmsPublicBuildUnavailable>;
+    readonly control: (input: {
+        readonly host: string;
+        readonly path: string;
+    }) => Effect.Effect<CmsPublicOutputFile, CmsPublicBuildUnavailable>;
+}
+
+export declare interface CmsPublicOutputsOptions extends Omit<CmsPublicBuildsOptions, 'readPage'> {
+    readonly use: (target: {
+        readonly host: string;
+        readonly path: string;
+    }) => SnapshotMediaUse;
+    readonly now?: () => number;
+    readonly readDocument: (tx: DataStore, set: OutputActivationSet, receipt: OutputRegionReceipt, target: CmsPublicPresentationTarget) => Promise<{
+        readonly found: false;
+    } | ({
+        readonly found: true;
+    } & CmsPublicOutputDocument)>;
+    readonly readAsset: (tx: DataStore, set: OutputActivationSet, receipt: OutputRegionReceipt, target: CmsPublicPresentationTarget) => Promise<{
+        readonly found: false;
+    } | ({
+        readonly found: true;
+    } & CmsPublicOutputAsset)>;
+    /** Exact verified redirect policy from this receipted region. Current
+     * ownership, intent, target admission and media rights are checked here. */
+    readonly readRedirect?: (tx: DataStore, set: OutputActivationSet, receipt: OutputRegionReceipt, target: {
+        readonly host: string;
+        readonly path: string;
+    }) => Promise<{
+        readonly found: false;
+    } | {
+        readonly found: true;
+        readonly definition: unknown;
+        readonly safetyGeneration: number;
+    }>;
+    /** Verified selected sitemap/robots bytes from this exact physical region.
+     * Absence leaves control serving disabled; private policy has no projection. */
+    readonly readControl?: (tx: DataStore, set: OutputActivationSet, receipt: OutputRegionReceipt, target: {
+        readonly host: string;
+        readonly path: string;
+    }) => Promise<{
+        readonly found: false;
+    } | ({
+        readonly found: true;
+    } & CmsPublicOutputControl)>;
+}
+
+export declare interface CmsPublicPresentations {
+    readonly consentPurposes: ReadonlyArray<SnapshotConsentPurpose>;
+    readonly presentations: ReadonlyArray<SnapshotPresentation>;
+}
+
+export declare interface CmsPublicPresentationTarget {
+    readonly host: string;
+    readonly path: string;
+    readonly presentation: SnapshotPresentation;
+}
+
+/** Use actual registered content types, approved site profiles and retained
+ * native discovery from the server application, never request-authored JSON. */
+declare interface CmsPublicRouteDeclaration {
+    readonly types: ReadonlyArray<ContentType>;
+    readonly site: SiteDeliveryDefinition;
+    /** Explicit null admits only CMS locations, with no native routing/discovery. */
+    readonly code: SnapshotAppCodePin | null;
+    readonly routing: SnapshotRoutingDefinition | null;
+    readonly routeDiscovery: unknown;
+}
+
+/**
+ * Where a content row lives besides its tenant: the site it belongs to, the
+ * content environment (e.g. `production`, `staging`) and its locale. Three
+ * separate axes, stored on every draft, published row and revision, and
+ * required by every write and read — never taken from a caller's free-form
+ * filter. The tenant comes from the request subject (`tenant()`).
+ */
+declare interface CmsScope {
+    readonly site: string;
+    readonly environment: string;
+    /** A BCP 47 tag, e.g. `en-GB`. */
+    readonly locale: string;
+}
+
+/** Dedicated private composition. No archive/output path, web pin, arbitrary
+ * file name or activation authority can be supplied through the request. */
+export declare const cmsSnapshotAssetsRest: (service: ReturnType<typeof createSnapshotAssetAssembly>) => {
+    routes: {
+        guards: RestGuard[];
+        maxBodyBytes: number;
+        publicApiDescriptor?: PublicApiDescriptor;
+        method: RestMethod;
+        path: string;
+        input?: Schema.Codec<Record<string, unknown>, any, never, never>;
+        output: Schema.Codec<unknown, any, never, never>;
+        handler: (input: Record<string, unknown>, ctx: RestRouteContext) => unknown;
+        mapFailure?: (error: unknown, request: Pick< PluginHttpRouteRequest, "method" | "path" | "query">) => unknown;
+        summary?: string;
+        description?: string;
+        example?: RestRouteExample;
+        operationId?: string;
+        tags?: ReadonlyArray<string>;
+        projection?: RestRouteProjection;
+        deprecated?: string;
+        sunset?: string;
+        version?: `v${number}`;
+        cors?: RestCors;
+        credentials?: "bearer";
+        rateLimit?: RestRateLimit;
+        streaming?: boolean;
+        etag?: boolean;
+        cache?: RestCache;
+    }[];
+    httpRoutes: {
+        handle: (req: PluginHttpRouteRequest) => Promise<{
+            headers: {
+                'www-authenticate'?: string;
+                'cache-control': string;
+                pragma: string;
+                vary: string;
+            };
+            status: number;
+            body?: string | Uint8Array;
+            contentType?: string;
+            stream?: PluginHttpRouteStream;
+            cause?: unknown;
+            byteStream?: PluginHttpRouteByteStream;
+        }>;
+        workload?: ApiWorkload;
+        restContract?: RestRouteDescriptor<any, any>;
+        method: "*" | "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
+        answersOtherMethods?: boolean | undefined;
+        path: string;
+        match?: "prefix" | "exact";
+        handleStream?: (req: PluginHttpRouteStreamRequest) => Promise< PluginHttpRouteResult>;
+        maxBodyBytes?: number;
+        originGuard?: "exempt";
+        cors?: RestCors;
+        credentials?: "bearer";
+    }[];
+};
+
+/** Private read-only transport. Base64 encodes at most 64KiB per chunk; no
+ * request can select a filesystem root, another role or publisher authority. */
+export declare const cmsSnapshotDocumentTransferRest: (service: ReturnType<typeof createSnapshotDocumentTransfer>) => {
+    routes: {
+        guards: RestGuard[];
+        maxBodyBytes: number;
+        publicApiDescriptor?: PublicApiDescriptor;
+        method: RestMethod;
+        path: string;
+        input?: Schema.Codec<Record<string, unknown>, any, never, never>;
+        output: Schema.Codec<unknown, any, never, never>;
+        handler: (input: Record<string, unknown>, ctx: RestRouteContext) => unknown;
+        mapFailure?: (error: unknown, request: Pick< PluginHttpRouteRequest, "method" | "path" | "query">) => unknown;
+        summary?: string;
+        description?: string;
+        example?: RestRouteExample;
+        operationId?: string;
+        tags?: ReadonlyArray<string>;
+        projection?: RestRouteProjection;
+        deprecated?: string;
+        sunset?: string;
+        version?: `v${number}`;
+        cors?: RestCors;
+        credentials?: "bearer";
+        rateLimit?: RestRateLimit;
+        streaming?: boolean;
+        etag?: boolean;
+        cache?: RestCache;
+    }[];
+    httpRoutes: {
+        handle: (req: PluginHttpRouteRequest) => Promise<{
+            headers: {
+                'www-authenticate'?: string;
+                'cache-control': string;
+                pragma: string;
+                vary: string;
+            };
+            status: number;
+            body?: string | Uint8Array;
+            contentType?: string;
+            stream?: PluginHttpRouteStream;
+            cause?: unknown;
+            byteStream?: PluginHttpRouteByteStream;
+        }>;
+        workload?: ApiWorkload;
+        restContract?: RestRouteDescriptor<any, any>;
+        method: "*" | "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
+        answersOtherMethods?: boolean | undefined;
+        path: string;
+        match?: "prefix" | "exact";
+        handleStream?: (req: PluginHttpRouteStreamRequest) => Promise< PluginHttpRouteResult>;
+        maxBodyBytes?: number;
+        originGuard?: "exempt";
+        cors?: RestCors;
+        credentials?: "bearer";
+    }[];
+};
+
+/** Private read-only transport. Base64 encodes at most 64KiB per chunk; no
+ * request can select a filesystem root or publisher authority. */
+export declare const cmsSnapshotRoleTransferRest: (service: ReturnType<typeof createSnapshotRoleTransfer>) => {
+    routes: {
+        guards: RestGuard[];
+        maxBodyBytes: number;
+        publicApiDescriptor?: PublicApiDescriptor;
+        method: RestMethod;
+        path: string;
+        input?: Schema.Codec<Record<string, unknown>, any, never, never>;
+        output: Schema.Codec<unknown, any, never, never>;
+        handler: (input: Record<string, unknown>, ctx: RestRouteContext) => unknown;
+        mapFailure?: (error: unknown, request: Pick< PluginHttpRouteRequest, "method" | "path" | "query">) => unknown;
+        summary?: string;
+        description?: string;
+        example?: RestRouteExample;
+        operationId?: string;
+        tags?: ReadonlyArray<string>;
+        projection?: RestRouteProjection;
+        deprecated?: string;
+        sunset?: string;
+        version?: `v${number}`;
+        cors?: RestCors;
+        credentials?: "bearer";
+        rateLimit?: RestRateLimit;
+        streaming?: boolean;
+        etag?: boolean;
+        cache?: RestCache;
+    }[];
+    httpRoutes: {
+        handle: (req: PluginHttpRouteRequest) => Promise<{
+            headers: {
+                'www-authenticate'?: string;
+                'cache-control': string;
+                pragma: string;
+                vary: string;
+            };
+            status: number;
+            body?: string | Uint8Array;
+            contentType?: string;
+            stream?: PluginHttpRouteStream;
+            cause?: unknown;
+            byteStream?: PluginHttpRouteByteStream;
+        }>;
+        workload?: ApiWorkload;
+        restContract?: RestRouteDescriptor<any, any>;
+        method: "*" | "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
+        answersOtherMethods?: boolean | undefined;
+        path: string;
+        match?: "prefix" | "exact";
+        handleStream?: (req: PluginHttpRouteStreamRequest) => Promise< PluginHttpRouteResult>;
+        maxBodyBytes?: number;
+        originGuard?: "exempt";
+        cors?: RestCors;
+        credentials?: "bearer";
+    }[];
+};
+
+export declare interface CmsStaticPathProgress {
+    readonly id: string;
+    readonly revision: number;
+    readonly phase: StaticPathProgress['phase'];
+    readonly enumerated: number;
+    readonly set: SignedStaticPathSet | null;
+}
+
+export declare interface CmsStaticPathRequest {
+    readonly snapshot: CmsBuildSnapshotPin;
+    readonly token: string;
+    readonly consumerId: string;
+    readonly buildId: string;
+    readonly host: string;
+    /** Omitted selects every enabled captured locale. Explicit selection is pinned. */
+    readonly localeIds?: ReadonlyArray<string>;
+    /** Omitted selects both owners; CMS-only excludes runtime/editor code. */
+    readonly owners?: ReadonlyArray<StaticPathOwner>;
+}
+
+/** Dedicated private coordinator routes; mount httpRoutes as plugin HTTP routes
+ * and pass routes to OpenAPI. No public serving, ambient auth or token cache. */
+export declare const cmsStaticPathSetRest: (service: CmsStaticPathSets) => {
+    routes: {
+        guards: RestGuard[];
+        maxBodyBytes: number;
