@drawnagency/primitives 0.1.118 → 0.1.119

package/src/document/engine/settings.ts

@@ -1,125 +0,0 @@
-import { z } from "zod";
-
-// Presentation settings for one link-heading chunk. This shape is designed as
-// if it were already a portal page's `document` options block — migrating it
-// into the portal later must be a data move, not a redesign.
-export const sectionSettingsSchema = z.object({
-  excluded: z.boolean().default(false),
-  textPlacement: z.enum(["top", "leftColumn"]).default("top"),
-  // "right" is only meaningful with textPlacement "leftColumn"; settingsFor
-  // normalizes the invalid combo.
-  imagePlacement: z.enum(["fullWidth", "right"]).default("fullWidth"),
-  // When true, text that overflows the first page is dropped instead of
-  // flowing onto Cont. pages (images still paginate normally).
-  dropTextOverflow: z.boolean().default(false),
-  // Also start new pages at sub-heading boundaries. Only read from PARENT
-  // entries (link_heading ids / __preamble); inert on sub-chunk entries.
-  splitAt: z.enum(["none", "sub_heading"]).default("none"),
-  imageLayout: z
-    .discriminatedUnion("mode", [
-      z.object({
-        mode: z.literal("grid"),
-        rows: z.union([z.literal(1), z.literal(2), z.literal(3)]).default(2),
-        columns: z.union([z.literal(2), z.literal(3), z.literal(4)]).default(4),
-        // "cover" crops each image to its cell; "contain" letterboxes the
-        // natural image inside it.
-        fit: z.enum(["cover", "contain"]).default("cover"),
-      }),
-      z.object({
-        mode: z.literal("masonry"),
-        flow: z.enum(["rows", "columns"]).default("rows"),
-        columns: z
-          .union([z.literal(2), z.literal(3), z.literal(4), z.literal(5), z.literal(6)])
-          .default(3),
-        // rows flow only: "auto" = greedy target-height fill (legacy behavior);
-        // 1-4 forces an exact aspect-balanced row count.
-        rows: z
-          .union([z.literal("auto"), z.literal(1), z.literal(2), z.literal(3), z.literal(4)])
-          .default("auto"),
-      }),
-    ])
-    .default({ mode: "masonry", flow: "rows", columns: 3, rows: "auto" }),
-});
-
-export type SectionSettings = z.infer<typeof sectionSettingsSchema>;
-
-const DEFAULTS: SectionSettings = sectionSettingsSchema.parse({});
-
-/**
- * Field-by-field salvage. The whole-entry `safeParse` fallback was
- * all-or-nothing: ONE unrecognised value discarded every sibling setting, and
- * since the defaults have `excluded: false`, a section deliberately excluded
- * from the printed document silently reappeared in the output. `splitAt` was
- * lost the same way. An index written by a newer package version — or by an MCP
- * agent — is the realistic source of such a value.
- */
-function salvage(raw: unknown): { settings: SectionSettings; rejected: string[] } {
-  const fast = sectionSettingsSchema.safeParse(raw ?? {});
-  if (fast.success) return { settings: fast.data, rejected: [] };
-  // Not an object at all (stale scalar, null): nothing to salvage.
-  if (!raw || typeof raw !== "object") return { settings: DEFAULTS, rejected: [] };
-
-  const src = raw as Record<string, unknown>;
-  const out: Record<string, unknown> = {};
-  const rejected: string[] = [];
-  for (const [key, field] of Object.entries(sectionSettingsSchema.shape)) {
-    // Every field carries a .default(), so an absent key parses to its default.
-    const parsed = (field as z.ZodTypeAny).safeParse(src[key]);
-    if (parsed.success) {
-      out[key] = parsed.data;
-    } else {
-      rejected.push(key);
-      out[key] = DEFAULTS[key as keyof SectionSettings];
-    }
-  }
-  return { settings: out as SectionSettings, rejected };
-}
-
-// Overlay lookup: unknown/stale/malformed entries fall back to defaults —
-// settings for a deleted portal section must be inert, never fatal.
