@gradial/aci 0.1.52-rc.2 → 0.1.52-rc.21

package/templates/common/.agents/skills/dam-delivery/SKILL.md

@@ -0,0 +1,228 @@
+---
+name: dam-delivery
+description: Mint and use signed DAM delivery URLs for on-demand image transforms, and manage public permanent URLs (permalinks) for CMS fields and email. Use when a page or server function needs a resized, cropped, or format-converted image at render time, when choosing between pre-baked derivatives and dynamic transforms, when an image URL must be pasted somewhere that cannot call a mint API (Contentful-class CMS fields, Marketo/SFMC email), or when a delivery URL returns 403/404 unexpectedly.
+---
+
+# DAM Delivery — Signed Transform URLs
+
+The DAM serves parameterized image transforms (resize, crop, quality,
+webp/avif) through signed URLs under `/dam/i/{assetId}/…`. The API mints
+them; clients can neither construct nor alter them — every URL is
+HMAC-signed server-side over a closed, validated parameter contract.
+
+## The One Rule: URLs Are Render-Time Artifacts
+
+Delivery URLs **expire** (24h maximum by default) and are **banned from
+published payloads**. The publish validator rejects any payload containing
+the `/dam/i/` path marker, exactly as it rejects raw `dam/blobs` pointers.
+
+- **DO** mint at render time: SSR handlers, server functions, API-backed
+  routes, previews.
+- **DO NOT** bake minted URLs into content JSON, compiled payloads, or
+  anything that gets published — a frozen release would carry URLs that
+  permanently 404 within a day.
+- For content baked into releases, keep using the pre-baked derivative
+  pipeline (`imageSlots` in contracts → `dam/derivatives/…` URLs via
+  `imageAttrs()`/`Picture`). Delivery URLs complement it; they do not
+  replace it.
+
+## Minting
+
+One endpoint mints single or batch; the request is always an array of
+parameter sets and one signed URL comes back per set, in order.
+
+```
+POST /v1/dam/assets/{assetId}/delivery-urls
+{
+  "requests": [
+    { "width": 800, "height": 600, "fit": "fill", "gravity": "noea",
+      "quality": 90, "dpr": 2, "format": "avif" },
+    { "width": 400 }
+  ]
+}
+```
+
+Response — exactly one of `url`/`error` per item:
+
+```json
+{
+  "results": [
+    { "url": "/dam/i/ast_…/…", "expiresAt": "2026-08-16T12:00:00Z" },
+    { "error": { "status": 400, "code": "dam.delivery.invalid_param",
+                 "message": "width must be 1-4096", "details": { "param": "width" } } }
+  ]
+}
+```
+
+Asset-level failures (asset not found, unavailable, permission denied)
+fail the whole request; parameter failures are per-item so one bad set
+cannot sink its siblings. Batches cap at 100 parameter sets.
+
+CLI equivalents:
+
+```bash
+# Single mint from flags
+aci dam delivery-url ast_2E9qL0001aBcDeF --width 800 --height 600 \
+  --fit fill --gravity noea --quality 90 --format avif --dpr 2
+
+# Batch from a JSON array (prints one URL<TAB>expiresAt line per mint)
+aci dam delivery-url ast_2E9qL0001aBcDeF \
+  --params '[{"width":400},{"width":800,"dpr":2}]'
+```
+
+## The Parameter Contract (Closed)
+
+Everything outside this table is rejected. Full ranges, interactions, and
+error codes: `references/parameter-contract.md`.
+
+| Param | Values | Default | Notes |
+| --- | --- | --- | --- |
+| `width`, `height` | 1–4096 | none | `width·dpr` and `height·dpr` must each stay ≤ 4096 |
+| `fit` | `fit` \| `fill` | `fit` | requires `width` or `height` |
+| `gravity` | `ce`, `no`, `so`, `ea`, `we`, `noea`, `nowe`, `soea`, `sowe`, or `fp:{x}:{y}` (x,y ∈ [0,1]) | `ce` | non-default gravity requires `fit: "fill"` |
+| `quality` | 1–100 | 82 | |
+| `dpr` | 1–3 | 1 | multiplies output dimensions |
+| `format` | `webp` \| `avif` \| `jpeg` \| `png` | `webp` | becomes the URL extension |
+
+Special cases:
+
+- **SVG** is passthrough-only: only the empty parameter set `{}` is
+  accepted; any transform param is rejected.
+- **Non-image assets** are never served through `/dam/i/*`; use the
+  download endpoints instead.
+- Oversized blobs (over the origin's 200 MB streaming envelope) refuse to
+  mint with `dam.delivery.source_too_large`.
+
+## Expiry Semantics
+
+- Every URL carries a signed expiry; `expiresAt` in the response is that
+  instant. After it, the URL 404s at the origin and cached copies die at
+  the CDN.
+- The bound is quantized (default 1h): identical requests minted within
+  the same quantum return **byte-equal URLs**, so re-minting per render is
+  cheap and cache-friendly. Effective lifetime is between `maxTTL − 1h`
+  and `maxTTL` (default 24h).
+- A version whose scheduled expiry revokes delivery gets URLs that expire
+  exactly at that boundary, which may be much sooner. Never assume a
+  fixed TTL — read `expiresAt`.
+- Re-mint instead of caching URLs long-term. Caching a minted URL for the
+  duration of one render/request is fine.
+
+## Availability: Why Mints Get Denied
+
+Minting serves **only the latest approved, publishable version** and fails
+closed. Expect typed errors (HTTP 422 unless noted):