+        publicApiDescriptor?: PublicApiDescriptor;
+        method: RestMethod;
+        path: string;
+        input?: Schema.Codec<Record<string, unknown>, any, never, never>;
+        output: Schema.Codec<unknown, any, never, never>;
+        handler: (input: Record<string, unknown>, ctx: RestRouteContext) => unknown;
+        mapFailure?: (error: unknown, request: Pick< PluginHttpRouteRequest, "method" | "path" | "query">) => unknown;
+        summary?: string;
+        description?: string;
+        example?: RestRouteExample;
+        operationId?: string;
+        tags?: ReadonlyArray<string>;
+        projection?: RestRouteProjection;
+        deprecated?: string;
+        sunset?: string;
+        version?: `v${number}`;
+        cors?: RestCors;
+        credentials?: "bearer";
+        rateLimit?: RestRateLimit;
+        streaming?: boolean;
+        etag?: boolean;
+        cache?: RestCache;
+    }[];
+    httpRoutes: {
+        handle: (req: PluginHttpRouteRequest) => Promise<{
+            headers: {
+                'www-authenticate'?: string;
+                'cache-control': string;
+                pragma: string;
+                vary: string;
+            };
+            status: number;
+            body?: string | Uint8Array;
+            contentType?: string;
+            stream?: PluginHttpRouteStream;
+            cause?: unknown;
+            byteStream?: PluginHttpRouteByteStream;
+        }>;
+        workload?: ApiWorkload;
+        restContract?: RestRouteDescriptor<any, any>;
+        method: "*" | "GET" | "POST" | "PUT" | "PATCH" | "DELETE" | "HEAD" | "OPTIONS";
+        answersOtherMethods?: boolean | undefined;
+        path: string;
+        match?: "prefix" | "exact";
+        handleStream?: (req: PluginHttpRouteStreamRequest) => Promise< PluginHttpRouteResult>;
+        maxBodyBytes?: number;
+        originGuard?: "exempt";
+        cors?: RestCors;
+        credentials?: "bearer";
+    }[];
+};
+
+export declare interface CmsStaticPathSets {
+    readonly begin: (request: CmsStaticPathRequest) => Effect.Effect<CmsStaticPathProgress, StaticPathSetUnavailable | StaticPathSetConflict>;
+    readonly advance: (request: CmsStaticPathRequest & {
+        readonly id: string;
+        readonly revision: number;
+    }) => Effect.Effect<CmsStaticPathProgress, StaticPathSetUnavailable | StaticPathSetConflict>;
+    readonly page: (request: CmsStaticPathRequest & {
+        readonly id: string;
+        readonly digest: string;
+        readonly index: number;
+    }) => Effect.Effect<{
+        readonly set: SignedStaticPathSet;
+        readonly index: number;
+        readonly entries: ReadonlyArray<StaticPathEntry>;
+        readonly next: number | null;
+    }, StaticPathSetUnavailable | StaticPathSetConflict>;
+}
+
+export declare interface CmsStaticPathSetsOptions {
+    readonly store: DataStore;
+    readonly scope: ChangeFeedScope;
+    readonly execution: SnapshotAppExecution;
+    readonly key: RenderReadKey;
+    readonly verificationKeys?: ReadonlyArray<RenderReadKey>;
+    readonly now?: () => number;
+}
+
+/**
+ * A component editors compose pages from (ADR-CMS-015): a stable `id`, a
+ * display name and typed props. The frontend renders it; the CMS validates
+ * and stores instances of it. `fingerprint` changes whenever the prop contract
+ * does, so a stored instance can tell which definition it was written against.
+ */
+declare interface ComponentDefinition {
+    readonly id: string;
+    readonly displayName: string;
+    readonly props: Readonly<Record<string, FieldSchema>>;
+    readonly fingerprint: string;
+    /** What it is for, in an editor's words — searched by the picker. */
+    readonly description?: string;
+    /** The editorial jobs it serves (`'announce an event'`, `'collect leads'`) — the picker groups and searches by them. */
+    readonly jobs?: ReadonlyArray<string>;
+    /** Named presets an editor starts from (`dark`, `compact`): props that differ from empty. */
+    readonly variants?: Readonly<Record<string, Readonly<Record<string, unknown>>>>;
+    /** Example props — previews, galleries and tests render them; checked against `props` when a content type uses the component. */
+    readonly fixtures?: Readonly<Record<string, Readonly<Record<string, unknown>>>>;
+    /** Upgrades of instances saved against an earlier definition: its fingerprint → the props it becomes now. */
+    readonly migrations?: Readonly<Record<string, (props: Readonly<Record<string, unknown>>) => Readonly<Record<string, unknown>>>>;
+    /** The consent purpose a reader must grant before this component's props reach them (`gateConsent`). */
+    readonly consent?: string;
+}
+
+/** A reader's choices: purpose id → the version they allowed. */
+declare type ConsentChoices = Readonly<Record<string, number>>;
+
+/** Something a reader can allow or refuse. */
+declare interface ConsentPurpose {
+    readonly id: string;
+    /** Raise it when what the reader agrees to changes. */
+    readonly version: number;
+    readonly displayName: string;
+    readonly description: string;
+    /** The third parties it lets in (none for a first-party purpose). */
+    readonly vendors?: ReadonlyArray<ConsentVendor>;
+}
+
+/**
+ * A third party a purpose lets in — kept apart from the purpose itself: who
+ * it is, where its content comes from (the origins a page may then load), what
+ * it stores on the reader's device, and what it does with the data.
+ */
+declare interface ConsentVendor {
+    /** camelCase, unique within the purpose — what a reader-facing text is keyed by. */
+    readonly id: string;
+    readonly name: string;
+    /** `https://host` origins, exactly — the browser loads frames from them once the purpose is granted. */
+    readonly origins: ReadonlyArray<string>;
+    readonly storage: string;
+    readonly dataUse: string;
+}
+
+declare interface ContentLocation {
+    /** Stable mapping identity. Changing a slug/path must not change this ID. */
+    readonly id: string;
+    readonly segments: ReadonlyArray<ContentLocationSegment>;
+}
+
+/** A decoded literal segment, one string field, or the complete content-tree path. */
+declare type ContentLocationSegment = string | {
+    readonly field: string;
+} | {
+    readonly tree: true;
+};
+
+declare interface ContentProjectionDefinition {
+    readonly version: 1;
+    readonly fields: ContentProjectionFields;
+}
+
+declare interface ContentProjectionFields {
+    readonly [field: string]: ContentProjectionNode;
+}
+
+declare type ContentProjectionNode = true | {
+    readonly object: ContentProjectionFields;
+} | {
+    readonly array: ContentProjectionNode;
+} | {
+    readonly variant: {
+        readonly field: string;
+        readonly cases: Readonly<Record<string, ContentProjectionFields>>;
+    };
+};
+
+declare interface ContentSeoDefaults {
+    readonly title?: string;
+    readonly description?: string;
+    readonly social?: {
+        readonly title?: string;
+        readonly description?: string;
+    };
+    readonly robots?: SeoRobotsPolicy;
+    readonly sitemap?: boolean;
+}
+
+declare interface ContentSeoDefinition {
+    readonly version: 1;
+    readonly title: SeoTextMapping;
+    readonly description?: SeoTextMapping;
+    readonly social?: {
+        readonly title?: SeoTextMapping;
+        readonly description?: SeoTextMapping;
+        readonly image?: string;
+    };
+    /** Route addresses remain authoritative; no independent URL field mapping. */
+    readonly canonical?: 'route' | 'omit';
+    readonly robots?: SeoRobotsPolicy;
+    readonly sitemap?: boolean;
+    readonly structuredData?: {
+        readonly type: 'WebPage' | 'Article' | 'BlogPosting';
+        /** A field the rendered main content actually shows, not the SEO override. */
+        readonly title: string;
+        readonly description?: string;
+        readonly datePublished?: string;
+    };
+}
+
+/** A registered content type. */
+declare interface ContentType {
+    readonly name: string;
+    readonly displayName: string;
+    readonly pluralName: string;
+    readonly fields: Readonly<Record<string, FieldSchema>>;
+    /** Original-file field of a versioned asset document. */
+    readonly asset?: AssetConfig;
+    readonly list?: ListConfig;
+    readonly idPrefix?: string;
+    /** Declared ISR revalidations fired by `revalidateContent` — see
+     *  `ContentTypeSpec.revalidate`. */
+    readonly revalidate?: ContentTypeSpec['revalidate'];
+    /** How the documents form a tree — see `ContentTypeSpec.tree`. */
+    readonly tree?: TreeConfig;
+    /** The field a document outside a tree is addressed by — see `ContentTypeSpec.address`. */
+    readonly address?: string;
+    /** Serializable delivery paths with stable mapping IDs; no publish reservation implied. */
+    readonly locations?: ReadonlyArray<ContentLocation>;
+    /** Required/invalid mapped values block publication; length recommendations do not. */
+    readonly seo?: ContentSeoDefinition;
+    /** Explicit delivery definitions supplying locale-specific SEO defaults. Requires `seo`. */
+    readonly seoSites?: ReadonlyArray<SiteDeliveryDefinition>;
+    /** Whether publishing needs an approved revision — see `ContentTypeSpec.review`. */
+    readonly review?: {
+        readonly required: boolean | 'workspace';
+        readonly workflow?: ReviewWorkflow;
+    };
+    /** When documents may be used — see `ContentTypeSpec.availability`. */
+    readonly availability?: AvailabilityConfig;
+    /** The review cycle — see `ContentTypeSpec.lifecycle`. */
+    readonly lifecycle?: LifecycleConfig;
+    /** Templates and their rules — see `ContentTypeSpec.templates`. */
+    readonly templates?: TemplatesConfig;
+    /** Whether publishes land in the change feed — see `ContentTypeSpec.changeFeed`. */
+    readonly changeFeed?: boolean;
+    /** What makes a document findable — see `ContentTypeSpec.search`. */
+    readonly search?: SearchConfig;
+    /** What its documents are checked for — see `ContentTypeSpec.quality`. */
+    readonly quality?: ReadonlyArray<QualityRule>;
+    /** The vocabulary of a list field — see `ContentTypeSpec.taxonomy`. */
+    readonly taxonomy?: TaxonomyConfig;
+    /** Field names whose value is computed-on-save (derivedFrom). */
+    readonly derivedFields: ReadonlyArray<string>;
+    /** Field names marked unique-per-tenant (composite `(tenantId, field)` UNIQUE). */
+    readonly uniqueFields: ReadonlyArray<string>;
+}
+
+/** The user-authored spec passed to `defineContentType`. */
+declare interface ContentTypeSpec {
+    readonly name: string;
+    readonly displayName: string;
+    readonly pluralName: string;
+    readonly fields: Readonly<Record<string, FieldSchema | PipeableField>>;
+    /** Explicit asset identity; the original is a required Media field. */
+    readonly asset?: AssetConfig;
+    readonly list?: ListConfig;
+    /** Override the TypeID prefix for awkward plurals / long names. */
+    readonly idPrefix?: string;
+    /**
+     * Arrange this type's documents in a tree (pages under pages): `parent` is
+     * an optional `Schema.Reference` to this same type, `order` an optional
+     * number field ordering siblings, `segment` the string field that forms the
+     * path (the slug). Read it with `cms.tree` / `cms.route`.
