@aotter/mantle 0.1.5-alpha.1 → 0.2.0-alpha.1

package/dist/spec/domain/model/ManifestGrammar.js

@@ -0,0 +1,149 @@
+/**
+ * K8s-style manifest envelope, scoped to the cms group of the mantle universe.
+ *
+ *   apiVersion: cms.mantle.aotter.net/v2
+ *   kind: <Kind>
+ *   metadata: { name }
+ *   spec: { ... kind-specific ... }
+ *
+ * Sibling group `analytics.mantle.aotter.net/v1` lives in the parallel mantle (OLAP)
+ * project and is parsed there — the two systems share lineage and mantle.ai
+ * domain but not parsers.
+ *
+ * The parser rejects keys and enum values outside this shipped grammar.
+ * Future syntax is added only with its implementation.
+ */
+export const API_VERSION = "cms.mantle.aotter.net/v2";
+export function isMediaMcpHint(value) {
+    return (value === "media" ||
+        value === "media-image" ||
+        value === "media-video" ||
+        value === "media-file");
+}
+export const MANTLE_REF_KEYWORD = "x-mantle-ref";
+/**
+ * A property's string options: its `enum`, or a `oneOf` whose every branch is a string `const` (the standard way to give each
+ * option a `title`). Undefined when the property is neither.
+ */
+export function enumOptions(property) {
+    if (property?.enum?.length && property.enum.every((v) => typeof v === "string"))
+        return property.enum.map((value) => ({ value: value }));
+    const branches = property?.oneOf;
+    if (!branches?.length || !branches.every((b) => typeof b.const === "string"))
+        return undefined;
+    return branches.map((b) => ({ value: b.const, ...(b.title !== undefined ? { title: b.title } : {}) }));
+}
+/** Normalize either `x-mantle-ref` form, or `null` when the property carries
+ *  none (or a malformed value, which graph validation reports). */
+export function resolveMantleRef(property) {
+    if (typeof property !== "object" || property === null)
+        return null;
+    const ref = property[MANTLE_REF_KEYWORD];
+    if (typeof ref === "string")
+        return ref.length > 0 ? { schema: ref, field: "id" } : null;
+    if (typeof ref !== "object" || ref === null || Array.isArray(ref))
+        return null;
+    const { schema, field } = ref;
+    return typeof schema === "string" && schema.length > 0 && typeof field === "string" && field.length > 0
+        ? { schema, field }
+        : null;
+}
+export const MCP_HINT_KEYWORD = "x-mcp-hint";
+/** A 0.1.x Schema-property keyword; 0.2.0 refuses it (Schema.spec.scope and a Procedure's SQL replace it). */
+export const MANTLE_BIND_KEYWORD = "x-mantle-bind";
+/**
+ * Resolve a `LocalizedText` value to a single displayable string for
+ * `preferred` (typically the viewer's chosen admin language), falling
+ * back to `canonical` (the site's canonical locale) and finally to the
+ * record's first own-enumerable entry (insertion order). A plain
+ * string is returned as-is — even an empty string, since only
+ * `null`/`undefined` map to `null` here; shape validation (rejecting
+ * empty strings) is the parser's job, not this resolver's. `null` /
+ * `undefined` input (the field was never set) resolves to `null`, and
+ * an empty record (structurally invalid, but resolved defensively)
+ * also resolves to `null` since there is nothing to fall back to.
+ */
+export function resolveLocalizedText(value, preferred, canonical) {
+    if (value == null)
+        return null;
+    if (typeof value === "string")
+        return value;
+    if (Object.prototype.hasOwnProperty.call(value, preferred)) {
+        return value[preferred];
+    }
+    if (canonical && Object.prototype.hasOwnProperty.call(value, canonical)) {
+        return value[canonical];
+    }
+    const firstKey = Object.keys(value)[0];
+    return firstKey !== undefined ? value[firstKey] : null;
+}
+export const VIEW_SURFACES = ["public", "staff", "internal"];
+/** Reserved query-string names on the View REST surface. A View `input` may
+ *  not declare them (`VIEW_INPUT_RESERVED_NAME`). */
+export const VIEW_INPUT_RESERVED = ["limit", "cursor"];
+export const PROCEDURE_TARGET_KEYS = ["schema", "id", "version"];
+export const PROCEDURE_MCP_ANNOTATION_KEYS = ["readOnlyHint", "destructiveHint", "openWorldHint"];
+/**
+ * Staff role hierarchy. `users` is the base identity layer (runtime);
+ * `staff` is the privilege overlay (one row per privileged user). A
+ * user without a staff row is a regular site member with no admin
+ * access.
+ *
+ *   owner       — full control, manages staff, manages settings
+ *   editor      — publish, approve/reject, manage all entries
+ *   contributor — create and edit drafts
+ *
+ * `StaffRole` lives in spec because the manifest grammar references
+ * it directly: `requires.auth.all: [{ "ctx.staff": [<role>, ...] }]`
+ * — the parser checks each role string is in `STAFF_ROLES` at boot.
+ * The `Staff` runtime row shape (with grantedBy / grantedAt) lives in
+ * `mantle-runtime`; only the closed enum is grammar.
+ */
+export const STAFF_ROLES = ["owner", "editor", "contributor"];
+// `meetsRole` (role-rank comparison) moved to
+// `domain/service/StaffRoleHierarchy.ts` — this file is pure grammar
+// types referenced by the parser.
+export function isStaffRole(s) {
+    return STAFF_ROLES.includes(s);
+}
+/** Shipped v0.1 lifecycle hook vocabulary: before/after ×
+ *  create/update/delete plus the publish boundary. New entries require an
+ *  explicit grammar-revise round. */
+export const LIFECYCLE_HOOKS = [
+    "before_create",
+    "after_create",
+    "before_update",
+    "after_update",
+    "before_delete",
+    "after_delete",
+    "before_publish",
+    "after_publish",
+];
+/** Surfaces an MCP-source Trigger can be bound to. `staff` ⇒
+ *  `/mcp/staff` (bearer + role gate); `public` ⇒ `/mcp` (bearer only).
+ *  The procedure's own `requires.auth` still gates the call —
+ *  surface determines visibility in `tools/list`. */
+export const MCP_TRIGGER_SURFACES = ["staff", "public"];
+/** Storage-row metadata columns reserved across every Schema. Used by
+ *  the View SQL compiler (to project them as native columns rather
+ *  than `json_extract`) and by the type emitter (to surface them on
+ *  every Entry interface). Adding a new reserved column is a grammar
+ *  revise — touch this constant + every consumer. */
+export const RESERVED_ENTRY_COLUMNS = [
+    "id",
+    "status",
+    "version",
+    "createdAt",
+    "updatedAt",
+    "authorId",
+];
+/**
+ * Reserved Procedure input wire names. `expectedVersion` is the observed
+ * native `entry.version` at read time (not version+1). First-party Admin/SDK
+ * bind and hide it; other callers supply it. Schema `spec.schema.properties`
+ * must not collide — validate is fail-closed (`INVALID_MANIFEST_ENVELOPE`).
+ * New reserved names need an ADR (ADR-0022).
+ */
+export const EXPECTED_VERSION_PROPERTY = "expectedVersion";
+export const RESERVED_PROCEDURE_INPUT_NAMES = [EXPECTED_VERSION_PROPERTY];
+//# sourceMappingURL=ManifestGrammar.js.map

