@caelo-cms/shared 0.10.22 → 0.10.24

package/src/genesis-inventory.ts

@@ -0,0 +1,215 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * issue #164 — design-compiler stage 1: the deterministic INVENTORY.
+ *
+ * Compiler contract (epic #149): the AI decides, code executes and
+ * verifies. This module is the "code" half of the first stage — it
+ * parses a Genesis draft (complete single-file HTML) into a fact base
+ * of design values (colors with usage contexts, font families, size /
+ * spacing / radius histograms, gradients, shadows) plus a section
+ * outline. The AI reads the inventory and makes the DECISIONS (which
+ * literal becomes which token, what things are called); it never has
+ * to re-derive facts by eyeballing raw CSS, and the facts can't be
+ * hallucinated.
+ *
+ * Pure string analysis, linear scans, unambiguous regex classes
+ * (ReDoS-aware per issue #113 — drafts are AI-authored but the parser
+ * budget must hold on adversarial input too).
+ */
+
+import { scanCssGradients } from "./css-gradient-scan.js";
+
+/** One distinct color literal with where/how often the draft uses it. */
+export interface ColorUsage {
+  readonly value: string;
+  readonly count: number;
+  /** Distinct declaration properties using it (background, color, …). */
+  readonly properties: readonly string[];
+}
+
+export interface GenesisDraftInventory {
+  readonly colors: readonly ColorUsage[];
+  readonly gradients: readonly string[];
+  readonly fontFamilies: readonly string[];
+  readonly fontSizes: readonly string[];
+  readonly spacingValues: readonly string[];
+  readonly radiusValues: readonly string[];
+  readonly shadows: readonly string[];
+  /** Ordered structural outline of the body (tag + text snippet). */
+  readonly outline: readonly { tag: string; text: string }[];
+}
+
+/** Linear extraction of every <style> block's contents. */
+export function extractDraftCss(html: string): string {
+  const parts: string[] = [];
+  const lower = html.toLowerCase();
+  let from = 0;
+  while (true) {
+    const open = lower.indexOf("<style", from);
+    if (open === -1) break;
+    const openEnd = lower.indexOf(">", open);
+    if (openEnd === -1) break;
+    const close = lower.indexOf("</style", openEnd);
+    if (close === -1) break;
+    parts.push(html.slice(openEnd + 1, close));
+    from = close + 8;
+  }
+  return parts.join("\n");
+}
+
+const DECLARATION_RE = /([a-zA-Z-]+)\s*:\s*([^;{}]+)/g;
+const COLOR_LITERAL_RE = /#[0-9a-fA-F]{3,8}\b|(?:oklch|rgba?|hsla?|lab|lch|hwb)\([^()]*\)/g;
+const LENGTH_RE = /-?\d+(?:\.\d+)?(?:rem|em|px|vh|vw|ch|%)\b/g;
+
+const SPACING_PROPS = new Set([
+  "margin",
+  "margin-top",
+  "margin-bottom",
+  "margin-left",
+  "margin-right",
+  "margin-block",
+  "margin-inline",
+  "padding",
+  "padding-top",
+  "padding-bottom",
+  "padding-left",
+  "padding-right",
+  "padding-block",
+  "padding-inline",
+  "gap",
+  "row-gap",
+  "column-gap",
+]);
+
+const GENERIC_FONT_KEYWORDS: ReadonlySet<string> = new Set([
+  "serif",
+  "sans-serif",
+  "monospace",
+  "cursive",
+  "fantasy",
+  "system-ui",
+  "ui-sans-serif",
+  "ui-serif",
+  "ui-monospace",
+]);
+
+function pushCount(map: Map<string, number>, key: string): void {
+  map.set(key, (map.get(key) ?? 0) + 1);
+}
+
+function sortedByCount(map: Map<string, number>): string[] {
+  return [...map.entries()].sort((a, z) => z[1] - a[1]).map(([k]) => k);
+}
+
+const OUTLINE_TAG_RE = /<(section|header|footer|main|nav|h1|h2|h3)\b[^>]*>/gi;
+const TAG_STRIP_RE = /<[^>]*>/g;
+
+/**
+ * Build the inventory. Caps guard pathological drafts: the boundary
+ * already limits draft size (GENESIS_DRAFT_MAX_HTML_BYTES), and each
+ * result list is truncated to what a decision-maker can actually use.
+ */
+export function inventoryGenesisDraft(html: string): GenesisDraftInventory {
+  const css = extractDraftCss(html);
+