+     */
+    readonly tree?: TreeConfig;
+    /**
+     * For a type outside a tree whose documents have an address of their own
+     * (a blog post's slug): the string field that is it. Every publish records
+     * it, and a changed address leaves a redirect to the document — as moving a
+     * page in a tree does. Read it with `redirectTarget(store, type, path, scope)`.
+     */
+    readonly address?: string;
+    /** Serializable delivery paths with stable mapping IDs; no publish reservation implied. */
+    readonly locations?: ReadonlyArray<ContentLocation>;
+    /** Required/invalid mapped values block publication; length recommendations do not. */
+    readonly seo?: ContentSeoDefinition;
+    /** Explicit delivery definitions supplying locale-specific SEO defaults. Requires `seo`. */
+    readonly seoSites?: ReadonlyArray<SiteDeliveryDefinition>;
+    /**
+     * `required: true` publishes only revisions another editor approved
+     * (`approveReview`) — for every path that publishes: single, release,
+     * rollback, schedule. Register `cmsReviewsTable` when set. `'workspace'`:
+     * each workspace decides (team.ts `setReviewRequired`, or a blueprint's
+     * `team.reviewRequired`) — register `cmsTeamTable` too. With `workflow`
+     * (`defineReviewWorkflow`), the approval is a workflow instance that
+     * approved the exact revision — every applicable step decided — instead of
+     * one approval; register `cmsWorkflowInstancesTable` and
+     * `cmsWorkflowDecisionsTable`.
+     */
+    readonly review?: {
+        readonly required: boolean | 'workspace';
+        readonly workflow?: ReviewWorkflow;
+    };
+    /**
+     * When this type's documents may be used (`until`: a date/datetime field,
+     * `blocked`: a boolean field). Publishing one records it; publishing
+     * anything referencing a blocked or expired one is refused
+     * (`ReferenceUnavailable`), and readers can leave it out
+     * (`unavailableAmong`). Register `cmsAvailabilityTable` when set.
+     */
+    readonly availability?: AvailabilityConfig;
+    /**
+     * How often a published document is checked again: its first publish sets
+     * a review date `reviewEveryDays` ahead, `recertify` moves it on. Register
+     * `cmsStewardshipTable` (it also holds each document's owner).
+     */
+    readonly lifecycle?: LifecycleConfig;
+    /**
+     * Templates a new document can start from, and the rules a document built
+     * from one keeps on every save (required components, the first one, at
+     * most N of one). `field` stores the template id.
+     */
+    readonly templates?: TemplatesConfig;
+    /**
+     * Append every publish and take-down of this type to the change feed
+     * (`cms_changes`, read with `readChanges`), in the same transaction. Register
+     * `cmsChangesTable` and `cmsChangeHeadsTable` for every publication writer;
+     * this flag controls event emission, not publication coordination.
+     */
+    readonly changeFeed?: boolean;
+    /**
+     * Make this type findable (`searchContent`): every save and publish writes
+     * the variant's text to `cms_search` in the same transaction — `title`
+     * ranked first, all other text (strings, rich text, component props) as the
+     * body. Register `cmsSearchTable` when set.
+     */
+    readonly search?: SearchConfig;
+    /**
+     * Quality rules (quality.ts): each names the causing field, the words an
+     * editor reads, and whether publishing waits for it (`blocking`, default
+     * true). A blocking finding is repaired at its field or excepted — one rule,
+     * one variant, a reason, an end date, approved by someone else
+     * (`requestQualityException` / `decideQualityException`). Register
+     * `cmsQualityExceptionsTable` when set.
+     */
+    readonly quality?: ReadonlyArray<QualityRule>;
+    /**
+     * A controlled vocabulary for one `Schema.Array(Schema.String)` field
+     * (taxonomy.ts): every save folds case and spacing, maps synonyms to their
+     * term and drops repeats; a term outside the vocabulary fails the save
+     * (`unknown: 'keep'` keeps it).
+     */
+    readonly taxonomy?: TaxonomyConfig;
+    /**
+     * ISR routes to drop when content of this type is published or
+     * unpublished. `revalidateContent(type)` calls `revalidatePath` /
+     * `revalidateTag` (from `@voltro/runtime`) for each entry, reaching every
+     * `voltro start` replica — `publishDue` after its commits, a mutation from
+     * a post-commit subscriber on `<type>_published` (the write ops run inside
+     * the caller's transaction, so they cannot know when it commits).
+     *
+     * You DON'T need this on postgres for the plain publish case: a route
+     * declaring `cacheInvalidatesOn: ['<type>_published']` is already dropped
+     * by CDC when the published table changes. Declare routes here for the
+     * cases CDC can't cover — non-postgres dialects, pattern purges of routes
+     * whose loader reads this content indirectly, or tag fanout.
+     */
+    readonly revalidate?: {
+        /** Route patterns (`/blog/[slug]`) or concrete paths (`/pricing`). */
+        readonly paths?: ReadonlyArray<string>;
+        /** Tags matched against routes' `cacheInvalidatesOn` entries. */
+        readonly tags?: ReadonlyArray<string>;
+    };
+}
+
+export declare const copyCmsPublicBuildIdentity: (value: unknown) => CmsPublicBuildIdentity;
+
+/** Detached version pins; the actual application retains its notice/vendor text. */
+export declare const copySnapshotConsentPurposes: (value: unknown) => ReadonlyArray<SnapshotConsentPurpose>;
+
+/** Detach a closed claim before asynchronous admission. This alone does not
+ * admit any purpose; use admitSnapshotPresentation against the captured policy. */
+export declare const copySnapshotPresentationValue: (supplied: unknown) => SnapshotPresentation;
+
+export declare const copyStaticPathManifest: (value: unknown) => StaticPathSetManifest;
+
+/** Compose the existing capture/grant/read/render implementation for the exact
+ * admitted application of each request. Selection and retained-code loading
+ * happen outside SQL transactions, after native credential/grant admission;
+ * the same admission is repeated afterwards. Underlying operations retain
+ * their own original receipt, fresh rights and commit-time checks.
+ *
+ * This is not application admission or an upload API. Its server catalog must
+ * already own verified immutable archives. No global current executor changes
+ * when another application is added, and no authorization result is cached. */
+export declare const createCmsApplicationBuildSnapshots: (options: CmsApplicationBuildSnapshotsOptions) => CmsBuildSnapshots;
+
+/** The original deployment association is immutable. Physical receive/open
+ * runs outside SQL; native key fencing and the final lifetime check protect
+ * the catalog commit. Even an exact retry verifies current source custody.
+ * Neither a delivery-read key nor possession of an archive ID admits code. */
+export declare const createCmsBuildApplicationCatalog: (options: CmsBuildApplicationCatalogOptions) => CmsBuildApplicationCatalog;
+
+/** A fixed tenant/site/environment service. Capture retries keep one durable
+ * attempt and the original expiry; possession of its id never grants reads.
+ * This creates private snapshots/output, not an activated website. */
+export declare const createCmsBuildSnapshots: (options: CmsBuildSnapshotsOptions) => CmsBuildSnapshots;
+
+/** No application execution or live route enumeration occurs while preparing
+ * metadata. The definitions are the actual retained, natively verified inputs.
+ * Current graph/rights admission runs separately in the atomic deploy commit. */
+export declare const createCmsNativeOutputDeployments: (supplied: CmsNativeOutputDeploymentsOptions) => CmsNativeOutputDeployments;
+
+/** Fixed tenant/site/environment and an explicit organization API-key scope.
+ * No application execution, provider allocation or signer material is accepted
+ * over the transport. All writes use the existing deployment/activation kernel.
+ * Retrying an exactly committed current marker acknowledges that same result;
+ * it never renews the expired probe or repeats a generation change. */
+export declare const createCmsOutputDeployments: (supplied: CmsOutputDeploymentsOptions) => CmsOutputDeployments;
+
+export declare const createCmsPublicBuilds: (options: CmsPublicBuildsOptions) => CmsPublicBuilds;
+
+export declare const createCmsPublicOutputs: (supplied: CmsPublicOutputsOptions) => CmsPublicOutputs;
+
+/** One host per set; a site's activation combines the sets for all captured
+ * hosts. A set cannot be selected by another host, locale filter or build. */
+export declare const createCmsStaticPathSets: (options: CmsStaticPathSetsOptions) => CmsStaticPathSets;
+
+export declare const createOutputActivationSet: (value: unknown) => OutputActivationSet;
+
+/** A private artifact ID is no activation or serving authority. All original
+ * signed paths, complete document/class receipts and current media rights are
+ * independently verified before and after physical composition and EOF reads.
+ */
+export declare const createSnapshotAssetAssembly: (options: {
+    readonly store: DataStore;
+    readonly scope: ChangeFeedScope;
+    readonly provider: SnapshotOutputProvider;
+    readonly use: SnapshotMediaUse;
+    readonly keys: ReadonlyArray<RenderReadKey>;
+    readonly now?: () => number;
+}) => {
+    render: (request: SnapshotAssetAssemblyRequest) => Promise<{
+        artifactId: string;
+        files: number;
+        bytes: number;
+    }>;
+};
+
+/** Durable private coordination, without persisting any parent/grant token.
+ * Immutable branches are allowed; only a complete, freshly admitted branch can
+ * become a document artifact. No mutable head, lease or elapsed-time recovery.
+ */
+export declare const createSnapshotDocumentAssembly: (options: {
+    readonly store: DataStore;
+    readonly scope: ChangeFeedScope;
+    readonly provider: SnapshotOutputProvider;
+    readonly use: SnapshotMediaUse;
+    readonly keys: ReadonlyArray<RenderReadKey>;
+    readonly now?: () => number;
+}) => {
+    begin: (request: SnapshotDocumentAssemblyRequest) => Promise<SnapshotDocumentAssemblyProgress>;
+    append: (request: SnapshotDocumentAssemblyRequest & SnapshotDocumentAssemblyCursor & {
+        readonly documents: ReadonlyArray<SnapshotOutputDocumentPin>;
+    }) => Promise<SnapshotDocumentAssemblyProgress>;
+    seal: (request: SnapshotDocumentAssemblyRequest & SnapshotDocumentAssemblyCursor) => Promise<{
+        artifactId: string;
+        documents: number;
+        bytes: number;
+    }>;
+};
+
+/** Re-admit the original grant, complete signed paths, renderer receipts and
+ * current media rights on BOTH sides of every physical provider operation.