+
+| Code | Meaning |
+| --- | --- |
+| `dam.asset.no_approved_version` | draft-only, embargoed, expired, or usage-restricted versions — nothing publishable |
+| `dam.asset.not_active` | archived or deleted |
+| `dam.asset.legal_hold` | under legal hold |
+| `dam.asset.blocked` | asset-wide publication block (usage restriction) |
+| `dam.permission_denied` | caller lacks download permission (403) |
+| `dam.delivery.not_image` | non-image MIME |
+
+There is no fallback to unapproved versions anywhere. Approval changes URL
+identity (new blob → new URLs on next mint); already-minted URLs keep
+serving what they named until they expire.
+
+## Public Permanent URLs (Permalinks)
+
+Assets flagged `lifecycle.publicDelivery` also serve through a **permanent,
+public URL** — Sanity-style, deterministic from the assetId alone, no mint
+API in the loop:
+
+```
+https://{site}/dam/a/{assetId}?w=640&h=384&fit=crop&fm=jpg&q=80
+```
+
+It always resolves to the **current approved version** (approve a new
+version and pasted URLs pick it up within ~30s, no re-paste), and it dies
+within the revocation budget (≤ 30s for fresh resolution) on embargo,
+expiry, archive, or unpublish. Transform parameters are
+client-constructable but **validated and quantized** at the edge — `w`/`h`
+snap down to a fixed ladder, `q` to steps of 5 — and unknown parameter
+names (`utm_*`, `mkt_tok`, any ESP decoration) are **stripped, never
+errors**, so tracking-decorated links keep working. Invalid *values* of
+the contract params (`fm=bmp`, `w=abc`) are a 400: author error fails
+loudly. Full grammar, quantization ladder, and Sanity-style examples:
+`references/permalink-grammar.md`.
+
+**When to use which lane:**
+
+- **Signed delivery URLs** (`/dam/i/*`, above): everything that renders
+  server-side and can re-mint — SSR, server functions, previews.
+- **Permalinks** (`/dam/a/*`): places where a URL is pasted once and must
+  live for years with no code in the loop — CMS fields, Marketo/SFMC
+  email. Requires the asset to be flagged public.
+
+### Getting the URL
+
+```
+GET /v1/dam/assets/{assetId}/permalinks
+```
+
+Returns the base permalink and per-recipe URLs (path + absolute URL), the
+grammar constants (width ladder, quality step, defaults), the
+`publicDelivery` flag state, and a `warning` field (below). CLI:
+
+```bash
+aci dam permalink ast_2E9qL0001aBcDeF               # base URL
+aci dam permalink ast_2E9qL0001aBcDeF --recipe email-hero
+```
+
+The permalink path is deterministic, so the endpoint answers even before
+the flag is flipped — check `publicDelivery` to know whether it resolves.
+
+### Flipping the Flag
+
+`publicDelivery` is patched through the governance plane:
+
+```
+PATCH /v1/dam/assets/{assetId}/governance
+{ "expectedHead": "…", "lifecycle": { "publicDelivery": true } }
+```
+
+Flipping **on** is a "make public" act and passes the eligibility gate
+against the version the permalink would serve. A refusal is a typed 400,
+code `dam.delivery.public_flip_denied`, with `details.reason` carrying the
+gate's own reason — e.g. `no_approved_version`, `not_image`, a
+`block_new_usage` restriction, a publication-less license, or an expiry
+the lane cannot enforce. Fix the governance fact; do not retry blind.
+Flipping **off** is a plain patch and kills public serving within the
+revocation budget.
+
+### Doctrine for Email and CMS (the two rules)
+
+1. **Paste the permalink; never let the ESP import the bytes.** Many email
+   tools offer to "import" or "copy" images to their own CDN — refuse. An
+   imported copy escapes governance and revocation forever; the permalink
+   is the governed pointer, and it is precisely the ≤ 30s revocation
+   budget that makes it safe to paste.
+2. **Assets needing `block_new_usage` semantics do not get flagged
+   public.** The permalink lane cannot tell an old placement from a new
+   one, so `block_new_usage` cannot be enforced there — the flip gate
+   refuses such assets at authoring time. Use `unpublish` or
+   `block_all_usage` expiry actions (the lane enforces those boundaries
+   exactly), or keep the asset on the signed lane. If `block_new_usage`
+   governance lands on an *already-public* asset, the permalink keeps
+   serving and the permalinks API surfaces
+   `warning: "block_new_usage_in_force"` — treat that warning as "review
+   this asset's public status now".
+
+Email format tip: Outlook desktop cannot render WebP — use `fm=jpg` or
+`fm=png` in email permalinks.
+
+## Draft Previews (Management Surfaces Only)
+
+Drafts are reachable only by naming their version — authenticated, never
+CDN-cached, never via `/dam/i/*`:
+
+```
+GET /v1/dam/assets/{assetId}/versions/{versionId}/preview?width=512
+GET /v1/dam/assets/{assetId}/versions/{versionId}/download
+```
+
+The preview takes the same transform parameters as query strings and
+streams the transformed image with `Cache-Control: private, no-store`.
+Use these for editorial UIs; never for site rendering.