package/dist/spec/domain/model/ManifestGrammar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ManifestGrammar.js","sourceRoot":"","sources":["../../../../src/spec/domain/model/ManifestGrammar.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,0BAAmC,CAAC;AAO/D,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,CACL,KAAK,KAAK,OAAO;QACjB,KAAK,KAAK,aAAa;QACvB,KAAK,KAAK,aAAa;QACvB,KAAK,KAAK,YAAY,CACvB,CAAC;AACJ,CAAC;AAiED,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAuB,CAAC;AAE1D;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgC;IAC1D,IAAI,QAAQ,EAAE,IAAI,EAAE,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAe,EAAE,CAAC,CAAC,CAAC;IACnJ,MAAM,QAAQ,GAAG,QAAQ,EAAE,KAAK,CAAC;IACjC,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/F,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAe,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACnH,CAAC;AAUD;mEACmE;AACnE,MAAM,UAAU,gBAAgB,CAAC,QAAiB;IAChD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,GAAG,GAAI,QAAoC,CAAC,kBAAkB,CAAC,CAAC;IACtE,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,GAA8B,CAAC;IACzD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QACrG,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE;QACnB,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AACD,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAqB,CAAC;AACtD,8GAA8G;AAC9G,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAwB,CAAC;AAa5D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAuC,EACvC,SAAiB,EACjB,SAAyB;IAEzB,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;QAC3D,OAAO,KAAK,CAAC,SAAS,CAAE,CAAC;IAC3B,CAAC;IACD,IAAI,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC,SAAS,CAAE,CAAC;IAC3B,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAwGD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAkDtE;qDACqD;AACrD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAU,CAAC;AAoDhE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAU,CAAC;AAO1E,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,cAAc,EAAE,iBAAiB,EAAE,eAAe,CAAU,CAAC;AA4C3G;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAU,CAAC;AAGvE,8CAA8C;AAC9C,qEAAqE;AACrE,kCAAkC;AAElC,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,OAAQ,WAAiC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAkCD;;qCAEqC;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,eAAe;IACf,cAAc;IACd,eAAe;IACf,cAAc;IACd,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,eAAe;CACP,CAAC;AAWX;;;qDAGqD;AACrD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAU,CAAC;AAmBjE;;;;qDAIqD;AACrD,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,IAAI;IACJ,QAAQ;IACR,SAAS;IACT,WAAW;IACX,WAAW;IACX,UAAU;CACF,CAAC;AAGX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,iBAA0B,CAAC;AACpE,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,yBAAyB,CAAU,CAAC"}