+  const colorMeta = new Map<string, { count: number; properties: Set<string> }>();
+  const gradients = new Map<string, number>();
+  const fontFamilies = new Map<string, number>();
+  const fontSizes = new Map<string, number>();
+  const spacing = new Map<string, number>();
+  const radii = new Map<string, number>();
+  const shadows = new Map<string, number>();
+
+  for (const decl of css.matchAll(DECLARATION_RE)) {
+    const prop = (decl[1] ?? "").toLowerCase();
+    const value = (decl[2] ?? "").trim();
+
+    for (const g of scanCssGradients(value)) {
+      pushCount(gradients, g.literal);
+    }
+    // Colors inside gradients still count — a gradient stop color is a
+    // palette member the token map must name.
+    for (const c of value.matchAll(COLOR_LITERAL_RE)) {
+      const key = c[0].toLowerCase();
+      const meta = colorMeta.get(key) ?? { count: 0, properties: new Set<string>() };
+      meta.count += 1;
+      meta.properties.add(prop);
+      colorMeta.set(key, meta);
+    }
+    if (prop === "font-family") {
+      for (const fam of value.split(",")) {
+        const clean = fam.trim().replace(/^["']|["']$/g, "");
+        // Generic keywords are fallback-chain noise, not palette
+        // members — the token map names real typefaces.
+        if (
+          clean.length > 0 &&
+          clean.length < 80 &&
+          !GENERIC_FONT_KEYWORDS.has(clean.toLowerCase())
+        ) {
+          pushCount(fontFamilies, clean);
+        }
+      }
+    } else if (prop === "font-size") {
+      pushCount(fontSizes, value);
+    } else if (SPACING_PROPS.has(prop)) {
+      for (const len of value.matchAll(LENGTH_RE)) pushCount(spacing, len[0]);
+    } else if (prop === "border-radius") {
+      pushCount(radii, value);
+    } else if (prop === "box-shadow" || prop === "text-shadow") {
+      pushCount(shadows, value);
+    }
+  }
+
+  const outline: { tag: string; text: string }[] = [];
+  for (const m of html.matchAll(OUTLINE_TAG_RE)) {
+    if (outline.length >= 60) break;
+    const tag = (m[1] ?? "").toLowerCase();
+    const start = (m.index ?? 0) + m[0].length;
+    const text = html
+      .slice(start, start + 400)
+      .replace(TAG_STRIP_RE, " ")
+      .replace(/\s+/g, " ")
+      .trim()
+      .slice(0, 80);
+    outline.push({ tag, text });
+  }
+
+  return {
+    colors: [...colorMeta.entries()]
+      .sort((a, z) => z[1].count - a[1].count)
+      .slice(0, 40)
+      .map(([value, meta]) => ({
+        value,
+        count: meta.count,
+        properties: [...meta.properties].sort(),
+      })),
+    gradients: sortedByCount(gradients).slice(0, 12),
+    fontFamilies: sortedByCount(fontFamilies).slice(0, 12),
+    fontSizes: sortedByCount(fontSizes).slice(0, 24),
+    spacingValues: sortedByCount(spacing).slice(0, 24),
+    radiusValues: sortedByCount(radii).slice(0, 12),
+    shadows: sortedByCount(shadows).slice(0, 12),
+    outline,
+  };
+}
+
+/** Compact, prompt-friendly rendering of the inventory. */
+export function formatGenesisInventory(inv: GenesisDraftInventory): string {
+  const lines: string[] = [];
+  lines.push(
+    `Colors (${inv.colors.length}): ${inv.colors
+      .map((c) => `${c.value}×${c.count}[${c.properties.join("/")}]`)
+      .join(", ")}`,
+  );
+  if (inv.gradients.length > 0) lines.push(`Gradients: ${inv.gradients.join(" | ")}`);
+  lines.push(`Font families: ${inv.fontFamilies.join(", ") || "(none declared)"}`);
+  lines.push(`Font sizes: ${inv.fontSizes.join(", ")}`);
+  lines.push(`Spacing values: ${inv.spacingValues.join(", ")}`);
+  if (inv.radiusValues.length > 0) lines.push(`Radii: ${inv.radiusValues.join(", ")}`);
+  if (inv.shadows.length > 0) lines.push(`Shadows: ${inv.shadows.join(" | ")}`);
+  lines.push(
+    `Outline: ${inv.outline.map((o) => `<${o.tag}>${o.text ? ` ${o.text}` : ""}`).join(" → ")}`,
+  );
+  return lines.join("\n");
+}