package/templates/common/.agents/skills/dam-delivery/references/parameter-contract.md

@@ -0,0 +1,107 @@
+# Delivery Parameter Contract Reference
+
+The mint API accepts exactly this parameter set. Anything else — unknown
+fields, out-of-range values, invalid combinations — is rejected with a
+typed error. Parameters are canonicalized server-side (fixed order,
+defaults elided) so numerically equal requests produce byte-equal URLs.
+
+## Parameters
+
+### width, height
+
+- Integers, 1–4096. Omit (or 0) for "not constrained".
+- The **effective** output dimension is capped, not the raw value:
+  `width·dpr ≤ 4096` and `height·dpr ≤ 4096`. `width: 4096, dpr: 2` is
+  rejected even though each value is individually legal.
+- Supplying only one dimension scales the other to preserve aspect ratio.
+
+### fit
+
+- `"fit"` (default): scale to fit inside width×height, preserving aspect
+  ratio, never cropping.
+- `"fill"`: scale and crop to exactly fill width×height.
+- Requires at least one of `width`/`height` when set explicitly.
+
+### gravity
+
+- Controls which region survives a `fill` crop.
+- Compass points: `ce` (center, default), `no`, `so`, `ea`, `we`, `noea`,
+  `nowe`, `soea`, `sowe`.
+- Focal point: `fp:{x}:{y}` with x and y in `[0,1]` — `fp:0.5:0.25` keeps
+  the point half across, a quarter down. Numerically equal focal points
+  canonicalize identically (`fp:0.50:0.250` ≡ `fp:0.5:0.25`).
+- **Non-default gravity requires `fit: "fill"`** — gravity only means
+  something when cropping. `{ "width": 100, "gravity": "noea" }` is
+  rejected; add `"fit": "fill"`.
+
+### quality
+
+- Integer 1–100, default 82. Applies to lossy output formats.
+
+### dpr
+
+- Integer 1–3, default 1. Multiplies the output dimensions for
+  high-density displays; see the effective-dimension cap above.
+
+### format
+
+- `"webp"` (default), `"avif"`, `"jpeg"`, `"png"`. Becomes the URL's file
+  extension.
+
+## Special Cases
+
+- **SVG assets**: passthrough only. The empty parameter set `{}` mints a
+  passthrough URL serving the original SVG; any transform parameter is
+  rejected with `dam.delivery.svg_transform`.
+- **Non-image assets**: never served through delivery URLs
+  (`dam.delivery.not_image`). Use the download endpoints.
+- **Oversized blobs**: blobs over the origin's 200 MB streaming envelope
+  refuse to mint (`dam.delivery.source_too_large`).
+
+## Error Codes
+
+Per-item (inside `results[i].error`, HTTP 200 on the envelope):
+
+| Code | Cause |
+| --- | --- |
+| `dam.delivery.invalid_param` | range or combination violation; `details.param` names the offender |
+| `dam.delivery.svg_transform` | transform params on an SVG asset |
+| `dam.delivery.not_image` | non-image MIME |
+| `dam.delivery.source_too_large` | blob over the streaming envelope |
+
+Request-level (problem+json):
+
+| Code | HTTP | Cause |
+| --- | --- | --- |
+| `dam.asset.no_approved_version` | 422 | no publishable approved version (draft-only, embargoed, expired, or version-scoped restriction) |
+| `dam.asset.not_active` | 422 | archived / deleted asset |
+| `dam.asset.legal_hold` | 422 | legal hold active |
+| `dam.asset.blocked` | 422 | asset-wide publication block (usage restriction) |
+| `dam.permission_denied` | 403 | caller lacks download permission |
+| `NOT_FOUND` | 404 | unknown asset |
+
+## Worked Examples
+
+```jsonc
+// Hero image, art-directed crop on a focal point, retina
+{ "width": 1440, "height": 600, "fit": "fill", "gravity": "fp:0.62:0.3", "dpr": 2 }
+
+// Thumbnail grid cell, default gravity center-crop
+{ "width": 320, "height": 320, "fit": "fill" }
+
+// Constrain width only, keep aspect ratio, high quality JPEG
+{ "width": 1200, "quality": 95, "format": "jpeg" }
+
+// SVG passthrough (the ONLY valid SVG request)
+{ }
+```
+
+Rejected examples and why:
+
+```jsonc
+{ "width": 4096, "dpr": 3 }                  // effective width 12288 > 4096
+{ "width": 100, "gravity": "noea" }          // gravity requires fit "fill"
+{ "fit": "fill" }                            // fit requires width or height
+{ "gravity": "fp:1.5:0" }                    // focal coords must be in [0,1]
+{ "format": "gif" }                          // outside the closed format set
+```

package/templates/common/.agents/skills/dam-delivery/references/permalink-grammar.md