package/dist/spec/domain/model/MediaMimeAccept.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Mime-accept grammar for `MediaPurposePolicy.required`.
+ *
+ * Each entry of `required` is parsed as one of:
+ *   - a full mime type:           `"image/jpeg"`, `"image/avif"`
+ *   - a comma-list of full mimes: `"image/jpg,image/png"` (either is OK)
+ *   - a shorthand subtype:        `"webp"` → `"image/webp"`, `"jpg"` → `"image/jpeg"`
+ *
+ * Whitespace around commas and around full entries is tolerated; the
+ * grammar mirrors the HTML `<input accept="...">` attribute editors
+ * already know. Each entry yields a non-empty *acceptable mime set*
+ * for one slot. **Slot order is only used for per-slot mime coverage.
+ * Variant role (`primary` / `alternate`) is declared independently
+ * per variant by the agent; the use case enforces exactly one
+ * primary, but does not bind primary to slot 0.** This matters for
+ * back-compat: alpha.14 fixtures such as
+ * `["image/avif", "image/webp", "image/jpeg"]` declare avif at slot 0
+ * yet ship jpeg as the `<img>` fallback (`role: "primary"`).
+ *
+ * Per-asset, the agent picks ONE mime per slot from the slot's
+ * acceptable set and chooses which of those is the primary. Repeatable
+ * benefit: a `product-cover` purpose declared as
+ * `["image/jpg,image/png", "webp", "avif"]` accepts a transparent
+ * PNG primary (logos / icons) or an opaque JPEG primary (photos)
+ * under the same purpose name — no per-purpose split, no forced jpeg
+ * flatten that loses alpha.
+ *
+ * Validation:
+ *   - Each entry must yield ≥1 mime after parsing.
+ *   - Mime sets across slots MUST NOT overlap (otherwise variant→slot
+ *     mapping is ambiguous at upload-policy enforcement time).
+ *   - `maxBytes` MUST cover every expanded mime (not the literal
+ *     `required[i]` string).
+ *
+ * See aotter/mantle#282 for the motivating editor-uploads-PNG-as-
+ * transparent-asset case.
+ */
+/**
+ * Parse one `required[i]` entry into its acceptable mime set.
+ * Returns a deduped, order-preserving list (so error messages /
+ * tool descriptions show the entry the way the consumer wrote it).
+ *
+ * Throws nothing — invalid tokens are returned as-is and the
+ * validator's allowlist check flags them downstream. This keeps the
+ * parser pure data-shape; semantic validation lives one layer up.
+ */
+export declare function parseMimeAccept(entry: string): readonly string[];
+/**
+ * Expand a policy's `required` into per-slot mime sets. Slot ordering
+ * is preserved as the consumer wrote it. Variant role (primary /
+ * alternate / fallback) is declared independently per variant — see
+ * the file header. Returns a `[slot][mime]` matrix.
+ */
+export declare function expandPolicyRequired(required: readonly string[]): readonly (readonly string[])[];
+//# sourceMappingURL=MediaMimeAccept.d.ts.map

package/dist/spec/domain/model/MediaMimeAccept.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MediaMimeAccept.d.ts","sourceRoot":"","sources":["../../../../src/spec/domain/model/MediaMimeAccept.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAsBH;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAahE;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAEhC"}