+ * Caller metadata never chooses a provider root or an unbound artifact ID. */
+export declare const createSnapshotDocumentTransfer: (options: {
+    readonly store: DataStore;
+    readonly scope: ChangeFeedScope;
+    readonly provider: SnapshotOutputProvider;
+    readonly use: SnapshotMediaUse;
+    readonly keys: ReadonlyArray<RenderReadKey>;
+    readonly now?: () => number;
+}) => {
+    read: (request: SnapshotDocumentTransferRequest) => Promise<SnapshotOutputArtifact>;
+    planFile: (request: Omit< CmsStaticPathRequest, "owners" | "localeIds"> & {
+        readonly documents: SnapshotSeoDocumentsSelection;
+    } & {
+        readonly id: string;
+    } & {
+        readonly path: string;
+    }) => Promise< SnapshotOutputFilePlan>;
+    readChunk: (request: Omit< CmsStaticPathRequest, "owners" | "localeIds"> & {
+        readonly documents: SnapshotSeoDocumentsSelection;
+    } & {
+        readonly id: string;
+    } & {
+        readonly file: SnapshotOutputFile;
+        readonly chunk: SnapshotOutputFileChunk;
+    }) => Promise<Uint8Array>;
+};
+
+export declare const createSnapshotRoleTransfer: (options: {
+    readonly store: DataStore;
+    readonly scope: ChangeFeedScope;
+    readonly provider: SnapshotOutputProvider;
+    readonly use: SnapshotMediaUse;
+    readonly keys: ReadonlyArray<RenderReadKey>;
+    readonly maxBytes: number;
+    readonly declaration?: SnapshotRouteDeclaration;
+    readonly now?: () => number;
+}) => {
+    readBatch: (request: Omit< CmsStaticPathRequest, "owners" | "localeIds"> & {
+        readonly documents: SnapshotSeoDocumentsSelection;
+    } & {
+        readonly role: SnapshotTransferRole;
+        readonly id: string;
+        readonly safety: {
+            readonly artifactId: string;
+        } | null;
+        readonly targets: ReadonlyArray<SnapshotRedirectTargetDocuments>;
+    } & {
+        readonly files: ReadonlyArray< SnapshotOutputFile>;
+    }) => Promise<Uint8Array>;
+    read: (request: SnapshotRoleTransferRequest) => Promise<SnapshotOutputArtifact>;
+    planFile: (request: Omit< CmsStaticPathRequest, "owners" | "localeIds"> & {
+        readonly documents: SnapshotSeoDocumentsSelection;
+    } & {
+        readonly role: SnapshotTransferRole;
+        readonly id: string;
+        readonly safety: {
+            readonly artifactId: string;
+        } | null;
+        readonly targets: ReadonlyArray<SnapshotRedirectTargetDocuments>;
+    } & {
+        readonly path: string;
+    }) => Promise< SnapshotOutputFilePlan>;
+    readChunk: (request: Omit< CmsStaticPathRequest, "owners" | "localeIds"> & {
+        readonly documents: SnapshotSeoDocumentsSelection;
+    } & {
+        readonly role: SnapshotTransferRole;
+        readonly id: string;
+        readonly safety: {
+            readonly artifactId: string;
+        } | null;
+        readonly targets: ReadonlyArray<SnapshotRedirectTargetDocuments>;
+    } & {
+        readonly file: SnapshotOutputFile;
+        readonly chunk: SnapshotOutputFileChunk;
+    }) => Promise<Uint8Array>;
+};
+
+export declare const decodeCmsPublicBuildIdentity: (value: string) => CmsPublicBuildIdentity;
+
+export declare const decodeSnapshotPresentation: (purposes: ReadonlyArray<SnapshotConsentPurpose>, selector: string) => SnapshotPresentation;
+
+/** Validate actual callable bindings. Full schema compatibility is checked by
+ * the shared descriptor encoder when the app describes its snapshot inputs. */
+export declare const defineFrontendBindings: (input: FrontendBindings) => FrontendBindings;
+
+export declare const denyOutputTarget: (tx: DataStore, suppliedScope: OutputActivationScope, suppliedTarget: OutputSafetyTarget, reason: "security" | "rights" | "takedown") => Promise<number>;
+
+/** A field marked computed-on-save from another field's value. */
+declare interface DerivedSpec {
+    readonly source: string;
+    readonly transform: (value: unknown, row: Record<string, unknown>) => unknown;
+}
+
+/** The widget the editor renders for a field — drives ContentForm. */
+declare type EditorHint = 'text' | 'textarea' | 'number' | 'boolean' | 'date' | 'datetime' | 'select' | 'richText' | 'media' | 'reference' | 'array' | 'struct' | 'components';
+
+/** Fixed ASCII framing needs no HTML attribute escaping and contains no site
+ * credentials, actor, grant, personal consent or private input configuration. */
+export declare const encodeCmsPublicBuildIdentity: (value: CmsPublicBuildIdentity) => string;
+
+/** A public class selector; this is not a credential or a reader identifier. */
+export declare const encodeSnapshotPresentation: (purposes: ReadonlyArray<SnapshotConsentPurpose>, presentation: SnapshotPresentation) => string;
+
+/** Discriminator for how a field compiles to a column + serialises. */
+declare type FieldKind = 'string' | 'number' | 'boolean' | 'date' | 'datetime' | 'literal' | 'richText' | 'media' | 'reference' | 'array' | 'struct' | 'components';
+
+/** A refinement applied through `.pipe(...)`. */
+declare type FieldRefinement = (field: FieldSchema) => FieldSchema;
+
+/** A fully-resolved field descriptor stored on a content type. */
+declare interface FieldSchema {
+    readonly kind: FieldKind;
+    readonly editorHint: EditorHint;
+    /** When true the field is nullable in the DB + optional in the editor. */
+    readonly isOptional: boolean;
+    /**
+     * Set by `.requiredToPublish()`: a draft may leave it empty; publishing
+     * needs it (`publishViolations`, checked by every publish). Implies
+     * `isOptional` — the column is nullable.
+     */
+    readonly publishRequired?: boolean;
+    /** Max string length — drives textarea-vs-input + save-time validation. */
+    readonly maxLength?: number;
+    /** Source-form regex (string) for save-time validation. */
+    readonly pattern?: string;
+    /** Closed value set for `literal` fields → `<select>` + CHECK constraint. */
+    readonly literals?: ReadonlyArray<string>;
+    /** What an editor reads for each literal (a token's value, an action's purpose). */
+    readonly literalLabels?: Readonly<Record<string, string>>;
+    /** Set by `Schema.Token`: the design-token group the value names. */
+    readonly token?: string;
+    /** Set by `Schema.Action`: the value names an action the renderer binds. */
+    readonly action?: true;
+    /** A `number` field that takes fractions (a `real` column); without it a number is whole. */
+    readonly fraction?: boolean;
+    /**
+     * When true, the field is unique PER TENANT — the derived tables carry a
+     * composite `(tenantId, <field>)` DB UNIQUE constraint (see contentType.ts).
+     * Only meaningful on a `string` field (typically a slug).
+     */
+    readonly unique?: boolean;
+    /** RichText options. */
+    readonly richText?: RichTextOptions;
+    /** Referenced content-type name for `reference` fields. */
+    readonly referenceType?: string;
+    /** Element field for `array` fields. */
+    readonly element?: FieldSchema;
+    /** Nested field map for `struct` fields. */
+    readonly struct?: Readonly<Record<string, FieldSchema>>;
+    /** The components a `components` field may hold, in the order editors see them. */
+    readonly components?: ReadonlyArray<ComponentDefinition>;
+    /** Computed-on-save derivation (set via `derivedFrom`). */
+    readonly derived?: DerivedSpec;
+}
+
+export declare type FrontendBindings = Readonly<Record<string, FrontendComponentBinding>>;
+
+export declare interface FrontendComponentBinding {
+    readonly schema: ComponentDefinition;
+    readonly renderer: string;
+    readonly contexts: ReadonlyArray<FrontendOutputContext>;
+    readonly render: (props: Readonly<Record<string, unknown>>, context: FrontendOutputContext, resources: {
+        readonly media: FrontendMediaReader;
+        readonly source?: SnapshotComponentSource;
+    }) => unknown;
+    readonly empty: (input: FrontendStateInput) => unknown;
+    readonly loading: (input: FrontendStateInput) => unknown;
+    readonly error: (input: FrontendStateInput) => unknown;
+    readonly restricted?: (input: FrontendStateInput & {
+        readonly purpose: string;
+    }) => unknown;
+}
+
+export declare interface FrontendMedia extends FrontendMediaSelection, FrontendMediaFile {
+}
+
+declare interface FrontendMediaFile {
+    readonly url: string;
+    readonly contentType: string;
+}
+
+declare type FrontendMediaOutput = {
+    readonly kind: 'original';
+} | {
+    readonly kind: 'rendition';
+    readonly slot: string;
+};
+
+export declare type FrontendMediaReader = (path: ReadonlyArray<string | number>, output?: FrontendMediaOutput) => FrontendMediaFile | null;
+
+export declare interface FrontendMediaSelection {
+    readonly fieldPath: ReadonlyArray<string | number>;
+    readonly output: FrontendMediaOutput;
+}
+
+export declare interface FrontendOutputContext extends FrontendOutputSelection {
+    readonly localeId: string;
+    readonly contentLocale: string;
+    readonly languageTag: string;
+    readonly direction: 'ltr' | 'rtl';
+}
+
+export declare interface FrontendOutputSelection {
+    readonly channel: string;
+    readonly theme: string;
+}
+
+export declare interface FrontendStateInput {
+    readonly componentId: string;
+    readonly context: FrontendOutputContext;
+    readonly source?: SnapshotComponentSource;
+}
+
+/** How one inherited field may be set. */
+declare interface InheritRule {
+    /** No page may set the field; saving one that does is refused (`locked`). */
+    readonly locked?: boolean;
+    /**
+     * An optional Boolean field of the same type that MASKS this one: true on a
+     * page means it shows nothing here, on purpose — not "unset" (that
+     * inherits) and not an empty value. Pages below inherit the mask until one
+     * sets its own value or mask. A locked field cannot be masked.
+     */
+    readonly mask?: string;
+}
+
+/** Explicit writers-stopped upgrade. Replay every issued activation from its
+ * actual retained region and verify custody/current admission. Missing older
+ * bytes refuse; today's routes cannot reconstruct unknown historical URLs.
+ * The caller transaction makes the entire replay atomic. */
+export declare const initializeOutputRouteHistory: (tx: DataStore, suppliedScope: OutputActivationScope, options: {
+    readonly keys: ReadonlyArray<RenderReadKey>;
+    readonly regionKeys: Readonly<Record<string, ReadonlyArray<RenderReadKey>>>;
+    readonly admit: OutputActivationAdmission;
+    readonly readRoutes: OutputActivationRouteInventory;
+}) => Promise<{
+    readonly revision: number;
+    readonly historyCount: number;
+}>;
+
+/** How often a type's documents are checked again, declared on the type. */
+declare interface LifecycleConfig {
+    /** Days from a publish or a recertification to the next review. */
+    readonly reviewEveryDays: number;
+}
+
+/**
+ * List-view configuration for the consuming editor/template: which
+ * columns its list page shows and the default sort. Validated by
+ * `defineContentType` — every referenced name must be a declared field
+ * or a lifecycle column, so a typo fails at definition time instead of
+ * rendering an empty column.
+ */
+declare interface ListConfig {
+    readonly columns: ReadonlyArray<string>;
+    readonly defaultSort?: {
+        readonly field: string;
+        readonly dir: 'asc' | 'desc';
+    };
+}
+
+/** Whether a (nested) list is numbered. */
+declare type ListKind = 'ordered' | 'unordered';
+
+/** One current candidate admission: deployment/publication, authenticated finite
+ * membership, current namespace/intent/safety and media rights. It grants no
+ * public response or private snapshot read and keeps the owning lock order. */
+export declare const makeOutputActivationAdmission: (supplied: OutputActivationAdmissionOptions) => OutputActivationAdmission;
+
+/** Deployment/publication component, also usable during writers-stopped history
+ * reconstruction. This alone is not a current route-graph admission. */
+export declare const makeOutputDeploymentAdmission: (verifyArtifacts: (tx: DataStore, set: OutputActivationSet) => Promise<void>) => OutputActivationAdmission;
+
+export declare const makeOutputRegionReceipt: (probe: OutputActivationProbe, region: string, key: RenderReadKey, outputId: string) => OutputRegionReceipt;
+
+/** Publication can advance while the previous complete output still serves.