@@ -0,0 +1,131 @@
+# Public Permalink Grammar Reference (`/dam/a/*`)
+
+The public permanent URL for an asset:
+
+```
+/dam/a/{assetId}[/{slug-or-recipe}[.{ext}]]?w=400&h=300&fit=crop&fm=jpg&q=80
+```
+
+(The query above shows the *shape* only — `w=400`/`h=300` are off-ladder
+and would serve 384x256 after snapping. The recommended examples below
+sit exactly on rungs; pick rung values when you control the URL.)
+
+Permanent, deterministic from the assetId alone, resolving to the current
+approved version while the asset is flagged `publicDelivery` and available
+for delivery. Everything below is edge-enforced; the API is never in the
+per-view path. The grammar constants (ladder, steps, defaults) are also
+served machine-readably by `GET /v1/dam/assets/{assetId}/permalinks`.
+
+## Parameters (open but quantized)
+
+Names are Sanity-compatible. Unknown parameter *names* are stripped —
+never errors — so ESP tracking decorations (`utm_*`, `mkt_tok`) cannot
+break an image. Invalid *values* of these contract params are a 400.
+
+| Param | Values | Default | Quantization |
+| --- | --- | --- | --- |
+| `w`, `h` | positive integers | none | snapped DOWN to the ladder `16, 32, 48, 64, 96, 128, 256, 384, 640, 750, 828, 1080, 1200, 1920, 2048, 3840`; below 16 snaps up to 16, above 3840 down to 3840 |
+| `fit` | `crop` \| `max` | `max` | `crop` requires **both** `w` and `h` |
+| `fm` | `webp` \| `avif` \| `jpg` \| `png` | `webp` | — |
+| `q` | 1–100 | absent → renders at 82 | snapped DOWN to steps of 5; below 5 snaps up to 5; an explicit `q=80` serves 80, never the default — explicit quality is honored after snapping, not silently inflated |
+
+The ladder is the Next.js image `srcset` ladder verbatim, so breakpoints
+authored against any modern framework land on rungs instead of snapping
+visibly. Quantization is deliberate abuse control: it bounds the
+transform cache keyspace per asset.
+
+Deliberately **not** in the grammar:
+
+- No `dpr` — pick the right `w` rung instead (the ladder already covers
+  device densities the way `srcset` consumes them).
+- No `Accept`-header format negotiation — format is always the explicit
+  `fm`. For email use `fm=jpg` or `fm=png` (Outlook desktop has no WebP).
+- `crop=focal` is reserved, not shipped.
+
+## Canonical Form, Slugs, and Recipes
+
+The canonical URL is **extension-less**: `/dam/a/{assetId}?…`. The
+optional second path segment (extension stripped) is either:
+
+- **A registered public recipe** (`/dam/a/{id}/email-hero.jpg`): expands
+  server-side into a fixed parameter set from the public recipe registry.
+  Recipe URLs are a second canonical form — no redirect hop. Adding
+  transform query params alongside a recipe is a 400 (ambiguity is author
+  error); ESP decorations are stripped first, as everywhere. The
+  extension is readability only — the recipe's format wins. The registry
+  ships empty; `GET …/permalinks` lists what is registered.
+- **Anything else — a readable slug** (`/dam/a/{id}/spring-sale.jpg`):
+  answers a 301 to the canonical no-slug URL with the same (canonicalized)
+  query. Use the slug form when a tool insists on an extension-bearing
+  image URL; it costs one cached redirect and is stable forever.
+
+## Response Semantics
+
+| Response | Meaning |
+| --- | --- |
+| 302 → `/dam/i/…` | serving: a short-lived signed inner URL (≤ 2h), re-minted per redirect |
+| 301 | slug normalization to the canonical URL |