package/src/genesis-sanitize.test.ts

@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * issue #199 — sanitizeDraftHtml. Adversarial per CLAUDE.md §6:
+ * operator-provided HTML becomes a stored draft that flows into
+ * materialisation, so script removal must survive casing tricks,
+ * multiple blocks, and unterminated tags.
+ */
+
+import { describe, expect, it } from "bun:test";
+import { sanitizeDraftHtml } from "./genesis.js";
+
+describe("sanitizeDraftHtml (#199)", () => {
+  it("strips script blocks, keeps everything else byte-identical", () => {
+    const html = `<html><head><style>.a{color:red}</style><script>alert(1)</script></head><body><h1>Hi</h1></body></html>`;
+    expect(sanitizeDraftHtml(html)).toBe(
+      `<html><head><style>.a{color:red}</style></head><body><h1>Hi</h1></body></html>`,
+    );
+  });
+
+  it("survives casing + attributes + multiple blocks", () => {
+    const html = `<SCRIPT src="evil.js"></SCRIPT><p>a</p><ScRiPt type="module">fetch('/x')</ScRiPt><p>b</p>`;
+    expect(sanitizeDraftHtml(html)).toBe(`<p>a</p><p>b</p>`);
+  });
+
+  it("an unterminated script drops to EOF rather than leaking half a payload", () => {
+    const html = `<p>keep</p><script>document.cookie`;
+    expect(sanitizeDraftHtml(html)).toBe(`<p>keep</p>`);
+  });
+
+  it("leaves script-free documents untouched", () => {
+    const html = `<body><section class="description">javascript is a word, &lt;script&gt; is an entity</section></body>`;
+    expect(sanitizeDraftHtml(html)).toBe(html);
+  });
+});