package/dist/spec/domain/model/MediaMimeAccept.js

@@ -0,0 +1,90 @@
+/**
+ * Mime-accept grammar for `MediaPurposePolicy.required`.
+ *
+ * Each entry of `required` is parsed as one of:
+ *   - a full mime type:           `"image/jpeg"`, `"image/avif"`
+ *   - a comma-list of full mimes: `"image/jpg,image/png"` (either is OK)
+ *   - a shorthand subtype:        `"webp"` → `"image/webp"`, `"jpg"` → `"image/jpeg"`
+ *
+ * Whitespace around commas and around full entries is tolerated; the
+ * grammar mirrors the HTML `<input accept="...">` attribute editors
+ * already know. Each entry yields a non-empty *acceptable mime set*
+ * for one slot. **Slot order is only used for per-slot mime coverage.
+ * Variant role (`primary` / `alternate`) is declared independently
+ * per variant by the agent; the use case enforces exactly one
+ * primary, but does not bind primary to slot 0.** This matters for
+ * back-compat: alpha.14 fixtures such as
+ * `["image/avif", "image/webp", "image/jpeg"]` declare avif at slot 0
+ * yet ship jpeg as the `<img>` fallback (`role: "primary"`).
+ *
+ * Per-asset, the agent picks ONE mime per slot from the slot's
+ * acceptable set and chooses which of those is the primary. Repeatable
+ * benefit: a `product-cover` purpose declared as
+ * `["image/jpg,image/png", "webp", "avif"]` accepts a transparent
+ * PNG primary (logos / icons) or an opaque JPEG primary (photos)
+ * under the same purpose name — no per-purpose split, no forced jpeg
+ * flatten that loses alpha.
+ *
+ * Validation:
+ *   - Each entry must yield ≥1 mime after parsing.
+ *   - Mime sets across slots MUST NOT overlap (otherwise variant→slot
+ *     mapping is ambiguous at upload-policy enforcement time).
+ *   - `maxBytes` MUST cover every expanded mime (not the literal
+ *     `required[i]` string).
+ *
+ * See aotter/mantle#282 for the motivating editor-uploads-PNG-as-
+ * transparent-asset case.
+ */
+/** Shorthand → full-mime expansion. Lowercase keys; alias forms
+ *  collapse to the canonical mime (`jpg` / `jpeg` / `image/jpg` →
+ *  `image/jpeg`). */
+const SHORTHAND_TO_MIME = {
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    "image/jpg": "image/jpeg",
+    png: "image/png",
+    "image/png": "image/png",
+    webp: "image/webp",
+    "image/webp": "image/webp",
+    avif: "image/avif",
+    "image/avif": "image/avif",
+    gif: "image/gif",
+    "image/gif": "image/gif",
+    svg: "image/svg+xml",
+    "image/svg+xml": "image/svg+xml",
+    "image/svg": "image/svg+xml",
+};
+/**
+ * Parse one `required[i]` entry into its acceptable mime set.
+ * Returns a deduped, order-preserving list (so error messages /
+ * tool descriptions show the entry the way the consumer wrote it).
+ *
+ * Throws nothing — invalid tokens are returned as-is and the
+ * validator's allowlist check flags them downstream. This keeps the
+ * parser pure data-shape; semantic validation lives one layer up.
+ */
+export function parseMimeAccept(entry) {
+    const seen = new Set();
+    const out = [];
+    for (const raw of entry.split(",")) {
+        const tok = raw.trim().toLowerCase();
+        if (!tok)
+            continue;
+        const expanded = SHORTHAND_TO_MIME[tok] ?? tok;
+        if (!seen.has(expanded)) {
+            seen.add(expanded);
+            out.push(expanded);
+        }
+    }
+    return out;
+}
+/**
+ * Expand a policy's `required` into per-slot mime sets. Slot ordering
+ * is preserved as the consumer wrote it. Variant role (primary /
+ * alternate / fallback) is declared independently per variant — see
+ * the file header. Returns a `[slot][mime]` matrix.
+ */
+export function expandPolicyRequired(required) {
+    return required.map(parseMimeAccept);
+}
+//# sourceMappingURL=MediaMimeAccept.js.map

package/dist/spec/domain/model/MediaMimeAccept.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MediaMimeAccept.js","sourceRoot":"","sources":["../../../../src/spec/domain/model/MediaMimeAccept.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH;;qBAEqB;AACrB,MAAM,iBAAiB,GAAqC;IAC1D,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,YAAY;IACzB,GAAG,EAAE,WAAW;IAChB,WAAW,EAAE,WAAW;IACxB,IAAI,EAAE,YAAY;IAClB,YAAY,EAAE,YAAY;IAC1B,IAAI,EAAE,YAAY;IAClB,YAAY,EAAE,YAAY;IAC1B,GAAG,EAAE,WAAW;IAChB,WAAW,EAAE,WAAW;IACxB,GAAG,EAAE,eAAe;IACpB,eAAe,EAAE,eAAe;IAChC,WAAW,EAAE,eAAe;CAC7B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAA2B;IAE3B,OAAO,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;AACvC,CAAC"}