+| 400 `no-store` | invalid value of a contract param, transform params on an SVG or alongside a recipe, malformed assetId |
+| 404 `no-store` | asset is not publicly served: flag off, not yet approved, embargoed, expired, archived, legal hold |
+| 503 `no-store` | resolution state unreadable — fail-closed, never a guess |
+
+The 302 carries a short cache TTL (default 30s) — the revocation dial.
+On unpublish/archive/embargo/revoking-expiry, fresh resolution dies
+within ≤ 30s; a flip **to** serving may additionally ride a ~10s
+error-caching echo. Approving a new version re-points the permalink
+within the same budget; already-fetched inner URLs keep serving the bytes
+they named until they expire (≤ 2h).
+
+## SVG
+
+SVG permalinks are passthrough-only: the bare permalink 302s to the SVG
+passthrough; any transform parameter (or recipe) is a 400.
+
+## Sanity-Style Examples
+
+```html
+<!-- Fixed-size email hero, JPEG for Outlook, explicit quality.
+     640 and 384 are ladder rungs; keep the HTML width/height on the same
+     rungs so the served crop and the layout box agree exactly -->
+<img src="https://www.example.com/dam/a/ast_2E9qL0001aBcDeF?w=640&h=384&fit=crop&fm=jpg&q=80"
+     width="640" height="384" alt="Spring sale hero">
+
+<!-- Responsive srcset on ladder rungs (no dpr param — use w) -->
+<img src="https://www.example.com/dam/a/ast_2E9qL0001aBcDeF?w=828"
+     srcset="https://www.example.com/dam/a/ast_2E9qL0001aBcDeF?w=640 640w,
+             https://www.example.com/dam/a/ast_2E9qL0001aBcDeF?w=828 828w,
+             https://www.example.com/dam/a/ast_2E9qL0001aBcDeF?w=1200 1200w"
+     sizes="(max-width: 640px) 100vw, 640px" alt="…">
+
+<!-- Extension-bearing slug form for ESP editors that validate by extension:
+     one cached 301 to the canonical URL, stable forever -->
+https://www.example.com/dam/a/ast_2E9qL0001aBcDeF/spring-sale.jpg?w=640&fm=jpg
+```
+
+Quantization in practice: `?w=333&q=77` and `?w=256&q=75` serve the
+identical rendition (333 snaps to 256, 77 snaps to 75) — do not expect
+pixel-exact widths off the ladder.
+
+## The Flag, the Gate, and the Warning
+
+- `lifecycle.publicDelivery` (asset-level, governance PATCH) is the one
+  admission act. Flip-on passes the eligibility gate against the version
+  the permalink would serve; refusal is a typed 400
+  `dam.delivery.public_flip_denied` with `details.reason` (e.g.
+  `no_approved_version`, `not_image`, `source_too_large`, a
+  `block_new_usage` restriction, a publication-less license, an
+  unenforceable expiry action).
+- Version selection is automatic and fail-closed: the latest approved,
+  deliverable version whose license (when present) grants `publication`
+  and whose `expiresAt` (when set) the lane can actually enforce
+  (`unpublish`/`block_all_usage`). Versions failing those rows are
+  skipped in favor of the previous passing one.
+- `GET …/permalinks` returns `warning: "block_new_usage_in_force"` when
+  `block_new_usage` governance landed on an already-public asset (the
+  flip gate refuses it up front, so this only happens for governance
+  added after the flip). The permalink keeps serving — the lane cannot
+  distinguish existing placements from new ones — so treat the warning as
+  a prompt to review the asset's public status.
+- Legal hold: flipping a legal-held asset on succeeds but the permalink
+  404s for the hold's duration and starts serving the moment the hold
+  lifts — no re-flip needed.