package/src/genesis.ts

@@ -0,0 +1,158 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * issue #163 — Site Genesis shared shapes; issue #375 generalises the
+ * same draft loop to growth-time.
+ *
+ * Design-time is divergent: the AI drafts complete freeform HTML pages
+ * (one per design direction) and the operator picks one; the CMS
+ * structure is derived FROM that choice (#164's compiler). Growth-time
+ * reuses the identical draft → present → select → materialise loop at
+ * smaller scope: `page` and `module` drafts are FRAGMENTS bound to the
+ * site's `var(--…)` theme tokens, composed into the real theme shell
+ * only at view time (never an AI approximation of the theme — #375).
+ * These are the boundary schemas for the brief + the draft rows.
+ */
+
+import { z } from "zod";
+
+/**
+ * The structured Design Brief the discovery dialog produces. Every
+ * field optional — the AI fills what the conversation answered; the
+ * draft prompts degrade gracefully on gaps. Stored on
+ * `site_defaults.design_brief`.
+ */
+export const designBriefSchema = z
+  .object({
+    audience: z.string().min(1).max(500).optional(),
+    /** 3–5 adjectives the operator wants the design to feel like. */
+    moodWords: z.array(z.string().min(1).max(40)).max(12).optional(),
+    tone: z.string().min(1).max(300).optional(),
+    industry: z.string().min(1).max(200).optional(),
+    differentiators: z.string().min(1).max(1000).optional(),
+    imageryDirection: z.string().min(1).max(500).optional(),
+    avoid: z.string().min(1).max(500).optional(),
+  })
+  .strict();
+export type DesignBrief = z.infer<typeof designBriefSchema>;
+
+/** Complete single-file drafts stay well under this (inline CSS only). */
+export const GENESIS_DRAFT_MAX_HTML_BYTES = 300_000;
+
+export const genesisDraftStatus = z.enum(["candidate", "selected", "discarded"]);
+export type GenesisDraftStatus = z.infer<typeof genesisDraftStatus>;
+
+/** issue #199 — where a draft came from. */
+export const genesisDraftSourceKind = z.enum(["genesis", "byod_image", "byod_html"]);
+export type GenesisDraftSourceKind = z.infer<typeof genesisDraftSourceKind>;
+
+/**
+ * issue #375 — what a draft covers. `site` is the Genesis case (a whole
+ * new design); `page` / `module` are growth-time variants of something
+ * that already exists.
+ */
+export const designDraftScope = z.enum(["site", "page", "module"]);
+export type DesignDraftScope = z.infer<typeof designDraftScope>;
+
+/**
+ * issue #375 — how a draft's HTML is stored. `site` drafts are complete
+ * standalone documents (Genesis, unchanged); `page`/`module` drafts are
+ * fragments that only become a renderable document when composed with
+ * the site's real theme shell at view time — so a stored variant never
+ * freezes a stale copy of the theme.
+ */
+export const designDraftFormat = z.enum(["document", "fragment"]);
+export type DesignDraftFormat = z.infer<typeof designDraftFormat>;
+
+/** The stored format is fully determined by the scope (see the paired
+ *  DB CHECK constraint): `site` → standalone document, else fragment. */
+export function draftFormatForScope(scope: DesignDraftScope): DesignDraftFormat {
+  return scope === "site" ? "document" : "fragment";
+}
+
+const addDraftBase = z
+  .object({
+    /** Human-readable design direction ("bold editorial"). */
+    direction: z.string().min(3).max(120),
+    /** Why this direction fits the brief — shown beside the preview. */
+    rationale: z.string().max(1000).default(""),
+    /** Site scope: complete self-contained single-file HTML. Page/module
+     *  scope: an HTML fragment bound to the site's `var(--…)` tokens. */
+    html: z.string().min(200).max(GENESIS_DRAFT_MAX_HTML_BYTES),
+    /** issue #375 — what this draft covers; `site` is the Genesis case. */
+    scope: designDraftScope.default("site"),
+    /** issue #375 — page scope: the page this variant redesigns. Module
+     *  scope: optional page context for "this module as used on …". */
+    targetPageId: z.string().uuid().optional(),
+    /** issue #375 — module scope: the module this variant restyles. */
+    targetModuleId: z.string().uuid().optional(),
+    /** issue #375 — groups one request's variants into one comparison.
+     *  Omit on the first save (the op mints and returns it); pass it on
+     *  every sibling save of the same round. */
+    variantSetId: z.string().uuid().optional(),
+    /** issue #199 — 'byod_image' (AI reproduction of an operator
+     *  mockup) / 'byod_html' (operator HTML, sanitised at the op). */
+    sourceKind: genesisDraftSourceKind.default("genesis"),
+    /** issue #199 — byod_image only: the uploaded mockup's media
+     *  asset. The parity gate uses THIS image as the reference. */
+    referenceAssetId: z.string().uuid().optional(),
+  })
+  .strict();
+
+/** Scope/target pairing rules shared by the op and the AI tool. */
+export const genesisAddDraftInput = addDraftBase.superRefine((v, ctx) => {
+  if (v.scope === "site") {
+    if (v.targetPageId !== undefined || v.targetModuleId !== undefined) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "site-scope drafts take no target — drop targetPageId/targetModuleId",
+      });
+    }
+  } else if (v.sourceKind !== "genesis") {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message:
+        "byod drafts are site-scope only (issue #199); growth-time variants use sourceKind 'genesis'",
+    });
+  } else if (v.scope === "page") {
+    if (v.targetPageId === undefined || v.targetModuleId !== undefined) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "page-scope drafts need targetPageId (and no targetModuleId)",
+      });
+    }
+  } else if (v.targetModuleId === undefined) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "module-scope drafts need targetModuleId (targetPageId is optional page context)",
+    });
+  }
+});
+export type GenesisAddDraftInput = z.infer<typeof genesisAddDraftInput>;
+
+/**
+ * issue #199 — strip <script> blocks from operator-provided draft
+ * HTML. Defense in depth: drafts render inside sandbox="" iframes
+ * (scripts never execute there), but stored HTML flows onward into
+ * materialisation, so the boundary removes them outright. Linear
+ * scan per the #113 discipline; case-insensitive; unterminated
+ * script blocks drop everything to EOF (never leak half a script).
+ */
+export function sanitizeDraftHtml(html: string): string {
+  const lower = html.toLowerCase();
+  let out = "";
+  let from = 0;
+  while (true) {
+    const open = lower.indexOf("<script", from);
+    if (open === -1) {
+      out += html.slice(from);
+      return out;
+    }
+    out += html.slice(from, open);
+    const close = lower.indexOf("</script", open);
+    if (close === -1) return out;
+    const closeEnd = lower.indexOf(">", close);
+    if (closeEnd === -1) return out;
+    from = closeEnd + 1;
+  }
+}