package/dist/spec/domain/model/RuntimePlan.d.ts

@@ -0,0 +1,94 @@
+/**
+ * The sealed plan (ADR-0032 decision 5, ADR-0034): what the CLI compiles from the manifests and Core executes.
+ * Every SQL source is already IR here, so no Worker parses SQL. Pure types and constants.
+ */
+import type { AuthorizationRequirements, JsonSchema, LocalizedText, ProcedureMcpAnnotations, ProcedureTarget, TriggerSource } from "./ManifestGrammar.js";
+import type { SqlNode, SqlPlan } from "./SqlIr.js";
+export declare const RUNTIME_PLAN_VERSION: 6;
+/** A Schema as storage and Store see it. Keys of `fields` and `names` are lower case: SQL folds unquoted identifiers. */
+export interface PlanSchema {
+    /** The name as declared: the key of `schemas` is lower case. */
+    readonly name: string;
+    readonly title?: LocalizedText;
+    readonly description?: LocalizedText;
+    /** Admin-only presentation, opaque to Core. */
+    readonly uiSchema?: Readonly<Record<string, unknown>>;
+    readonly localized?: boolean;
+    readonly scope?: string;
+    readonly ttl?: string;
+    readonly ttlSeconds?: number;
+    readonly publishing?: boolean;
+    /** column -> Mantle type: text integer real bool json timestamptz date numeric(p,s) geo */
+    readonly fields: Readonly<Record<string, string>>;
+    /** lower-cased column -> the name the JSON Schema declares */
+    readonly names: Readonly<Record<string, string>>;
+    /** The Schema's JSON Schema: Store validates the values of a write against it. */
+    readonly schema: JsonSchema;
+    /** Boolean expressions over the row's own columns, as IR. */
+    readonly checks?: readonly SqlNode[];
+    /** A translation publishes only once the parent entry that shares `on` is published (ADR-0010). Names as declared. */
+    readonly translates?: {
+        readonly parent: string;
+        readonly on: string;
+    };
+    readonly search?: readonly string[];
+    readonly unique?: readonly (readonly string[])[];
+    readonly indexes?: readonly (readonly string[])[];
+}
+export interface PlanView extends SqlPlan {
+    readonly title?: LocalizedText;
+    readonly description?: LocalizedText;
+    readonly uiSchema?: Readonly<Record<string, unknown>>;
+    /** input property -> Mantle type */
+    readonly inputs: Readonly<Record<string, string>>;
+    readonly input?: JsonSchema;
+    /** The SQL as authored, which Admin shows; the IR (`stmts`) is what runs. */
+    readonly source: string;
+    readonly surface: "public" | "staff" | "internal";
+    readonly requires?: AuthorizationRequirements;
+    /** Output name -> the Schema field it reads unchanged (`SELECT t.f`, `t.f AS f`, `*`, `created_at`) or a `sum`/`min`/`max` of it; the Store decodes these as `select` does. */
+    readonly columns?: Readonly<Record<string, {
+        readonly schema: string;
+        readonly field: string;
+    }>>;
+}
+export interface PlanProcedure {
+    readonly title?: LocalizedText;
+    readonly description?: LocalizedText;
+    readonly uiSchema?: Readonly<Record<string, unknown>>;
+    readonly input: JsonSchema;
+    readonly output: JsonSchema;
+    /** input property -> Mantle type, for an inline `sql` handler */
+    readonly inputs: Readonly<Record<string, string>>;
+    readonly requires?: AuthorizationRequirements;
+    readonly target?: ProcedureTarget;
+    readonly mcp?: ProcedureMcpAnnotations;
+    /** An inline handler carries its SQL as authored (`source`), which Admin shows; the IR is what runs. */
+    readonly handler: {
+        readonly ref: string;
+    } | {
+        readonly sql: SqlPlan;
+        readonly source: string;
+    };
+}
+export interface PlanTrigger {
+    readonly source: TriggerSource;
+    readonly procedure: string;
+}
+export interface RuntimePlan {
+    readonly version: typeof RUNTIME_PLAN_VERSION;
+    /** The dialect the SQL was compiled for (ADR-0035 decision 5); boot refuses a storage of another. */
+    readonly dialect: {
+        readonly name: string;
+        readonly version: string;
+    };
+    /** SHA-256 of the plan without this field (`planFingerprint`). */
+    readonly fingerprint: string;
+    readonly schemas: Readonly<Record<string, PlanSchema>>;
+    readonly views: Readonly<Record<string, PlanView>>;
+    readonly procedures: Readonly<Record<string, PlanProcedure>>;
+    readonly triggers: Readonly<Record<string, PlanTrigger>>;
+}
+/** The native columns a View may output that decode like a field of this type: the entry's timestamps. */
+export declare const NATIVE_OUTPUT_TYPES: Readonly<Record<string, string>>;
+//# sourceMappingURL=RuntimePlan.d.ts.map