-export function settingsFor(
-  all: Record<string, unknown> | undefined,
-  chunkId: string,
-): SectionSettings {
-  const s = salvage(all?.[chunkId]).settings;
-  if (s.textPlacement === "top" && s.imagePlacement === "right") {
-    return { ...s, imagePlacement: "fullWidth" };
-  }
-  return s;
-}
-
-/** Setting names for `chunkId` that failed to parse and were reset to their
- *  default. Surfaced as document warnings so a silent reset is visible. */
-export function settingsIssuesFor(
-  all: Record<string, unknown> | undefined,
-  chunkId: string,
-): string[] {
-  return salvage(all?.[chunkId]).rejected;
-}
-
-const documentMetaSchema = z.object({
-  client: z.string().default(""),
-  project: z.string().default(""),
-  dateLabel: z.string().default(""),
-});
-const documentCoverSchema = z.object({
-  bgColor: z.string().default("#333333"),
-  accentColor: z.string().default("#EB9500"),
-  title: z.string().default(""),
-  label: z.string().default("BRAND GUIDELINES"),
-  date: z.string().default(""),
-  // Media-library image id shown between masthead and title lockup; null = solid cover.
-  imageId: z.string().nullable().default(null),
-});
-
-export const documentOptionsSchema = z.object({
-  enabled: z.boolean().default(false),
-  // `.default({})` doesn't typecheck even though `{}` parses fine at
-  // runtime — zod v4 infers the default's type from the object schema's
-  // required input shape, not its post-default output shape.
-  meta: documentMetaSchema.default(() => documentMetaSchema.parse({})),
-  cover: documentCoverSchema.default(() => documentCoverSchema.parse({})),
-  sections: z.record(z.string(), sectionSettingsSchema).default({}),
-});
-export type DocumentOptions = z.infer<typeof documentOptionsSchema>;
-export type DocCover = DocumentOptions["cover"];

package/src/document/engine/types.ts

@@ -1,64 +0,0 @@
-// Engine-local structural types for portal content. Deliberately NOT imported
-// from the rest of @drawnagency/primitives: the engine's contract is the
-// portal content SHAPE, and staying import-free keeps it portable into its
-// own package later.
-// (The fixture test in tests/document/fixture.test.ts pins the shape against
-// the real primitives schemas so drift is caught.)
-
-export const PREAMBLE_ID = "__preamble";
-
-// Page-split boundary level for one parent section. Sub-headings are the
-// deepest deck boundary (internal convention, 2026-07-19) — sub_sub_heading
-// sections always stay in-page as level-3 text blocks.
-export type SplitAt = "none" | "sub_heading";
-
-// Breadcrumb metadata shown in the page chrome. Single definition — the
-// harness carried this shape in two places (deck/DeckPage.tsx's `DeckMeta`
-// and lib/deck/schema.ts's zod-inferred `DeckMeta`); the engine only needs
-// the plain type, not a schema, so it lives here once.
-export interface DocMeta {
-  client: string;
-  project: string;
-  dateLabel: string;
-}
-
-export interface DocSectionInput {
-  id: string;
-  type: string;
-  content: Record<string, unknown>;
-  options?: Record<string, unknown>;
-}
-
-// One displayable image, dimensions + pre-chosen repo filenames baked in by
-// the (scaffolding) fetch layer so the engine never touches the manifest.
-export interface DocImage {
-  imageId: string;
-  width: number;
-  height: number;
-  alt: string;
-  previewFile: string; // e.g. "1080.webp" — editor variant
-  printFile: string;   // e.g. "1920.webp" — print/PDF variant
-}
-
-export type TextBlock =
-  | { kind: "heading"; level: 2 | 3; text: string }
-  | { kind: "prose"; html: string };
-
-// A page-producing chunk: a link_heading section (or the preamble), or — when
-// the parent's splitAt says so — a sub heading section.