package/src/i18n.test.ts

@@ -0,0 +1,58 @@
+// SPDX-License-Identifier: MPL-2.0
+
+import { describe, expect, it } from "bun:test";
+import { computeContentHash, isHomeSlug, pageIsLocaleHome } from "./i18n.js";
+
+describe("isHomeSlug", () => {
+  it("recognises the magic-slug sentinels regardless of surrounding slashes", () => {
+    for (const s of ["", "home", "index", "/", "/home/", "/index"]) {
+      expect(isHomeSlug(s)).toBe(true);
+    }
+  });
+
+  it("treats any other slug as non-home", () => {
+    for (const s of ["about", "en", "blog/post", "homepage"]) {
+      expect(isHomeSlug(s)).toBe(false);
+    }
+  });
+});
+
+describe("pageIsLocaleHome (0184 shared predicate)", () => {
+  const PAGE = "11111111-1111-4111-8111-111111111111";
+  const OTHER = "22222222-2222-4222-8222-222222222222";
+
+  it("is true when the page IS the locale's designated home_page_id", () => {
+    expect(pageIsLocaleHome(PAGE, "en", PAGE)).toBe(true);
+  });
+
+  it("is true for a magic slug even with no designation", () => {
+    expect(pageIsLocaleHome(PAGE, "home", null)).toBe(true);
+    expect(pageIsLocaleHome(PAGE, "index", undefined)).toBe(true);
+  });
+
+  it("is false for a non-magic slug that isn't the designated page", () => {
+    expect(pageIsLocaleHome(PAGE, "en", OTHER)).toBe(false);
+    expect(pageIsLocaleHome(PAGE, "about", null)).toBe(false);
+  });
+});
+
+describe("computeContentHash", () => {
+  it("is stable across runs for the same input", async () => {
+    const a = await computeContentHash({ x: 1, y: [1, 2] });
+    const b = await computeContentHash({ x: 1, y: [1, 2] });
+    expect(a).toBe(b);
+    expect(a).toMatch(/^[0-9a-f]{64}$/);
+  });
+
+  it("is order-independent for object keys", async () => {
+    const a = await computeContentHash({ x: 1, y: 2 });
+    const b = await computeContentHash({ y: 2, x: 1 });
+    expect(a).toBe(b);
+  });
+
+  it("is order-dependent for arrays", async () => {
+    const a = await computeContentHash({ x: [1, 2] });
+    const b = await computeContentHash({ x: [2, 1] });
+    expect(a).not.toBe(b);
+  });
+});