package/dist/spec/domain/model/RuntimePlan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RuntimePlan.d.ts","sourceRoot":"","sources":["../../../../src/spec/domain/model/RuntimePlan.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,yBAAyB,EAAE,UAAU,EAAE,aAAa,EAAE,uBAAuB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1J,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAEnD,eAAO,MAAM,oBAAoB,EAAG,CAAU,CAAC;AAE/C,yHAAyH;AACzH,MAAM,WAAW,UAAU;IACzB,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC;IACrC,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,kFAAkF;IAClF,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACrC,sHAAsH;IACtH,QAAQ,CAAC,UAAU,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC;IACjD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,QAAS,SAAQ,OAAO;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,oCAAoC;IACpC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IAC9C,+KAA+K;IAC/K,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;CAClG;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,uBAAuB,CAAC;IACvC,wGAAwG;IACxG,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACjG;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,oBAAoB,CAAC;IAC9C,qGAAqG;IACrG,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE,kEAAkE;IAClE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;CAC1D;AAED,0GAA0G;AAC1G,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAA4D,CAAC"}

package/dist/spec/domain/model/RuntimePlan.js

@@ -0,0 +1,4 @@
+export const RUNTIME_PLAN_VERSION = 6;
+/** The native columns a View may output that decode like a field of this type: the entry's timestamps. */
+export const NATIVE_OUTPUT_TYPES = { created_at: "timestamptz", updated_at: "timestamptz" };
+//# sourceMappingURL=RuntimePlan.js.map

package/dist/spec/domain/model/RuntimePlan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RuntimePlan.js","sourceRoot":"","sources":["../../../../src/spec/domain/model/RuntimePlan.ts"],"names":[],"mappings":"AAOA,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAU,CAAC;AA6E/C,0GAA0G;AAC1G,MAAM,CAAC,MAAM,mBAAmB,GAAqC,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC"}

