@aotter/mantle 0.1.0-alpha.1 → 0.1.0-alpha.2

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aotter/mantle",
-  "version": "0.1.0-alpha.1",
-  "description": "Umbrella entry for @aotter/mantle. Adopters install this one package and import from subpaths: /spec, /runtime, /cloudflare, /admin-ui. Sub-packages remain individually installable on npm for tooling / alt-adapter authors. The Netlify adapter ships as a private workspace stub in v0.1 — its subpath will be added when the impl lands in v0.2.",
+  "version": "0.1.0-alpha.2",
+  "description": "Umbrella entry for @aotter/mantle. Adopters install this one package and import from subpaths: /spec, /runtime, /cloudflare, /admin-ui. Sub-packages remain individually installable on npm for tooling and adapter authors.",
   "license": "Apache-2.0",
   "homepage": "https://mantle.tools/",
   "repository": {
@@ -55,15 +55,15 @@
     "README.md"
   ],
   "dependencies": {
-    "@aotter/mantle-admin-ui": "0.1.0-alpha.1",
-    "@aotter/mantle-cloudflare": "0.1.0-alpha.1",
-    "@aotter/mantle-spec": "0.1.0-alpha.1",
-    "@aotter/mantle-runtime": "0.1.0-alpha.1"
+    "@aotter/mantle-cloudflare": "0.1.0-alpha.2",
+    "@aotter/mantle-admin-ui": "0.1.0-alpha.2",
+    "@aotter/mantle-runtime": "0.1.0-alpha.2",
+    "@aotter/mantle-spec": "0.1.0-alpha.2"
   },
   "peerDependencies": {
     "@cloudflare/workers-oauth-provider": "^0.8.2",
     "aws4fetch": "^1.0.20",
-    "better-auth": "^1.6.24",
+    "better-auth": "^1.6.27",
     "hono": "^4.12.0",
     "zod": "^4.0.0"
   },
@@ -71,7 +71,7 @@
     "@cloudflare/workers-oauth-provider": "^0.8.2",
     "@types/node": "^26",
     "aws4fetch": "^1.0.20",
-    "better-auth": "^1.6.24",
+    "better-auth": "^1.6.27",
     "hono": "^4.12.34",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10",

package/skills/develop/SKILL.md

@@ -16,7 +16,7 @@ docs govern runtime/API behavior.
 ## First Read
 
 1. `package.json` for the installed `@aotter/mantle*` versions.
-2. `manifests/`, the active adapter config, and `src/auth.ts` when present. If the project is older, check `src/mantleConfig.ts`.
+2. `manifests/site.yaml`, the active adapter config, and `src/auth.ts` when present. If the project is older, check `src/mantleConfig.ts`.
 3. The active `.mantle/overlays/<type>/seed.json`, when present; generated
    homepages commonly import visible copy and form structure from it.
 4. Optional local context: `.mantle/launch-state.json`, `.mantle/handoff.md`,
@@ -82,9 +82,12 @@ the atoms cannot express the behavior.
   `Procedure.spec.input` before the seed/form. Keep public mutation inputs
   `additionalProperties: false`; otherwise JSON Schema's default may strip an
   undeclared field while returning success.
-- Use `lifecycle: none` for submissions, inquiries, orders, and other
+- Use `lifecycle: operational` for submissions, inquiries, orders, and other
   Procedure-created operational records that staff inspect or correct. Reserve
-  `simple` for content a person stages and publishes.
+  `publishing` for content a person stages and publishes.
+- Lifecycle `before_update` / `after_update` hooks also fire for unpublish,
+  archive, and every other status transition whose target is not `published`;
+  do not use them for edit-only work.
 - When a form's fixed option values change, update the stored Schema and public
   Procedure input `enum` together. Keep translated labels in the page seed;
   Admin and Staff MCP derive their typed controls from the manifest values.
@@ -98,10 +101,15 @@ the atoms cannot express the behavior.
 
 - `data.locale` is reserved for `localized: true` Schemas. A non-localized
   Schema must use a domain field such as `replyLocale`.
+- Use a standalone localized Schema only for independent locale rows. For
+  versions of one entity, use a non-localized parent plus a localized child
+  with `translates: { parent, on }`. The child must own at least one field
+  besides `locale` and the join field.
 - Parallel locale blocks must keep field names, option values, step IDs, and
   result keys identical; translate display strings only.
-- `siteDefaults.locales` is code-owned and boot-synced. Brand, title,
-  description, and origin are seeded once, then changed through site settings.
+- `siteDefaults.origin` and `siteDefaults.locales` are code-owned and
+  boot-synced. Brand, title, and description seed once, then change through
+  site settings.
 - When changing an existing collection from `[slug]` to `[slug, locale]`,
   boot with a Mantle version that reconciles obsolete unique indexes and test
   the same slug in two locales. Do not patch D1 manually.
@@ -203,7 +211,8 @@ cache.
 
 ## Rules
 
-- Prefer manifest YAML for content model changes.
+- Put all content model changes in `manifests/site.yaml`; other manifest
+  filenames are rejected.
 - Use a generated overlay `seed.json` for the auth-free local first page when
   it is already imported by `src/web/content/*`.
 - Add TypeScript only for handlers, rendering, adapter wiring, or real behavior.

package/skills/plugin/SKILL.md

@@ -49,7 +49,7 @@ stop and ask for the recipe instead of guessing.
 ## First Read
 
 1. `package.json` for Mantle version and adapter package.
-2. `manifests/` for current atom names and route/tool collisions.
+2. `manifests/site.yaml` for current atom names and route/tool collisions.
 3. `src/mantle/config.ts` and `src/mantle/handlers/` for registered handlers, templates, and optional ports. Older projects may use `src/mantleConfig.ts`.
 4. `.mantle/plugins.json` and `.mantle/plugins.lock.json` if present.
 5. `.mantle/launch-state.json` only as context, not as plugin authority.

package/skills/provision/SKILL.md

@@ -50,6 +50,10 @@ Capture the live URL in `PUBLIC_ORIGIN` and `Public site:` in `AGENTS.md`, then
 commit and push non-secret changes. Reuse any repo or Worker already created
 by landing. Workers Builds is optional after a direct deploy.
 
+When the owner later adopts a custom domain, update `PUBLIC_ORIGIN` and the
+provider's OAuth callback together, then redeploy. Do not patch `site_config`
+directly; boot syncs its canonical origin from `PUBLIC_ORIGIN`.
+
 ## Choose Auth
 
 - **Self-hosted — free:** configure the owner's per-site GitHub OAuth App and

package/skills/theme/SKILL.md

@@ -18,7 +18,7 @@ tokens, or recipes, but the skill contract is Core-owned.
 2. `styles/`, `components/`, `src/web/`, `src/theme*`, and UI-library config
    if present.
 3. A vendored UI palette's manifest and license, if present.
-4. `manifests/` to understand which content shape drives the public UI.
+4. `manifests/site.yaml` to understand which content shape drives the public UI.
 
 ## Ownership