+ * Current deployment/policy conformance and target membership/rights cannot. */
+export declare const makeOutputServingAdmission: (verifyTarget: (tx: DataStore, set: OutputActivationSet, target: OutputSafetyTarget, receipt: OutputRegionReceipt) => Promise<void>) => OutputServingAdmission;
+
+/** Mandatory trusted server adapter: rehash actual staged outputs and path-set
+ * coverage, and lock/read current publication, deployment, contract and policy.
+ * It must reject incompatible rolling deploys, including rollback targets.
+ * Request fields or cached observations are never implementations of admission. */
+export declare type OutputActivationAdmission = (tx: DataStore, set: OutputActivationSet, mode: 'forward' | 'rollback') => Promise<OutputActivationObservation>;
+
+export declare interface OutputActivationAdmissionOptions {
+    /** Trusted immutable artifact reader. Rehash actual required regions and all
+     * six roles; return one exact region's metadata plus original signed replies.
+     * The CLI reader provides physical metadata without a CMS runtime dependency. */
+    readonly verifyArtifacts: (tx: DataStore, set: OutputActivationSet) => Promise<OutputRouteGraphArtifacts>;
+    readonly pathKeys: ReadonlyArray<RenderReadKey>;
+    readonly use: (target: {
+        readonly host: string;
+        readonly path: string;
+    }) => SnapshotMediaUse;
+    readonly now?: () => number;
+}
+
+export declare interface OutputActivationHostArtifacts {
+    readonly host: string;
+    readonly documents: string;
+    readonly assets: string;
+    readonly redirects: string;
+    readonly sitemap: string;
+    readonly robots: string;
+    readonly deny: string;
+}
+
+export declare interface OutputActivationManifest {
+    readonly version: 2;
+    readonly scope: OutputActivationScope;
+    readonly snapshot: {
+        readonly id: string;
+        readonly digest: string;
+        readonly releaseId: string;
+        readonly publicationGeneration: string;
+    };
+    readonly app: {
+        readonly deploymentId: string;
+        readonly inputsId: string;
+        readonly executionId: string;
+        readonly contractVersion: number;
+        readonly bindingsDigest: string;
+        readonly schemaDigest: string;
+        readonly cacheKeyDigest: string;
+    };
+    readonly renderPolicyDigest: string;
+    readonly paths: ReadonlyArray<{
+        readonly host: string;
+        readonly setId: string;
+        readonly count: number;
+    }>;
+    readonly artifacts: ReadonlyArray<OutputActivationHostArtifacts>;
+    readonly cacheNamespace: string;
+    readonly regions: {
+        readonly required: ReadonlyArray<string>;
+        readonly quorum: number;
+    };
+}
+
+export declare interface OutputActivationMarker {
+    readonly id: string;
+    readonly generation: number;
+    readonly set: OutputActivationSet;
+    readonly probe: OutputActivationProbe;
+    readonly receipts: ReadonlyArray<OutputRegionReceipt>;
+    readonly activatedAt: number;
+}
+
+/** Fresh server observations, re-read under the caller's publication/app/policy
+ * locks at probe and commit. Not accepted from an HTTP request or app worker. */
+export declare interface OutputActivationObservation {
+    readonly publicationGeneration: string;
+    readonly releaseId: string | null;
+    readonly deploymentId: string;
+    readonly renderPolicyDigest: string;
+    readonly contractDigest: string;
+}
+
+export declare interface OutputActivationProbe {
+    readonly version: 1;
+    readonly id: string;
+    readonly targetId: string;
+    readonly scope: OutputActivationScope;
+    readonly expectedGeneration: number;
+    readonly mode: 'forward' | 'rollback';
+    readonly observation: OutputActivationObservation;
+    readonly expiresAt: number;
+    readonly keyId: string;
+    readonly signature: string;
+}
+
+/** Trusted server reader of the complete document inventory in this exact
+ * receipted region. Admission separately verifies all physical bytes and signed
+ * path sets. This port must never consume client-supplied URL lists. */
+export declare type OutputActivationRouteInventory = (set: OutputActivationSet, receipt: OutputRegionReceipt) => Promise<{
+    readonly documentArtifacts: ReadonlyArray<{
+        readonly host: string;
+        readonly artifactId: string;
+    }>;
+    readonly routes: ReadonlyArray<{
+        readonly url: string;
+        readonly routeId: string;
+    }>;
+}>;
+
+export declare interface OutputActivationScope {
+    readonly tenantId: string;
+    readonly site: string;
+    readonly environment: string;
+}
+
+export declare interface OutputActivationSet {
+    readonly id: string;
+    readonly manifest: OutputActivationManifest;
+}
+
+export declare class OutputActivationUnavailable extends OutputActivationUnavailable_base {
+}
+
+declare const OutputActivationUnavailable_base: Schema.Class<OutputActivationUnavailable, Schema.TaggedStruct<"OutputActivationUnavailable", {
+    readonly reason: Schema.Literals<readonly ["input", "integrity", "state", "changed", "generation", "regions", "denied", "expired"]>;
+}>, YieldableError>;
+
+export declare interface OutputDeployment {
+    readonly revision: number;
+    readonly app: OutputActivationManifest['app'];
+    readonly renderPolicyDigest: string;
+}
+
+export declare interface OutputRegionReceipt {
+    readonly version: 1;
+    readonly probeId: string;
+    readonly targetId: string;
+    readonly generation: number;
+    readonly region: string;
+    readonly outputId: string;
+    readonly keyId: string;
+    readonly signature: string;
+}
+
+/** Trusted provider data from exact verified private artifact roles. Signed
+ * path evidence is the actual retained build reply, never a caller URL list.
+ * Neither this data nor a signed path set grants serving authority. */
+export declare interface OutputRouteGraphArtifacts {
+    readonly artifacts: ReadonlyArray<{
+        readonly host: string;
+        readonly documents: string;
+        readonly redirects: string;
+        readonly deny: string;
+    }>;
+    readonly documents: ReadonlyArray<{
+        readonly url: string;
+        readonly routeId: string;
+        readonly media: ReadonlyArray<{
+            readonly digest: string;
+            readonly rights: unknown;
+        }>;
+    }>;
+    readonly redirects: ReadonlyArray<unknown>;
+    readonly safety: {
+        readonly generation: number;
+        readonly entries: ReadonlyArray<unknown>;
+    };
+    readonly producers: ReadonlyArray<{
+        readonly consumerId: string;
+        readonly buildId: string;
+        readonly host: string;
+    }>;
+    readonly pathSets: ReadonlyArray<{
+        readonly set: unknown;
+        readonly pages: ReadonlyArray<unknown>;
+    }>;
+}
+
+export declare type OutputSafetyTarget = {
+    readonly kind: 'url';
+    readonly url: string;
+} | {
+    readonly kind: 'asset';
+    readonly digest: string;
+};
+
+export declare type OutputServingAdmission = (tx: DataStore, set: OutputActivationSet, target: OutputSafetyTarget, receipt: OutputRegionReceipt) => Promise<void>;
+
+/** One template a content type offers. */
+declare interface PageTemplate {
+    /** Stable id, stored on the document. */
+    readonly id: string;
+    readonly displayName: string;
+    /** Field values a new document starts with (e.g. a layout). */
+    readonly values?: Readonly<Record<string, unknown>>;
+    /** The components a new document starts with, in order. */
+    readonly sections?: ReadonlyArray<{
+        readonly component: ComponentDefinition;
+        readonly props?: Readonly<Record<string, unknown>>;
+    }>;
+    /** Components the document must always hold at least once. */
+    readonly required?: ReadonlyArray<ComponentDefinition>;
+    /** The component that must come first. */
+    readonly first?: ComponentDefinition;
+    /** The most of one component the document may hold. */
+    readonly max?: ReadonlyArray<{
+        readonly component: ComponentDefinition;
+        readonly count: number;
+    }>;
+    /** Other `Schema.Components` fields of the type (an aside), each with its own rules. */
+    readonly regions?: Readonly<Record<string, RegionRule>>;
+    /** The widths a component may take here: the values its `TemplatesConfig.width` prop may hold. */
+    readonly widths?: ReadonlyArray<{
+        readonly component: ComponentDefinition;
+        readonly allowed: ReadonlyArray<string>;
+    }>;
+    /** How deep components may sit inside each other's slots; 1 = no nesting. */
+    readonly maxDepth?: number;
+}
+
+declare interface PipeableField extends FieldSchema {
+    readonly isOptional: boolean;
+    pipe(...refinements: ReadonlyArray<FieldRefinement>): PipeableField;
+    /** Mark the field optional → nullable column + non-required editor input. */
+    optional(): PipeableField;
+    /**
+     * Let a draft be saved without it, and refuse to publish until it is set —
+     * an image uploaded in bulk before anyone wrote its alt text. The column is
+     * nullable, like `optional()`.
+     */
+    requiredToPublish(): PipeableField;
+}
+
+export declare const probeOutputActivation: (tx: DataStore, supplied: OutputActivationSet, options: {
+    readonly expectedGeneration: number;
+    readonly mode: "forward" | "rollback";
+    readonly key: RenderReadKey;
+    readonly now: number;
+    readonly ttlMs: number;
+    readonly admit: OutputActivationAdmission;
+}) => Promise<OutputActivationProbe>;
+
+/** When and where a quality rule is checked; `scope` is null where no place is known (every pack then applies). */
+declare interface QualityContext {
+    readonly now: Date;
+    readonly scope: CmsScope | null;
+}
+
+/** One quality check of a type — see `ContentTypeSpec.quality`. */
+declare interface QualityRule {
+    /** Stable id (letters, digits, `.`, `-`), unique in the type — exceptions name it. */
+    readonly id: string;
+    /** The field that causes the finding and where it is repaired. */
+    readonly field: string;
+    /** What is wrong, in the editor's words. */
+    readonly message: string;
+    /** Whether publishing waits for a repair or an approved exception. Default true. */
+    readonly blocking?: boolean;
+    /**
+     * The policy pack it belongs to (`'EU claims'`, `'German market'`) — shown
+     * beside the finding. With `sites` / `locales` a pack applies only there;
+     * absent, everywhere.
+     */
+    readonly pack?: string;
+    readonly sites?: ReadonlyArray<string>;
+    readonly locales?: ReadonlyArray<string>;
+    /** True when the values have the finding. Pure; `at` says when and where (a claim's evidence may have run out). */
+    readonly check: (values: Readonly<Record<string, unknown>>, at: QualityContext) => boolean;
+}
+
+/** Serving adapters must invoke this for each response, including cached and
+ * rollback responses. A marker alone never proves present rights/admission. */
+export declare const readActiveOutput: (tx: DataStore, suppliedScope: OutputActivationScope, suppliedTarget: OutputSafetyTarget, options: {
+    readonly keys: ReadonlyArray<RenderReadKey>;
+    readonly regionKeys: Readonly<Record<string, ReadonlyArray<RenderReadKey>>>;
+    readonly region: string;
+    readonly admit: OutputServingAdmission;
+    /** Shared only when the complete admission path is read-only and retains
+     * shared barriers. History/control reads retain exclusive coordination. */
+    readonly lock?: "update" | "share";
+}) => Promise<{
+    readonly marker: OutputActivationMarker;
+    readonly safetyGeneration: number;
+} | null>;
+
+/** Private deployment metadata only. Reobserve a committed result after a lost
+ * acknowledgement without renewing its expired probe or advancing generation.