package/src/i18n.ts

@@ -0,0 +1,91 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * Slug/URL primitives shared between the static generator, the preview
+ * op, and the admin UI. Epic #380 Phase A (#383): locale URL shaping
+ * (resolveLocaleUrl, buildHreflangLinks) is deleted — URL shape beyond
+ * base + slug becomes a plugin contribution on the URL composition
+ * point (#390). What survives until the page-identity cut (#384):
+ *
+ *   isHomeSlug / pageIsLocaleHome — the home-decision predicate.
+ *   computeContentHash — drives `pages.content_hash` (removed in #384).
+ *   trimSlashes / trimTrailingSlashes — linear-scan slug hygiene.
+ */
+
+const TEXT_ENCODER = new TextEncoder();
+
+/**
+ * Strip leading and trailing `/` characters with a single linear scan.
+ *
+ * Replaces the regex `/^\/+|\/+$/g`, whose trailing-slash branch
+ * backtracks O(n²) on a long run of slashes that is not at end-of-string
+ * (CodeQL js/polynomial-redos). This char-index walk is unconditionally
+ * linear and produces byte-identical output for every input.
+ */
+export function trimSlashes(s: string): string {
+  let start = 0;
+  let end = s.length;
+  while (start < end && s.charCodeAt(start) === 47 /* '/' */) start += 1;
+  while (end > start && s.charCodeAt(end - 1) === 47 /* '/' */) end -= 1;
+  return s.slice(start, end);
+}
+
+/**
+ * Strip only trailing `/` characters with a single linear scan — the
+ * non-backtracking replacement for `/\/+$/` (same ReDoS class as above).
+ * Used for base URLs, which carry a scheme and must keep their leading
+ * characters.
+ */
+export function trimTrailingSlashes(s: string): string {
+  let end = s.length;
+  while (end > 0 && s.charCodeAt(end - 1) === 47 /* '/' */) end -= 1;
+  return s.slice(0, end);
+}
+
+/**
+ * The "magic slug" sentinel test: a page whose slug is empty, `home`,
+ * or `index` is the locale root by convention even without an explicit
+ * `locales.home_page_id` designation. Leading/trailing slashes are
+ * ignored so `/home/` reads the same as `home`.
+ */
+export function isHomeSlug(slug: string): boolean {
+  const s = trimSlashes(slug);
+  return s === "" || s === "home" || s === "index";
+}
+
+/**
+ * The single home-decision predicate every URL/output-path site must
+ * use so canonical, hreflang, redirects, and the emitted file agree
+ * (0184 explicit-homepage feature). A page is the locale root when it
+ * IS the locale's designated `home_page_id` OR carries a magic slug.
+ *
+ * @param pageId            The page being resolved.
+ * @param slug              That page's slug.
+ * @param localeHomePageId  `locales.home_page_id` for the page's locale
+ *                          (null/undefined when no page is designated).
+ */
+export function pageIsLocaleHome(
+  pageId: string,
+  slug: string,
+  localeHomePageId: string | null | undefined,
+): boolean {
+  return (localeHomePageId != null && pageId === localeHomePageId) || isHomeSlug(slug);
+}
+
+/**
+ * Canonical-JSON serializer + sha256 → hex. Stable across runs because
+ * keys are sorted. The output is used for `pages.content_hash` so that
+ * a Mode-2 translation can detect whether its source has changed.
+ */
+export async function computeContentHash(value: unknown): Promise<string> {
+  const canonical = JSON.stringify(value, (_key, val) => {
+    if (val && typeof val === "object" && !Array.isArray(val)) {
+      const sorted: Record<string, unknown> = {};
+      for (const k of Object.keys(val).sort()) sorted[k] = (val as Record<string, unknown>)[k];
+      return sorted;
+    }
+    return val;
+  });
+  const digest = await crypto.subtle.digest("SHA-256", TEXT_ENCODER.encode(canonical));
+  return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+}

package/src/index.test.ts

@@ -0,0 +1,10 @@
+// SPDX-License-Identifier: MPL-2.0
+
+import { describe, expect, it } from "bun:test";
+import { PROJECT_NAME } from "./index.js";
+
+describe("shared scaffold", () => {
+  it("exports the project name", () => {
+    expect(PROJECT_NAME).toBe("caelo-cms");
+  });
+});