-export interface Chunk {
-  id: string; // boundary heading's section id, or PREAMBLE_ID
-  title: string;
-  textBlocks: TextBlock[];
-  images: DocImage[];
-  // Sub-chunk fields; absent on top-level chunks.
-  parentId?: string;
-  kicker?: string; // masthead context line — the parent link_heading title
-  depth?: 1;
-}
-
-export interface DocSourceContent {
-  pageTitle: string;
-  sections: DocSectionInput[];
-  images: Record<string, DocImage>;
-}

package/src/document/index.ts

@@ -1,18 +0,0 @@
-// Public surface of the document engine + components. Sealed subtree: nothing
-// in document/ imports from the rest of primitives (see spec — extraction to
-// @drawnagency/document must stay a directory move).
-export * from "./engine/types";
-export * from "./engine/settings";
-export { splitProseBlocks } from "./engine/blocks";
-export { harvest } from "./engine/harvest";
-export * from "./engine/paginate";
-export { layoutMasonryPage, type MasonryOpts, type Sized } from "./engine/masonry";
-
-export { DocPage, type DocMeta } from "./components/DocPage";
-export { DocSectionPage, type DocHost } from "./components/DocSectionPage";
-export { DocCoverPage } from "./components/DocCoverPage";
-export { useDocPages } from "./components/useDocPages";
-
-// Task 3 — shared document shell (presentation + editing).
-export { DocViewer } from "./components/DocViewer";
-export { DocRail, entryId, type RailEntry } from "./components/DocRail";

package/src/document/styles/document.css

@@ -1,217 +0,0 @@
-/* Document artifact rendering — physical units only. This file styles the
-   artifact itself (editor canvas AND print route), so no Tailwind utilities
-   and no viewport-relative units. 11×17 tabloid landscape = 17in × 11in. */
-
-/* ---- Drawn brand fonts ---------------------------------------------- */
-/* Albra Grotesk (sans body) · Kapra Neue Expanded (uppercase labels).
-   Self-hosted, resolved relative to this file so bundlers can locate them
-   without a public root. */
-@font-face {
-  font-family: "Albra Grotesk";
-  src: url("../assets/fonts/albra-grotesk-regular.woff") format("woff");
-  font-weight: 400;
-  font-style: normal;
-  font-display: swap;
-}
-@font-face {
-  font-family: "Albra Grotesk";
-  src: url("../assets/fonts/albra-grotesk-bold.woff") format("woff");
-  font-weight: 600;
-  font-style: normal;
-  font-display: swap;
-}
-@font-face {
-  font-family: "Kapra Neue Expanded";
-  src: url("../assets/fonts/kapra-neue-expanded-regular.woff") format("woff");
-  font-weight: 400;
-  font-style: normal;
-  font-display: swap;
-}
-@font-face {
-  font-family: "Kapra Neue Expanded";
-  src: url("../assets/fonts/kapra-neue-expanded-medium.woff") format("woff");
-  font-weight: 700;
-  font-style: normal;
-  font-display: swap;
-}
-
-/* ---- page chrome ------------------------------------------------------ */
-
-.deck-page {
-  position: relative;
-  width: 17in;
-  height: 11in;
-  background: #fff;
-  color: #1a1a1a;
-  overflow: hidden;
-}
-
-.deck-chrome {
-  position: absolute;
-  top: 0.5in;
-  left: 0.6in;
-  right: 0.6in;
-  display: flex;
-  align-items: flex-end;
-  justify-content: space-between;
-  border-bottom: 1px solid #1a1a1a;
-  padding-bottom: 0.1in;
-  z-index: 10;
-}
-
-.deck-crumb {
-  font-family: "Kapra Neue Expanded", Helvetica, Arial, sans-serif;
-  font-size: 9pt;
-  letter-spacing: 0.12em;
-  text-transform: uppercase;
-}
-
-/* The wordmark SVG's viewBox includes an under-swash flourish below the
-   letters' baseline. The clip wrapper truncates the glyph so the hairline
-   rule slices INTO the letter bottoms (per the reference deck): the cut
-   falls at ~viewBox y=100.5 of 154.474 (0.407 / 0.625), removing the
-   under-swash, the D's descender loop, and the rounded letter bottoms.