+ * This does not check current target membership, denials or serving rights;
+ * public reads must still use readActiveOutput and its mandatory admission. */
+export declare const readOutputActivationMarker: (tx: DataStore, suppliedScope: OutputActivationScope, options: {
+    readonly keys: ReadonlyArray<RenderReadKey>;
+    readonly regionKeys: Readonly<Record<string, ReadonlyArray<RenderReadKey>>>;
+    readonly lock?: "update" | "share";
+}) => Promise<OutputActivationMarker | null>;
+
+/** Private original metadata only. Callers must still freshly authorize the
+ * deployment and verify all physical roles/current graph before activation. */
+export declare const readOutputActivationTarget: (tx: DataStore, suppliedScope: OutputActivationScope, targetId: string) => Promise<RetainedOutputActivationTarget | null>;
+
+/** Private current deployment metadata, without registering a deployment or
+ * granting output/serving authority. Compose writes under the existing site
+ * fence before this row lock, as bindOutputDeployment does. */
+export declare const readOutputDeployment: (tx: DataStore, suppliedScope: OutputActivationScope, options?: {
+    readonly lock?: "update" | "share";
+}) => Promise<OutputDeployment | null>;
+
+/** Trusted deployment metadata from the original retained job, not a new
+ * snapshot/read grant. The caller must already own server deployment authority;
+ * current graph, rights and output admission remain mandatory. Read every
+ * original signed output page and its exact EOF without invoking live routes,
+ * application code or a source enumerator. */
+export declare const readStaticPathSetEvidence: (tx: DataStore, suppliedScope: Pick<StaticPathSetContext, "tenantId" | "site" | "environment">, input: {
+    readonly id: string;
+    readonly digest: string;
+}, keys: ReadonlyArray<RenderReadKey>) => Promise<StaticPathSetEvidence>;
+
+/** The rules of one region of a template. */
+declare interface RegionRule {
+    /** Only these components may be placed here (all the field allows, when unset). */
+    readonly allowed?: ReadonlyArray<ComponentDefinition>;
+    readonly required?: ReadonlyArray<ComponentDefinition>;
+    /** The most components the region may hold. */
+    readonly maxItems?: number;
+}
+
+/** An explicitly supplied server key. Never a default or stored with the grant. */
+export declare interface RenderReadKey {
+    readonly id: string;
+    readonly material: Uint8Array;
+}
+
+export declare interface RetainedOutputActivationTarget {
+    readonly set: OutputActivationSet;
+    readonly pathSets: ReadonlyArray<{
+        readonly host: string;
+        readonly jobId: string;
+    }>;
+    readonly outputs: ReadonlyArray<{
+        readonly region: string;
+        readonly outputId: string;
+    }>;
+}
+
+/** Retain one exact original selection in a caller-owned deployment transaction.
+ * Original signed path pages must exist. Roots, providers, keys and bearer
+ * credentials never enter this record. Physical output IDs are coordinates;
+ * this metadata alone neither attests bytes nor grants activation authority. */
+export declare const retainOutputActivationTarget: (tx: DataStore, suppliedScope: OutputActivationScope, supplied: RetainedOutputActivationTarget, keys: ReadonlyArray<RenderReadKey>) => Promise<RetainedOutputActivationTarget>;
+
+declare interface ReviewWorkflow {
+    readonly id: string;
+    /** Raise it whenever the steps change: an instance keeps the version it started with. */
+    readonly version: number;
+    readonly steps: ReadonlyArray<WorkflowStep>;
+}
+
+/** A top-level block. `id` is stable across edits, moves and translations. `style`
+ *  names a token of the profile's style group; `change` marks a block suggested
+ *  for insertion or deletion. */
+declare type RichBlock = {
+    readonly id: string;
+    readonly change?: RichChange;
+    readonly type: 'paragraph';
+    readonly content: ReadonlyArray<RichInline>;
+    readonly style?: string;
+} | {
+    readonly id: string;
+    readonly change?: RichChange;
+    readonly type: 'heading';
+    readonly level: 2 | 3;
+    readonly content: ReadonlyArray<RichInline>;
+    readonly style?: string;
+} | {
+    readonly id: string;
+    readonly change?: RichChange;
+    readonly type: 'list';
+    readonly style?: string;
+    readonly ordered: boolean;
+    readonly items: ReadonlyArray<ReadonlyArray<RichInline>>;
+    /** How deep each item sits (0 at the top, at most `MAX_LIST_LEVEL`), one per item; absent: all at the top.
+     *  An item is at most one level deeper than the one before it. */
+    readonly levels?: ReadonlyArray<number>;
+    /** The kind of the lists nested in it, by depth — index 0 for the lists one level in. Absent (or
+     *  shorter than the depth): numbered like the list itself. At most `MAX_LIST_LEVEL` entries. */
+    readonly sublists?: ReadonlyArray<ListKind>;
+} | {
+    readonly id: string;
+    readonly change?: RichChange;
+    readonly type: 'table';
+    /** True when the first row holds the column headers. */
+    readonly header: boolean;
+    readonly rows: ReadonlyArray<ReadonlyArray<ReadonlyArray<RichInline>>>;
+}
+/** An image asset (by its documentId) with an optional caption. */
+| {
+    readonly id: string;
+    readonly change?: RichChange;
+    readonly type: 'image';
+    readonly asset: string;
+    readonly caption?: string;
+}
+/** A file to download — an asset (by its documentId) from the media library — and the text its link shows. */
+| {
+    readonly id: string;
+    readonly change?: RichChange;
+    readonly type: 'file';
+    readonly asset: string;
+    readonly label: string;
+}
+/** A component the profile allows, placed between blocks; `id` is its instance id. */
+| {
+    readonly id: string;
+    readonly change?: RichChange;
+    readonly type: 'component';
+    readonly componentId: string;
+    readonly props: Readonly<Record<string, unknown>>;
+    /** The definition's fingerprint when it was last saved. */
+    readonly fingerprint?: string;
+};
+
+/** A kind of block. */
+declare type RichBlockKind = RichBlock['type'];
+
+/** A suggested change (track changes): text or a block someone proposes to insert
+ *  or delete, until it is accepted or rejected (trackChanges.ts). */
+declare interface RichChange {
+    readonly id: string;
+    readonly kind: 'insert' | 'delete';
+    /** Who suggested it. */
+    readonly by: string;
+    /** When, as an ISO timestamp. */
+    readonly at: string;
+}
+
+/** How a contact is given: a published contact point (its documentId), or a one-off address or number. */
+declare type RichContact = {
+    readonly target: string;
+} | {
+    readonly channel: 'email' | 'phone';
+    readonly value: string;
+};
+
+/** A run of text inside a block. `change` marks it as suggested. */
+declare type RichInline = 
+/** `style` names a token of the profile's style group (`lead`, `note`). */
+    {
+    readonly type: 'text';
+    readonly text: string;
+    readonly marks?: ReadonlyArray<RichMark>;
+    readonly style?: string;
+    readonly change?: RichChange;
+}
+/** A link to a document (by its documentId) — the site resolves its address. */
+| {
+    readonly type: 'link';
+    readonly target: string;
+    readonly text: string;
+    readonly change?: RichChange;
+}
+/** An e-mail address or a phone number — the site makes it a `mailto:` / `tel:` link. */
+| {
+    readonly type: 'contact';
+    readonly text: string;
+    readonly contact: RichContact;
+    readonly change?: RichChange;
+};
+
+/** An inline mark. */
+declare type RichMark = 'bold' | 'italic' | 'underline';
+
+/**
+ * Which resources a rich-text field may hold: `images` names the content type
+ * an image block references (an asset type), `files` the type a download
+ * block references (an asset type), `links` the type a link references (a
+ * page type). Unset → that node is not allowed.