package/dist/spec/domain/model/SiteConfig.d.ts

@@ -0,0 +1,173 @@
+/**
+ * Site-level declarative contract — sibling to the manifest grammar,
+ * not part of it.
+ *
+ * The 4-atom manifest grammar (Schema/View/Procedure/Trigger) describes
+ * content types. `SiteConfig` describes deployment metadata: locales the
+ * site publishes in, brand label, the operator-visible title and
+ * description, the canonical absolute origin used for canonical URLs.
+ *
+ * Lives in `mantle-spec` (not `-runtime`) because the spec validator
+ * checks declared `siteDefaults.locales` are canonical BCP 47 at boot
+ * (see `domain/service/SiteDefaultsValidator`). The runtime operations
+ * that read/write `site_config` rows from the DB live in
+ * `mantle-runtime` — they go through the `DatabaseDriver`.
+ *
+ * Future v0.1.x: optional standalone `site.yaml` parsed via a
+ * `kind: SiteConfig` envelope sibling to the 4-atom manifest grammar.
+ * Today the consumer declares `siteDefaults` in `src/mantle/config.ts` as a
+ * TS object; either path conforms to this type.
+ */
+export interface SiteConfig {
+    /** Site title — `<title>` suffix and og:site_name. */
+    readonly title: string;
+    /** Default `<meta name="description">` when an entry has none. */
+    readonly description: string;
+    /** Canonical absolute origin (no trailing slash), e.g. `https://my-blog.com`. */
+    readonly origin: string;
+    /** All locales the site publishes in. Empty = locale subsystem off
+     *  site-wide (ADR-0010). Drives `<link rel="alternate" hreflang>`
+     *  emission only when non-empty. */
+    readonly locales: readonly string[];
+    /** Canonical locale (`locales[0]`) or `null` when locales is empty.
+     *  Templates emit `<html lang="">` only when this is non-null —
+     *  silent omission is correct for zero-locale sites, not a fake
+     *  default. */
+    readonly canonicalLocale: string | null;
+    /** Operator-facing brand label — admin chrome (sidebar header,
+     *  sign-in card). Distinct from `title` so single-tenant operators
+     *  can ship one and agencies can override the other. */
+    readonly brand: string;
+    /** One site identity shared by browser favicons, Admin chrome, and
+     *  MCP `serverInfo.icons`. Always contains at least the SDK default. */
+    readonly icons: readonly SiteIcon[];
+    /** Starter-declared media taxonomy. Empty array = no first-party
+     *  media uploads permitted; the runtime disables the
+     *  `create_media_upload` / `commit_media_upload` MCP tools and the
+     *  admin upload lifecycle on deployments that don't declare any
+     *  purpose, symmetric with "no `MediaStorage` configured". When
+     *  non-empty, `create_media_upload` rejects any `purpose` not in
+     *  this set with `MEDIA_PURPOSE_REJECTED`. */
+    readonly media: SiteMediaConfig;
+}
+/** Runtime read shape for the `media` section of `SiteConfig`. Always
+ *  present after seed; `purposes` may be empty when the consumer
+ *  didn't declare any. Each purpose carries the required mime set the
+ *  Worker enforces and the per-mime byte cap the uploader is held to. */
+export interface SiteMediaConfig {
+    readonly purposes: readonly MediaPurposePolicy[];
+}
+/**
+ * Per-purpose policy. `name` is the slug consumers reference from
+ * `create_media_upload`; `required` is the closed set of mime types
+ * the variants manifest MUST cover; `maxBytes` caps each variant's
+ * byteSize keyed by its declared mime.
+ *
+ * Optimization runs agent-side in the MCP client's runtime; the
+ * Worker only verifies the uploaded bytes match the policy. The
+ * runtime also enforces a "suspicious shape" heuristic so an uploader
+ * that ships a 200KB jpeg + a 400KB "avif" (i.e. forgot to optimize)
+ * fails closed rather than producing a `<picture>` that's slower than
+ * a plain `<img>`.
+ */
+export interface MediaPurposePolicy {
+    /** Lowercase-slug identifier; matches `MEDIA_PURPOSE_SLUG_PATTERN`. */
+    readonly name: string;
+    /**
+     * Ordered list of acceptable mime slots. Each entry uses the HTML
+     * `<input accept="...">` grammar:
+     *
+     *   - full mime:           `"image/jpeg"`, `"image/avif"`
+     *   - comma-list of mimes: `"image/jpg,image/png"` (either is OK)
+     *   - shorthand subtype:   `"webp"` → `"image/webp"`,
+     *                          `"jpg"` → `"image/jpeg"`
+     *
+     * Slot position does NOT determine variant role. Per-asset, the
+     * agent picks ONE mime per slot from that slot's acceptable set
+     * and independently declares exactly one supplied variant as
+     * `role: "primary"` (the format `<img>` falls back to); the rest
+     * are `role: "alternate"` (preferred via `<picture><source>`).
+     * This decoupling preserves back-compat with alpha.14 fixtures
+     * such as `["image/avif", "image/webp", "image/jpeg"]` that ship
+     * jpeg as primary despite avif occupying slot 0. The multi-mime
+     * slot form (e.g. `"image/jpg,image/png"`) lets a single purpose
+     * accept either jpeg-primary (photos) or png-primary (logos /
+     * transparent assets) without splitting into two purposes.
+     *
+     * Parse + expand via `parseMimeAccept` / `expandPolicyRequired`.
+     * Mime sets across slots MUST NOT overlap; `maxBytes` keys MUST
+     * cover every mime that appears in any expanded slot.
+     *
+     * See aotter/mantle#282 for the editor-uploads-transparent-PNG
+     * motivating case.
+     */
+    readonly required: readonly string[];
+    /** Per-mime byte cap, keyed by FULLY-EXPANDED mime type (e.g.
+     *  `"image/jpeg"`, not the shorthand `"jpg"`). MUST cover every
+     *  mime that appears in any slot of `required` after parsing.
+     *  Mimes outside the expanded set are ignored. The use case
+     *  rejects with `MEDIA_VARIANT_SIZE_EXCEEDED` when a variant's
+     *  declared `byteSize` exceeds its cap. */
+    readonly maxBytes: Readonly<Record<string, number>>;
+}
+/**
+ * Defaults declared by the consumer in `src/mantle/config.ts`. Operator-owned
+ * fields seed once, while deployment-owned fields (`origin`, `icons`, `locales`,
+ * and media purposes) sync on every boot. Empty / blank fields skip, preventing a
+ * partial declaration from clobbering stored values.
+ *
+ * Validated during storage preparation by `assertSiteDefaultsCanonical`; a
+ * non-canonical locale tag rejects boot rather than corrupting the seed.
+ *
+ * `SiteDefaults` is the **author-time** declaration (what the consumer
+ * writes); `SiteConfig` (above) is the **runtime read shape**
+ * (what the dispatcher and templates see after the seed has been
+ * applied and the operator has had a chance to edit). The runtime's
+ * `DatabaseSiteConfigRepository` owns that seed/load conversion; spec defines
+ * both types and the validator.
+ */
+export interface SiteDefaults {
+    readonly locales?: ReadonlyArray<string>;
+    readonly brand?: string;
+    readonly title?: string;
+    /** Default `<meta name="description">` and og:description for entries
+     *  that don't carry their own. */
+    readonly description?: string;
+    /** Canonical absolute origin (no trailing slash), e.g.
+     *  `https://my-blog.com`. The render pipeline uses this to build
+     *  absolute URLs in `/llms.txt` and the `.md` mirrors; an empty
+     *  origin produces relative URLs that are useless to off-site agent
+     *  consumers. The runtime syncs it from `src/mantle/config.ts` on every boot
+     *  so a later custom-domain change becomes canonical without a D1 edit. */
+    readonly origin?: string;
+    /** Browser / Admin / MCP icon renditions. Root-relative or absolute HTTPS. */
+    readonly icons?: ReadonlyArray<SiteIcon>;
+    /** Starter-declared media taxonomy. See `SiteConfig.media` for
+     *  runtime semantics. Omit the whole `media` key (or declare it
+     *  with an empty `purposes` array) on archetypes that don't
+     *  exercise first-party media uploads — the runtime will keep the
+     *  upload tools disabled, symmetric with "no `MediaStorage`
+     *  configured". Each purpose's `name` is slug-shaped
+     *  (`^[a-z0-9]+(-[a-z0-9]+)*$`); validated synchronously at boot. */
+    readonly media?: SiteMediaDefaults;
+}
+export interface SiteMediaDefaults {
+    readonly purposes?: ReadonlyArray<MediaPurposePolicy>;
+}
+/** MCP-compatible icon metadata, reused directly by every site surface. */
+export interface SiteIcon {
+    readonly src: string;
+    readonly mimeType?: "image/png" | "image/jpeg" | "image/svg+xml" | "image/webp";
+    readonly sizes?: ReadonlyArray<string>;
+    readonly theme?: "light" | "dark";
+}
+export declare const DEFAULT_SITE_ICONS: readonly SiteIcon[];
+/** Slug regex for `media.purposes[].name`. Matches a lowercase
+ *  alphanumeric word, optionally followed by dash-separated
+ *  alphanumeric segments — no leading/trailing dashes, no double
+ *  dashes. The R2 adapter already uses a looser variant of this for
+ *  storage-key prefixes (`/^[a-z0-9-]+$/`); spec-level validation is
+ *  stricter so admin / docs / object-store dashboards see clean
+ *  slugs. */
+export declare const MEDIA_PURPOSE_SLUG_PATTERN: RegExp;
+//# sourceMappingURL=SiteConfig.d.ts.map