package/templates/common/.content/pages/{home/_index.json → _index.json}

@@ -11,6 +11,7 @@
   "regions": {
     "main": [
       {
+        "$type": "component",
         "id": "hero",
         "component": "home_hero",
         "props": {
@@ -27,6 +28,7 @@
         }
       },
       {
+        "$type": "component",
         "id": "why-meridian",
         "component": "feature_grid",
         "props": {
@@ -34,6 +36,7 @@
           "subtitle": "Engineered for the edges of the world.",
           "features": [
             {
+              "$type": "component",
               "id": "global-coverage",
               "component": "feature_card",
               "props": {
@@ -43,6 +46,7 @@
               }
             },
             {
+              "$type": "component",
               "id": "low-latency",
               "component": "feature_card",
               "props": {
@@ -52,6 +56,7 @@
               }
             },
             {
+              "$type": "component",
               "id": "easy-setup",
               "component": "feature_card",
               "props": {
@@ -64,6 +69,7 @@
         }
       },
       {
+        "$type": "component",
         "id": "personalization-choice",
         "component": "personalization_choice",
         "props": {
@@ -75,6 +81,7 @@
         }
       },
       {
+        "$type": "component",
         "id": "stats",
         "component": "stats_bar",
         "props": {
@@ -87,6 +94,7 @@
         }
       },
       {
+        "$type": "component",
         "id": "cta",
         "component": "container",
         "props": {
@@ -94,6 +102,7 @@
           "className": "items-center justify-center text-center",
           "content": [
             {
+              "$type": "component",
               "id": "cta-primary",
               "component": "button",
               "props": {
@@ -105,6 +114,7 @@
               }
             },
             {
+              "$type": "component",
               "id": "cta-secondary",
               "component": "button",
               "props": {