+ */
+declare interface RichTextOptions {
+    readonly images?: string;
+    /** The asset type a download block references; unset → no downloads. */
+    readonly files?: string;
+    readonly links?: string;
+    /** What this field allows beyond that; without one, every built-in block and mark, no styles, components or contacts. */
+    readonly profile?: RichTextProfile;
+}
+
+/** What a rich-text field allows (`defineRichTextProfile`). Versioned: a change bumps `version`. */
+declare interface RichTextProfile {
+    readonly name: string;
+    readonly version: number;
+    /** `<name>@<version>` — what a saved document records. */
+    readonly id: string;
+    readonly blocks: ReadonlyArray<RichBlockKind>;
+    readonly headings: ReadonlyArray<2 | 3>;
+    readonly marks: ReadonlyArray<RichMark>;
+    /** Named styles of paragraphs, headings, lists and runs of text: one design-token group, name → meaning. */
+    readonly styles?: {
+        readonly group: string;
+        readonly tokens: Readonly<Record<string, string>>;
+    };
+    /** The components that may sit between the blocks. */
+    readonly components: ReadonlyArray<ComponentDefinition>;
+    /** The content type of the published contact points (e-mail, phone) a text may name. */
+    readonly contactPoints?: string;
+    /** Whether a text may hold a one-off e-mail address or phone number (checked on save). */
+    readonly contactLiterals: boolean;
+}
+
+/** What makes a type findable. */
+declare interface SearchConfig {
+    /** The string field ranked first — usually the title. */
+    readonly title: string;
+}
+
+declare interface SeoRobotsPolicy {
+    readonly index: boolean;
+    readonly follow: boolean;
+}
+
+declare interface SeoTextMapping {
+    readonly fields: ReadonlyArray<string>;
+    readonly required?: boolean;
+    /** An editorial recommendation, never an invented search-engine limit. */
+    readonly recommendedMaxLength?: number;
+}
+
+export declare interface SignedStaticPathSet {
+    readonly id: string;
+    readonly manifest: StaticPathSetManifest;
+    readonly keyId: string;
+    readonly signature: string;
+}
+
+declare interface SiteDeliveryDefinition {
+    readonly id: string;
+    readonly version: number;
+    readonly environments: ReadonlyArray<string>;
+    readonly defaultEnvironment: string;
+    readonly locales: ReadonlyArray<SiteDeliveryLocale>;
+    readonly defaultLocale: string;
+    readonly sourceLocale: string;
+    /** Named site-content bindings and their registered content type names. */
+    readonly bindings: Readonly<Record<string, string>>;
+    /** Editorial defaults keyed by stable locale identity, never request language guesses. */
+    readonly seo?: Readonly<Record<string, ContentSeoDefaults>>;
+}
+
+declare interface SiteDeliveryLocale {
+    readonly id: string;
+    /** An explicitly approved language tag; this compiler never canonicalizes it. */
+    readonly tag: string;
+    /** Existing published/draft row partition. Renaming a tag does not rewrite it. */
+    readonly contentLocale: string;
+    readonly direction: 'ltr' | 'rtl';
+    readonly enabled: boolean;
+    readonly prefix: string;
+    /** Ordered fallback locale IDs, independent of translation source. */
+    readonly fallback: ReadonlyArray<string>;
+}
+
+declare const SNAPSHOT_PARTS: readonly ["release", "environment", "site", "domains", "locales", "routes", "schema", "components", "assets", "redirects", "seo", "policies", "projection", "app"];
+
+/** Must come from the admitted build artifact/config, never a request claim. */
+export declare interface SnapshotAppCodePin {
+    readonly commit: string;
+    readonly artifactDigest: string;
+    readonly configDigest: string;
+}
+
+/** Trusted server provider. No compiler, filesystem paths or credentials are
+ * part of this boundary; the CLI installs its retained Node JSON executor. */
+export declare interface SnapshotAppExecution {
+    readonly run: (request: {
+        readonly inputsId: string;
+        readonly executionId: string;
+        readonly exportName: 'describe' | 'definitions' | 'render' | '__voltro_routes' | '__voltro_staticPaths' | '__voltro_renderPage' | '__voltro_renderCmsPage';
+        readonly inputJson: string;
+    }) => Promise<{
+        readonly value: unknown;
+        readonly receipt: Readonly<Record<string, unknown>>;
+    }>;
+}
+
+export declare interface SnapshotApplicationDefinition {
+    readonly types: ReadonlyArray<ContentType>;
+    readonly site: SiteDeliveryDefinition;
+    readonly access: Readonly<Record<string, SnapshotPublicAccess>>;
+    readonly projection: SnapshotProjectionSelection;
+    readonly renditions: ReadonlyArray<SnapshotRenditionRequirement>;
+    readonly xDefault: boolean;
+    readonly frontend: FrontendBindings;
+    readonly output: FrontendOutputSelection;
+    readonly routing: SnapshotRoutingDefinition | null;
+    /** Version pins from the actual application's public consent declarations. */
+    readonly consentPurposes?: ReadonlyArray<SnapshotConsentPurpose>;
+}
+
+/** Frontend declaration producer: validate actual callable implementations in
+ * the retained application, then emit their portable references. */
+export declare const snapshotApplicationPins: (definition: SnapshotApplicationDefinition, code: SnapshotAppCodePin) => {
+    frontend: {
+        version: 2;
+        output: FrontendOutputSelection;
+        components: {
+            render: {
+                kind: string;
+                app: SnapshotAppCodePin;
+                path: string[];
+            };
+            restricted: {
+                kind: string;
+                app: SnapshotAppCodePin;
+                path: string[];
+            } | null;
+            empty: {
+                kind: string;
+                app: SnapshotAppCodePin;
+                path: string[];
+            };
+            loading: {
+                kind: string;
+                app: SnapshotAppCodePin;
+                path: string[];
+            };
+            error: {
+                kind: string;
+                app: SnapshotAppCodePin;
+                path: string[];
+            };
+            id: string;
+            digest: string;
+            renderer: string;
+            contexts: readonly FrontendOutputContext[];
+        }[];
+    };
+    version: 2;
+    app: SnapshotAppCodePin;
+    parts: SnapshotPartPin[];
+    site: SiteDeliveryDefinition;
+    renditions: readonly SnapshotRenditionRequirement[];
+    xDefault: boolean;
+    routing: SnapshotRoutingDefinition | null;
+    consentPurposes: readonly SnapshotConsentPurpose[];
+};
+
+export declare type SnapshotAssetAssemblyRequest = Omit<CmsStaticPathRequest, 'localeIds' | 'owners'> & {
+    readonly documents: SnapshotSeoDocumentsSelection;
+};
+
+export declare interface SnapshotBindingRead {
+    readonly snapshotId: string;
+    readonly snapshotDigest: string;
+    readonly binding: string;
+    readonly contentType: string;
+    readonly localeId: string;
+    readonly requestedLocale: string;
+    readonly sourceLocale: string;
+    readonly fallback: boolean;
+    readonly values: Readonly<Record<string, unknown>>;
+    readonly presentation: SnapshotPresentation;
+}
+
+/** API-side configuration may use the retained portable renderer declaration.
+ * Explicit callbacks, when supplied, still have to match that declaration. */
+export declare interface SnapshotCaptureApplicationDefinition extends Omit<SnapshotApplicationDefinition, 'frontend'> {
+    readonly frontend?: FrontendBindings;
+}
+
+export declare interface SnapshotComponentSource {
+    readonly content: SnapshotContentIdentity;
+    readonly fieldPath: ReadonlyArray<string | number>;
+    /** The original placed instance, or rich block id; null when not projected. */
+    readonly instanceId: string | null;
+    /** Paths are relative to this component's props, never document ids. */
+    readonly link: (fieldPath: ReadonlyArray<string | number>) => string | null;
+    readonly reference: (fieldPath: ReadonlyArray<string | number>) => SnapshotContentData | null;
+}
+
+export declare type SnapshotConsentPurpose = Pick<ConsentPurpose, 'id' | 'version'>;
+
+declare interface SnapshotContentData {
+    readonly content: SnapshotContentIdentity;
+    readonly context: FrontendOutputContext;
+    readonly sourceLocale: string;
+    readonly fallback: boolean;
+    readonly values: Readonly<Record<string, unknown>>;
+    readonly media: ReadonlyArray<FrontendMedia>;
+    readonly presentation: SnapshotPresentation;
+    readonly consentPurposes: ReadonlyArray<SnapshotConsentPurpose>;
+}
+
+export declare interface SnapshotContentIdentity {
+    readonly contentType: string;
+    readonly documentId: string;
+    readonly variantId: string;
+    readonly revisionId: string;
+    readonly revision: number;
+}
+
+export declare interface SnapshotDocumentAssemblyCursor {
+    readonly headerId: string;
+    readonly tipId: string;
+}
+
+export declare interface SnapshotDocumentAssemblyProgress extends SnapshotDocumentAssemblyCursor {
+    readonly count: number;
+    readonly bytes: number;
+}
+
+export declare type SnapshotDocumentAssemblyRequest = Omit<CmsStaticPathRequest, 'localeIds' | 'owners'> & SnapshotPathSetSelection;
+
+export declare type SnapshotDocumentTransferRequest = SnapshotAssetAssemblyRequest & {
+    readonly id: string;
+};
+
+export declare interface SnapshotMediaUse {
+    readonly territory: string | null;
+    readonly channel: string | null;
+    readonly purpose: string | null;
+}
+
+/** Verified private artifact from the server-selected provider root. All files
+ * must be rehashed through EOF before this metadata can be returned. */
+export declare interface SnapshotOutputArtifact {
+    readonly id: string;
+    readonly manifest: {
+        readonly version: 1;
+        readonly subject: Readonly<Record<string, unknown>>;
+        readonly files: ReadonlyArray<SnapshotOutputFile>;
+    };
+}
+
+export declare interface SnapshotOutputAssetsInput extends Pick<SnapshotOutputDocumentsInput, 'snapshotDigest' | 'inputsId' | 'executionId' | 'consentPurposes' | 'presentations' | 'documents'> {
+    readonly web: {
+        readonly id: string;
+        readonly namespace: string;
+    };
+}
+
+export declare interface SnapshotOutputDocumentPin {
+    readonly url: string;
+    readonly path: string;
+    readonly routeId: string;
+    readonly artifactId: string;
+    readonly presentation: SnapshotPresentation;
+}
+
+export declare interface SnapshotOutputDocumentsInput {
+    readonly snapshotDigest: string;
+    readonly inputsId: string;
+    readonly executionId: string;
+    readonly selector: string;
+    readonly pathSetIds: ReadonlyArray<string>;
+    readonly consentPurposes: ReadonlyArray<SnapshotConsentPurpose>;
+    readonly presentations: ReadonlyArray<SnapshotPresentation>;
+    readonly documents: ReadonlyArray<SnapshotOutputDocumentPin>;
+}
+
+export declare interface SnapshotOutputFile {
+    readonly path: string;
+    readonly digest: string;
+    readonly size: number;
+    readonly contentType: string;
+}
+
+export declare interface SnapshotOutputFileChunk {
+    readonly offset: number;
+    readonly size: number;
+    readonly digest: string;
+}
+
+export declare interface SnapshotOutputFilePlan {
+    readonly file: SnapshotOutputFile;
+    readonly chunks: ReadonlyArray<SnapshotOutputFileChunk>;
+}
+
+export declare interface SnapshotOutputProvider {
+    /** Private physical transfer ports only. Their results grant no admission,
+     * activation or serving authority; callers still own fresh authorization. */
+    readonly planFile?: (input: {
+        readonly id: string;
+        readonly path: string;
+    }) => Promise<SnapshotOutputFilePlan>;
+    readonly readChunk?: (input: {
+        readonly id: string;
+        readonly file: SnapshotOutputFile;
+        readonly chunk: SnapshotOutputFileChunk;
+    }) => Promise<Uint8Array>;
+    /** Trusted aggregation of the retained web bytes and actual renderer media.
+     * The provider fixes all archive and output paths, independent of HTTP. */
+    readonly composeAssets?: (input: SnapshotOutputAssetsInput) => Promise<{
+        readonly id: string;
+        readonly files: number;
+        readonly bytes: number;
+    }>;
+    /** Read-only physical provenance from the fixed retained archive and actual
+     * renderer inventories. No capture/stage/build is permitted. The enclosing
+     * CMS reader still owns fresh grant, path and current-rights admission. */
+    readonly readAssets?: (input: SnapshotOutputAssetsInput & {
+        readonly id: string;
+    }) => Promise<SnapshotOutputArtifact>;
+    readonly begin: () => Promise<SnapshotOutputStage>;
+    /** Required when composing controls from previously rendered documents. */
+    readonly read?: (id: string) => Promise<SnapshotOutputArtifact>;
+    /** Trusted physical composition of actual renderer receipts and verified
+     * document bytes. The server fixes both source and destination custody. */
+    readonly composeDocuments?: (input: SnapshotOutputDocumentsInput) => Promise<{
+        readonly id: string;
+        readonly documents: number;
+        readonly bytes: number;
+    }>;
+}
+
+export declare interface SnapshotOutputStage {
+    readonly write: (file: SnapshotOutputFile, bytes: AsyncIterable<Uint8Array>) => Promise<void>;
+    readonly seal: (subject: Readonly<Record<string, unknown>>) => Promise<{
+        readonly id: string;
+    }>;
+    readonly abort: () => Promise<void>;
+}
+
+declare type SnapshotPart = typeof SNAPSHOT_PARTS[number];
+
+declare interface SnapshotPartPin {
+    readonly part: SnapshotPart;
+    readonly format: string;
+    readonly entries: number;
+    readonly digest: string;
+}
+
+declare interface SnapshotPathSetSelection {
+    readonly pathSets: ReadonlyArray<{
+        readonly id: string;
+        readonly digest: string;
+    }>;
+}
+
+export declare interface SnapshotPresentation {
+    readonly version: 1;
+    readonly decided: boolean;
+    readonly granted: ReadonlyArray<SnapshotConsentPurpose>;
+}
+
+/** Cookie decoding belongs to the application. Retain the existing exact-version
+ * consent decision, ignoring inherited properties and unknown purpose names. */
+export declare const snapshotPresentationFromChoices: (purposes: ReadonlyArray<SnapshotConsentPurpose>, choices: ConsentChoices | undefined) => SnapshotPresentation;
+
+/** Complete finite public classes, including never-decided and explicit denial.