package/dist/spec/domain/model/SiteConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SiteConfig.d.ts","sourceRoot":"","sources":["../../../../src/spec/domain/model/SiteConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,UAAU;IACzB,sDAAsD;IACtD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;wCAEoC;IACpC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;mBAGe;IACf,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC;;4DAEwD;IACxD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;4EACwE;IACxE,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;IACpC;;;;;;kDAM8C;IAC9C,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;CACjC;AAED;;;yEAGyE;AACzE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAClD;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;+CAK2C;IAC3C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrD;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;sCACkC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;+EAK2E;IAC3E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC;;;;;;yEAMqE;IACrE,QAAQ,CAAC,KAAK,CAAC,EAAE,iBAAiB,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CACvD;AAED,2EAA2E;AAC3E,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,YAAY,GAAG,eAAe,GAAG,YAAY,CAAC;IAChF,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CACnC;AAED,eAAO,MAAM,kBAAkB,EAAE,SAAS,QAAQ,EAGjD,CAAC;AAEF;;;;;;aAMa;AACb,eAAO,MAAM,0BAA0B,QAA6B,CAAC"}

package/dist/spec/domain/model/SiteConfig.js

@@ -0,0 +1,13 @@
+export const DEFAULT_SITE_ICONS = [
+    { src: "/admin/favicon.png", mimeType: "image/png", sizes: ["64x64"] },
+    { src: "/admin/favicon.svg", mimeType: "image/svg+xml", sizes: ["any"] },
+];
+/** Slug regex for `media.purposes[].name`. Matches a lowercase
+ *  alphanumeric word, optionally followed by dash-separated
+ *  alphanumeric segments — no leading/trailing dashes, no double
+ *  dashes. The R2 adapter already uses a looser variant of this for
+ *  storage-key prefixes (`/^[a-z0-9-]+$/`); spec-level validation is
+ *  stricter so admin / docs / object-store dashboards see clean
+ *  slugs. */
+export const MEDIA_PURPOSE_SLUG_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+//# sourceMappingURL=SiteConfig.js.map

package/dist/spec/domain/model/SiteConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SiteConfig.js","sourceRoot":"","sources":["../../../../src/spec/domain/model/SiteConfig.ts"],"names":[],"mappings":"AAyKA,MAAM,CAAC,MAAM,kBAAkB,GAAwB;IACrD,EAAE,GAAG,EAAE,oBAAoB,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE;IACtE,EAAE,GAAG,EAAE,oBAAoB,EAAE,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE;CACzE,CAAC;AAEF;;;;;;aAMa;AACb,MAAM,CAAC,MAAM,0BAA0B,GAAG,0BAA0B,CAAC"}