-   The negative margin cancels .deck-chrome's padding-bottom so the cut
-   edge lands exactly on the rule, while the breadcrumb keeps its normal
-   gap above the rule. */
-.deck-wordmark-clip {
-  height: 0.407in;
-  overflow: hidden;
-  margin-bottom: -0.1in;
-}
-
-.deck-wordmark {
-  height: 0.625in;
-  width: auto;
-  display: block;
-}
-
-.deck-body {
-  position: absolute;
-  top: 1.35in;
-  left: 0.6in;
-  right: 0.6in;
-  bottom: 0.6in;
-}
-
-/* Bleed layouts (cover) paint the whole page; chrome layers above via
-   .deck-chrome's z-index — layering only, chrome treatment is untouched. */
-.deck-bleed {
-  position: absolute;
-  inset: 0;
-}
-
-/* ---- title card (document cover) --------------------------------------- */
-
-.layout-titlecard {
-  position: absolute;
-  inset: 0;
-  color: #fff;
-}
-.layout-titlecard__masthead {
-  position: absolute;
-  top: 0.5in;
-  left: 0.6in;
-  right: 0.6in;
-  display: flex;
-  align-items: center;
-  gap: 0.3in;
-}
-.layout-titlecard__wordmark { height: 0.4in; width: auto; color: #fff; flex: none; }
-.layout-titlecard__rule { flex: 1; height: 1px; background: #fff; }
-/* Optional cover image: the band between the masthead rule (~1.1in) and the
-   title lockup (~3.2in from the page bottom). Image is 50% of the band's
-   height, natural aspect ratio, left-aligned to the content margin, its
-   center anchored at 45% of the band (top 20% + half of 50%). */
-.layout-titlecard__image {
-  position: absolute;
-  top: 1.1in;
-  bottom: 3.2in;
-  left: 0.6in;
-  right: 0.6in;
-}
-.layout-titlecard__image img {
-  position: absolute;
-  top: 20%;
-  left: 0;
-  height: 50%;
-  width: auto;
-  max-width: 100%;
-  object-fit: contain;
-}
-.layout-titlecard__lockup {
-  position: absolute;
-  left: 0.6in;
-  bottom: 1.1in;
-  right: 0.6in;
-}
-.layout-titlecard__title {
-  font-family: "Kapra Neue Expanded", Helvetica, Arial, sans-serif;
-  font-size: 40pt;
-  letter-spacing: 0.14em;
-  text-transform: uppercase;
-  margin: 0 0 0.25in;
-}
-.layout-titlecard__titlerule { display: block; width: 100%; height: 1px; margin-bottom: 0.18in; }
-.layout-titlecard__label {
-  font-family: "Kapra Neue Expanded", Helvetica, Arial, sans-serif;
-  font-size: 10pt;
-  letter-spacing: 0.12em;
-  text-transform: uppercase;
-  margin: 0;
-}
-.layout-titlecard__date {
-  font-family: "Kapra Neue Expanded", Helvetica, Arial, sans-serif;
-  font-size: 10pt;
-  letter-spacing: 0.12em;
-  text-transform: uppercase;
-  margin: 0.04in 0 0;
-}
-
-/* ---- document pages ----------------------------------------------------- */
-
-.pdoc-title {
-  font-family: "Kapra Neue Expanded", Helvetica, Arial, sans-serif;
-  font-size: 22pt;
-  letter-spacing: 0.04em;
-  text-transform: uppercase;
-  margin: 0;
-  height: 0.9in; /* = DOC_GEOM.titleBandIn; keep in sync */
-}
-/* Sub-page context line inside the title band (uppercase inherits from
-   .pdoc-title). Sized to sit with the title within the fixed 0.9in band. */
-.pdoc-kicker {
-  display: block;
-  font-size: 9pt;
-  letter-spacing: 0.12em;
-  color: #999999;
-  margin-bottom: 0.05in;
-}
-.pdoc-text { position: absolute; }
-.pdoc-h2, .pdoc-h3 {
-  font-family: "Kapra Neue Expanded", Helvetica, Arial, sans-serif;
-  text-transform: uppercase;
-  letter-spacing: 0.04em;
-  line-height: 1.3;
-  margin: 0;
-}
-.pdoc-h2 { font-size: 14pt; }