package/templates/common/.content/schemas/site.schema.json

@@ -27,7 +27,7 @@
     },
     "overlayResolution": {
       "type": "array",
-      "items": { "enum": ["locale", "audience"] }
+      "items": { "enum": ["locale", "audience", "segment", "experiment", "experimentArm"] }
     },
     "brandHref": { "type": "string" },
     "brandLogo": {

package/templates/common/.nvmrc

@@ -1 +1 @@
-22
+24

package/templates/common/starter-content/.content/.rules-baseline.json

@@ -0,0 +1,8 @@
+{
+  "version": 1,
+  "rules": {
+    "no-public-resource-paths": [
+      "/assets/meridian-logo.svg"
+    ]
+  }
+}

package/templates/common/starter-content/.content/config/site.json

@@ -10,7 +10,7 @@
     "notFound": "/404/",
     "catchAll": "/error/"
   },
-  "overlayResolution": ["locale", "audience"],
+  "overlayResolution": ["locale", "audience", "segment"],
   "brandHref": "/",
   "brandLogo": {
     "src": "/assets/meridian-logo.svg",

package/templates/common/starter-content/.content/content-rules/no-public-resource-paths.json

@@ -0,0 +1,6 @@
+{
+  "kind": "forbid-string-pattern",
+  "pattern": "^/[^\\s]+\\.(png|jpe?g|webp|gif|svg|avif|mp4|webm|ico)$",
+  "appliesTo": "all-string-props",
+  "message": "Content must not reference front-end public/ resources."
+}

package/templates/common/starter-content/.content/fragments/navbar/_index.json

@@ -1,25 +1,28 @@
 {
   "$type": "fragment",
   "fragmentId": "navbar",
-  "component": "site-navigation",
-  "props": {
-    "brandHref": "/",
-    "brandLabel": "Meridian",
-    "brandLogo": {
-      "src": "/assets/meridian-logo.svg",
-      "alt": "Meridian"
-    },
-    "navigation": [
-      { "id": "home", "label": "Home", "href": "/" },
-      { "id": "plans", "label": "Plans", "href": "/plans/" },
-      { "id": "devices", "label": "Devices", "href": "/devices/" },
-      { "id": "business", "label": "Business", "href": "/business/" },
-      { "id": "blog", "label": "Blog", "href": "/blog/" },
-      { "id": "about", "label": "About", "href": "/about/" }
-    ],
-    "utilities": [
-      { "id": "sign-in", "label": "Sign in", "href": "/sign-in/", "variant": "ghost" },
-      { "id": "contact-sales", "label": "Contact sales", "href": "/contact-sales/", "variant": "primary" }
-    ]
+  "block": {
+    "$type": "component",
+    "component": "site-navigation",
+    "props": {
+      "brandHref": "/",
+      "brandLabel": "Meridian",
+      "brandLogo": {
+        "src": "/assets/meridian-logo.svg",
+        "alt": "Meridian"
+      },
+      "navigation": [
+        { "id": "home", "label": "Home", "href": "/" },
+        { "id": "plans", "label": "Plans", "href": "/plans/" },
+        { "id": "devices", "label": "Devices", "href": "/devices/" },
+        { "id": "business", "label": "Business", "href": "/business/" },
+        { "id": "blog", "label": "Blog", "href": "/blog/" },
+        { "id": "about", "label": "About", "href": "/about/" }
+      ],
+      "utilities": [
+        { "id": "sign-in", "label": "Sign in", "href": "/sign-in/", "variant": "ghost" },
+        { "id": "contact-sales", "label": "Contact sales", "href": "/contact-sales/", "variant": "primary" }
+      ]
+    }
   }
 }