+ * Refuse a build that cannot retain all classes within its declared budget. */
+export declare const snapshotPresentations: (purposes: ReadonlyArray<SnapshotConsentPurpose>, maximum?: number) => ReadonlyArray<SnapshotPresentation>;
+
+export declare class SnapshotPresentationUnavailable extends SnapshotPresentationUnavailable_base {
+}
+
+declare const SnapshotPresentationUnavailable_base: Schema.Class<SnapshotPresentationUnavailable, Schema.TaggedStruct<"SnapshotPresentationUnavailable", {
+    readonly reason: Schema.Literals<readonly ["policy", "selection", "bounds"]>;
+}>, YieldableError>;
+
+export declare interface SnapshotProjectionSelection {
+    readonly id: string;
+    readonly definitions: Readonly<Record<string, ContentProjectionDefinition | null>>;
+    /** Explicit target types admitted for recursive native reference composition. */
+    readonly referenceTypes?: ReadonlyArray<string>;
+    /** Explicit target type → captured location mapping for native reference links. */
+    readonly referenceRoutes?: Readonly<Record<string, string>>;
+    /** Named captured trees with explicit scalar display fields and route mapping. */
+    readonly trees?: Readonly<Record<string, SnapshotTreeSelection>>;
+}
+
+/** Explicit decisions from the admitted app. Missing/null field values are a
+ * separate decision; an unknown nonempty audience never becomes public. */
+export declare type SnapshotPublicAccess = {
+    readonly kind: 'public';
+} | {
+    readonly kind: 'deny';
+} | {
+    readonly kind: 'field';
+    readonly field: string;
+    readonly values: ReadonlyArray<string>;
+    readonly missing: 'public' | 'deny';
+};
+
+export declare interface SnapshotRedirectTargetDocuments {
+    readonly host: string;
+    readonly documents: SnapshotSeoDocumentsSelection;
+}
+
+export declare interface SnapshotRenditionRequirement extends RenditionDerivation {
+    readonly contentType: string;
+    readonly slot: string;
+}
+
+export declare type SnapshotRoleTransferRequest = SnapshotAssetAssemblyRequest & {
+    readonly role: SnapshotTransferRole;
+    readonly id: string;
+    readonly safety: {
+        readonly artifactId: string;
+    } | null;
+    readonly targets: ReadonlyArray<SnapshotRedirectTargetDocuments>;
+};
+
+export declare type SnapshotRouteClaim = {
+    readonly kind: 'cms';
+} | {
+    readonly kind: 'code';
+    readonly collision: 'reject' | 'cms' | 'code';
+    /** Opt this native page into public production documents and path sets. */
+    readonly public?: boolean;
+};
+
+/** Pure server-owned declaration selection from an already admitted snapshot.
+ * No IO or application execution belongs in this synchronous callback. */
+export declare type SnapshotRouteDeclaration = CmsPublicRouteDeclaration | ((application: CmsBuildSnapshotApplicationPin & {
+    readonly routeDiscovery: unknown;
+}) => CmsPublicRouteDeclaration);
+
+export declare interface SnapshotRouteRead {
+    readonly snapshotId: string;
+    readonly snapshotDigest: string;
+    readonly routeId: string;
+    readonly path: string;
+    readonly contentType: string;
+    readonly localeId: string;
+    readonly requestedLocale: string;
+    readonly sourceLocale: string;
+    readonly fallback: boolean;
+    readonly values: Readonly<Record<string, unknown>>;
+    readonly presentation: SnapshotPresentation;
+}
+
+export declare interface SnapshotRoutingDefinition {
+    readonly pagesDirectory: string;
+    readonly claims: Readonly<Record<string, SnapshotRouteClaim>>;
+}
+
+export declare interface SnapshotSeoDocumentsSelection extends SnapshotPathSetSelection {
+    readonly artifactId: string;
+}
+
+export declare type SnapshotTransferRole = 'assets' | 'deny' | 'redirects' | 'sitemap' | 'robots';
+
+export declare interface SnapshotTreeData {
+    readonly version: 1;
+    readonly contentType: string;
+    readonly localeId: string;
+    readonly requestedLocale: string;
+    readonly currentDocumentId: string | null;
+    readonly nodes: ReadonlyArray<SnapshotTreeNode>;
+    /** Root-first public ancestors of the current document, independent of includeField. */
+    readonly ancestors: ReadonlyArray<SnapshotTreeNode>;
+}
+
+export declare interface SnapshotTreeNode {
+    readonly documentId: string;
+    readonly parent: string | null;
+    readonly depth: number;
+    readonly path: string;
+    readonly sourceLocale: string;
+    readonly fallback: boolean;
+    readonly values: Readonly<Record<string, unknown>>;
+}
+
+export declare interface SnapshotTreeSelection {
+    readonly contentType: string;
+    readonly mappingId: string;
+    readonly fields: ReadonlyArray<string>;
+    /** Include only true nodes whose ancestors also match this Boolean field. */
+    readonly includeField?: string;
+}
+
+export declare interface StaticPathEntry {
+    readonly host: string;
+    readonly path: string;
+    readonly localeId: string;
+    readonly routeId: string;
+    readonly owner: StaticPathOwner;
+    readonly file: string | null;
+    readonly sourceDigest: string | null;
+    readonly parameters: Readonly<Record<string, string>>;
+}
+
+export declare const staticPathHash: (value: unknown) => string;
+
+export declare type StaticPathOwner = 'cms' | 'code';
+
+declare interface StaticPathProgress {
+    readonly version: 1;
+    readonly phase: 'cms' | 'code' | 'seal' | 'ready';
+    readonly after: string | null;
+    readonly codeIndex: number;
+    readonly revision: number;
+    readonly inputPages: number;
+    readonly inputCount: number;
+    readonly inputBytes: number;
+    readonly chain: string;
+}
+
+export declare class StaticPathSetConflict extends StaticPathSetConflict_base {
+}
+
+declare const StaticPathSetConflict_base: Schema.Class<StaticPathSetConflict, Schema.TaggedStruct<"StaticPathSetConflict", {
+    readonly url: Schema.String;
+    readonly owners: Schema.$Array<Schema.String>;
+    readonly repair: Schema.String;
+}>, YieldableError>;
+
+export declare interface StaticPathSetContext {
+    readonly tenantId: string;
+    readonly site: string;
+    readonly environment: string;
+    readonly snapshotId: string;
+    readonly snapshotDigest: string;
+    readonly releaseId: string | null;
+    readonly consumerId: string;
+    readonly buildId: string;
+    readonly inputsId: string;
+    readonly executionId: string;
+    readonly routesDigest: string;
+    readonly domainsDigest: string;
+    readonly localesDigest: string;
+    readonly policyDigest: string;
+    readonly projectionDigest: string;
+    readonly host: string;
+    readonly localeIds: ReadonlyArray<string>;
+    readonly owners: ReadonlyArray<StaticPathOwner>;
+}
+
+export declare interface StaticPathSetEvidence {
+    readonly set: SignedStaticPathSet;
+    readonly pages: ReadonlyArray<ReadonlyArray<StaticPathEntry>>;
+}
+
+export declare interface StaticPathSetManifest {
+    readonly version: 1;
+    readonly context: StaticPathSetContext;
+    readonly sort: 'host-nfc-path/v1';
+    readonly pageSize: 200;
+    readonly count: number;
+    readonly sources: {
+        readonly count: number;
+        readonly digest: string;
+    };
+    readonly pages: ReadonlyArray<{
+        readonly count: number;
+        readonly digest: string;
+        readonly first: string;
+        readonly last: string;
+    }>;
+}
+
+export declare class StaticPathSetUnavailable extends StaticPathSetUnavailable_base {
+}
+
+declare const StaticPathSetUnavailable_base: Schema.Class<StaticPathSetUnavailable, Schema.TaggedStruct<"StaticPathSetUnavailable", {
+    readonly reason: Schema.Literals<readonly ["input", "bounds", "integrity", "key", "cursor", "state", "changed"]>;
+}>, YieldableError>;
+
+/** A type's taxonomy — see `ContentTypeSpec.taxonomy`. */
+declare interface TaxonomyConfig {
+    /** A declared `Schema.Array(Schema.String)` field. */
+    readonly field: string;
+    readonly terms: ReadonlyArray<VocabularyTerm>;
+    /** A term outside the vocabulary: `refuse` (default) fails the save, `keep` keeps it as typed. */
+    readonly unknown?: 'refuse' | 'keep';
+}
+
+/** Declared on a content type as `templates`. */
+declare interface TemplatesConfig {
+    /** An optional string field that stores the template's id. */
+    readonly field: string;
+    /** The `Schema.Components` field the rules apply to. */
+    readonly components: string;
+    /** The component prop that holds a placement's width (`widths`); default `width`. */
+    readonly width?: string;
+    readonly list: ReadonlyArray<PageTemplate>;
+}
+
+/** How a content type forms a tree. Validated by `defineContentType`. */
+declare interface TreeConfig {
+    /** An optional `Schema.Reference(<this type>)` field: the parent document. */
+    readonly parent: string;
+    /** An optional number field ordering siblings (ascending; unset sorts last). */
+    readonly order?: string;
+    /** The string field that is this node's path segment — usually the slug. */
+    readonly segment: string;
+    /**
+     * Optional fields a page takes from the nearest ancestor that sets them
+     * (a header, a footer): read with {@link inheritedValue}. `locked: true`
+     * means no page may set it — only whatever the app supplies above the
+     * tree (a site default).
+     */
+    readonly inherit?: Readonly<Record<string, InheritRule>>;
+}
+
+/** One upload, no retries. backendOrigin is trusted deployment configuration,
+ * never request-selected. On a lost acknowledgement, inspect the original
+ * deployment through the JSON client before deciding whether to send again.
+ * The source factory runs only after initial admission and must honor its
+ * supplied signal while awaiting IO. Transfer completion/refusal cancels it. */
+export declare const uploadCmsBuildApplication: (options: {
+    readonly backendOrigin: string;
+    readonly credential: string;
+    readonly admission: CmsBuildApplicationAdmission;
+    readonly bytes: (signal: AbortSignal) => AsyncIterable<Uint8Array>;
+    readonly authorize: () => Promise<void>;
+    readonly signal: AbortSignal;
+    /** Trusted server-owned transport; endpoint and all upload guards stay fixed. */
+    readonly fetch?: typeof globalThis.fetch;
+}) => Promise<CmsBuildApplicationAdmission>;
+
+/** Check each immutable page independently against its signed root and count. */
+export declare const verifyStaticPathPage: (set: SignedStaticPathSet, index: number, value: unknown) => ReadonlyArray<StaticPathEntry>;
+
+/** One term and the spellings that mean it. */
+declare interface VocabularyTerm {
+    readonly term: string;
+    readonly synonyms?: ReadonlyArray<string>;
+}
+
+declare interface WorkflowStep {
+    /** camelCase, unique within the workflow. */
+    readonly id: string;
+    readonly label: string;
+    /** The scope a person needs to decide this step (a delegate decides without it). */
+    readonly approverScope: string;
+    /** Steps that must be approved before this one opens. */
+    readonly after?: ReadonlyArray<string>;
+    /** The step applies only when this holds for the revision's values. */
+    readonly when?: (values: Readonly<Record<string, unknown>>) => boolean;
+    /** Hours the step may stay open once it is open; later it is overdue. */
+    readonly slaHours?: number;
+    /** Approving needs evidence: a link or a note saying what was checked. */
+    readonly evidence?: boolean;
+}
+
+export { }