-.pdoc-h3 { font-size: 11pt; letter-spacing: 0.08em; }
-.pdoc-prose {
-  font-family: "Albra Grotesk", Helvetica, Arial, sans-serif;
-  font-size: 12.5pt;
-  line-height: 1.55;
-  margin: 0;
-}
-/* Self-contained prose: renders identically with or without Tailwind
-   preflight. The editor loads preflight but the /print route and the
-   hidden measurer do not, so pin every element the upstream sanitizer
-   allows to zero margins and give lists explicit markers — otherwise
-   measured heights (and page counts) diverge across surfaces. */
-.pdoc-prose :where(p, ul, ol, li, blockquote, h1, h2, h3, h4, h5, h6, pre, hr) { margin: 0; }
-.pdoc-prose ul { list-style: disc; }
-.pdoc-prose ol { list-style: decimal; }
-.pdoc-prose ul, .pdoc-prose ol { padding-left: 0.25in; }
-.pdoc-img { position: absolute; overflow: hidden; }
-.pdoc-img img { width: 100%; height: 100%; display: block; }
-.pdoc-measure { position: fixed; left: -10000px; top: 0; visibility: hidden; pointer-events: none; }

package/src/lib/deck-access.ts

@@ -1,132 +0,0 @@
-import type { DeckOwner } from "../schemas/deck-meta";
-
-/**
- * Who is asking. Built from the request's identity — a signed audience cookie
- * (with the credential username when the site has named credentials) or an
- * editor session — and deliberately NOT an Astro `locals`: the decision below
- * is pure, so it is testable the way `audiencePasses` is.
- *
- * `audience` (no username) is the env-mode standalone case: a shared password
- * per audience means there is no person to attribute to (ADR 0002).
- */
-export type DeckIdentity =
-  | { kind: "viewer"; username: string; audience: string }
-  | { kind: "editor"; userId: string }
-  | { kind: "audience"; audience: string };
-
-/** The owner to record on a deck this identity is creating. */
-export function deckOwnerFor(identity: DeckIdentity): DeckOwner {
-  switch (identity.kind) {
-    case "viewer":
-      return { kind: "viewer", username: identity.username, audience: identity.audience };
-    case "editor":
-      return { kind: "editor", userId: identity.userId };
-    case "audience":
-      return { kind: "audience", audience: identity.audience };
-  }
-}
-
-/**
- * Ownership. Credential-keyed for viewers (the username is the person-level
- * key — an audience change must not hand a deck to someone else, and must not
- * take it away from its author), user-id-keyed for editors, and audience-keyed
- * for the env-mode fallback.
- *
- * An audience-owned deck is owned by everyone in that audience, which is
- * exactly the attribution loss ADR 0002 accepts for env-mode portals. The
- * reverse does not hold: an identity with no username cannot claim a
- * credential-owned deck.
- */
-export function isDeckOwner(owner: DeckOwner, identity: DeckIdentity): boolean {
-  switch (owner.kind) {
-    case "viewer":
-      return identity.kind === "viewer" && identity.username === owner.username;
-    case "editor":
-      return identity.kind === "editor" && identity.userId === owner.userId;
-    case "audience":
-      return (identity.kind === "viewer" || identity.kind === "audience") && identity.audience === owner.audience;
-  }
-}
-
-/**
- * May this identity see and change this deck? Owner, or any editor — editors
- * are super-admins over every deck on the site regardless of audience config
- * (feasibility decision 9).