package/src/index.ts

@@ -0,0 +1,59 @@
+// SPDX-License-Identifier: MPL-2.0
+
+export const PROJECT_NAME = "caelo-cms";
+
+export * from "./ai-tools.js";
+export * from "./auth-forms.js";
+export * from "./base-css.js";
+export * from "./build-page.js";
+export * from "./cap-failures.js";
+export * from "./content.js";
+export * from "./context.js";
+export * from "./css-gradient-scan.js";
+export * from "./css-var-scan.js";
+export * from "./design-draft-shell.js";
+export * from "./design-manifest.js";
+export * from "./fonts.js";
+export * from "./genesis.js";
+export * from "./genesis-inventory.js";
+export * from "./i18n.js";
+export * from "./interactions.js";
+export {
+  type LogContext,
+  type Logger,
+  type LoggerOptions,
+  type LogLevel,
+  makeLogger,
+  mintRequestId,
+  redact,
+  type ServiceName,
+  type StructuredLogEntry,
+} from "./logger.js";
+export * from "./media.js";
+export * from "./page-log.js";
+export * from "./preview-compose.js";
+export * from "./preview-scanner.js";
+export * from "./proposal-status.js";
+export * from "./responsive-images.js";
+export * from "./result.js";
+export * from "./safe-keys.js";
+export * from "./seo.js";
+export * from "./skills.js";
+export * from "./snapshots.js";
+export * from "./strip-cdata.js";
+export * from "./structured-sets.js";
+export * from "./subagents.js";
+export * from "./template-engine.js";
+export * from "./theme-importers/auto-detect.js";
+export * from "./theme-importers/dtcg.js";
+export * from "./theme-importers/loose.js";
+export * from "./theme-importers/shadcn.js";
+export * from "./theme-importers/style-dictionary.js";
+export * from "./theme-importers/tailwind.js";
+export * from "./theme-literal-binding.js";
+export * from "./theme-normalize.js";
+export * from "./theme-ramp.js";
+export * from "./theme-render.js";
+export * from "./themes.js";
+export * from "./themes-errors.js";
+export { CAELO_VERSION, CALEO_VERSION, type CaeloVersion, parseVersion } from "./version.js";

package/src/interactions.ts

@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * issue #160 — the vetted interaction baseline (epic #149).
+ *
+ * A header without a working mobile menu reads as broken, not minimal
+ * — and hand-rolled per-module JS gets focus/aria handling wrong more
+ * often than right. This module carries the FUNCTIONAL (non-aesthetic)
+ * CSS + JS for the built-in nav renderer: hamburger toggle under the
+ * mobile breakpoint, `aria-expanded` bookkeeping, escape-to-close.
+ * All colors/spacing stay the module/theme's business — these rules
+ * only govern show/hide behaviour, so they don't violate the
+ * no-global-look re-scope (#151).
+ *
+ * The composer includes each asset ONCE per page when at least one
+ * nav-menu module rendered (natural dedup, same rule as #158).
+ */
+
+/** Functional-only rules: collapse/expand mechanics, zero aesthetics. */
+export const NAV_FUNCTIONAL_CSS =
+  ".caelo-nav-menu .caelo-nav-toggle{display:none;background:none;border:0;cursor:pointer;padding:0.5rem;color:inherit;font:inherit}" +
+  ".caelo-nav-menu .caelo-nav-toggle .caelo-nav-bar{display:block;width:1.25em;height:2px;background:currentColor;margin:0.25em 0}" +
+  "@media (max-width: 720px){" +
+  ".caelo-nav-menu .caelo-nav-toggle{display:inline-block}" +
+  ".caelo-nav-menu > ul{display:none}" +
+  '.caelo-nav-menu[data-nav-open="true"] > ul{display:block}' +
+  "}";
+
+/**
+ * Toggle behaviour. Runs deferred; idempotent per element via the
+ * data attribute; closes on Escape and returns focus to the toggle.
+ */
+export const NAV_TOGGLE_JS =
+  "(function(){" +
+  "document.querySelectorAll('.caelo-nav-menu').forEach(function(nav){" +
+  "var btn=nav.querySelector('.caelo-nav-toggle');if(!btn)return;" +
+  "btn.addEventListener('click',function(){" +
+  "var open=nav.getAttribute('data-nav-open')==='true';" +
+  "nav.setAttribute('data-nav-open',String(!open));" +
+  "btn.setAttribute('aria-expanded',String(!open));" +
+  "});" +
+  "nav.addEventListener('keydown',function(e){" +
+  "if(e.key==='Escape'&&nav.getAttribute('data-nav-open')==='true'){" +
+  "nav.setAttribute('data-nav-open','false');" +
+  "btn.setAttribute('aria-expanded','false');btn.focus();" +
+  "}});" +
+  "});" +
+  "})();";