- *
- * One function for read and for write because today they are the same rule:
- * a deck is private to its owner (Deck Visibility). Audience grants and Public
- * Links (#36/#37) widen READ only, and that is when the two split.
- */
-export function canAccessDeck(owner: DeckOwner, identity: DeckIdentity): boolean {
-  return identity.kind === "editor" || isDeckOwner(owner, identity);
-}
-
-/**
- * May this identity CREATE a deck? Editors always (super-admins); everyone else
- * only from a deck-enabled audience — `deckBuilder.audiences`, strict opt-in
- * exactly like `chatbot.audiences`, so an empty list means no viewer may.
- *
- * Creation rights are AUDIENCE-keyed while ownership of the result is
- * CREDENTIAL-keyed (`deckOwnerFor`); the two deliberately do not share a key.
- * An `audience` identity (env-mode standalone, shared password, no named
- * credential) passes when its audience is listed: that is a deliberate opt-in
- * by the editor, and the resulting deck is audience-owned — the attribution
- * loss ADR 0002 accepts, not an accident. What the list prevents is the DEFAULT
- * audience being enabled implicitly, i.e. anyone holding the site password
- * writing to the client's repo.
- */
-export function canCreateDeck(identity: DeckIdentity, deckAudiences: readonly string[]): boolean {
-  if (identity.kind === "editor") return true;
-  return deckAudiences.includes(identity.audience);
-}
-
-/** FNV-1a, twice, at different offsets — 16 hex chars with no crypto import and
- *  no async. Partitioning only; see `deckDraftScope` for why that is enough. */
-function digest(input: string): string {
-  const half = (offset: number): string => {
-    let hash = offset;
-    for (let i = 0; i < input.length; i++) {
-      hash ^= input.charCodeAt(i);
-      hash = Math.imul(hash, 0x01000193) >>> 0;
-    }
-    return hash.toString(16).padStart(8, "0");
-  };
-  return half(0x811c9dc5) + half(0x7fffffff);
-}
-
-/**
- * The Deck Draft partition key for an identity.
- *
- * A Deck Draft lives in one browser until it is published (ADR 0002), and a
- * browser PROFILE is shared between people far more often than an account is.
- * Keyed by site alone, two viewers signing into the same portal on one machine
- * saw each other's unpublished drafts in the grid, could open and read them,
- * and could publish another person's never-published draft under their own
- * ownership; a signed-out user's drafts simply waited for whoever came next.
- *
- * The partition mirrors `deckOwnerFor` exactly, so a draft can only ever be
- * published under the identity that staged it.
- *
- * DIGESTED, not spelled out, because the value becomes an IndexedDB database
- * NAME and any script on the origin can enumerate those — a raw username there
- * would disclose who last used the browser. This is NOT a security boundary:
- * IndexedDB is per-origin and isolates nothing between people sharing a
- * profile. It bounds accidents, not somebody with the keyboard.
- *
- * Switching identity leaves the previous identity's database in place,
- * untouched and unread. That is deliberate — the alternative is destroying a
- * colleague's unpublished work on sign-in — so orphaned drafts persist until
- * the browser's own storage eviction takes them.
- */
-export function deckDraftScope(identity: DeckIdentity): string {
-  switch (identity.kind) {
-    case "viewer":
-      return digest(`viewer:${identity.username}@${identity.audience}`);
-    case "editor":
-      return digest(`editor:${identity.userId}`);
-    case "audience":
-      // Env-mode standalone: a shared password means there is no person to
-      // separate, and ownership degrades the same way (ADR 0002).
-      return digest(`audience:${identity.audience}`);
-  }
-}