@gradial/aci 0.1.52-rc.9 → 0.1.52

package/templates/common/.agents/skills/dam-delivery/SKILL.md

@@ -0,0 +1,216 @@
+---
+name: dam-delivery
+description: Build and use public DAM asset links (`/dam/{assetId}`) with on-the-fly image shaping (resize, crop, format, quality). Use when a page, a CMS field, or an email needs a URL for an approved DAM asset, when choosing between pre-baked derivatives and a shaped public link, when making an asset public or taking it down, or when a `/dam/…` URL answers 301, 403, or 404 unexpectedly.
+---
+
+# DAM Delivery — Public Asset Links
+
+Every approved DAM asset has one public address on the site's own domain:
+
+```
+https://{site}/dam/{assetId}
+```
+
+Add a query to shape an image on the fly:
+
+```
+https://{site}/dam/{assetId}?w=640&h=384&fit=crop&fm=jpg&q=80
+```
+
+The link is built from the asset ID alone. Nothing is minted or signed and
+nothing expires, so the same link can sit in a page, a CMS field, or an
+email for years. It always serves the newest approved public version of
+the asset.
+
+## Retired — Do Not Use
+
+Earlier SDK releases documented two delivery lanes that no longer exist.
+If you meet any of these in old content, notes, or code, replace them with
+the link above. They are not served and they do not redirect.
+
+| Retired | Now |
+| --- | --- |
+| Signed URLs under `/dam/i/…`, `POST /v1/dam/assets/{assetId}/delivery-urls`, `aci dam delivery-url` | Build `/dam/{assetId}?…` yourself; there is nothing to mint |
+| Permalinks under `/dam/a/…`, `GET /v1/dam/assets/{assetId}/permalinks`, recipe URLs | `/dam/{assetId}?…` |
+| The `lifecycle.publicDelivery` flag | Approving a version makes it public (see below) |
+| `width`, `height`, `gravity`, `dpr`, `quality`, `format` | `w`, `h`, `fit`, `fm`, `q` |
+
+## The Link
+
+```
+/dam/{assetId}[/{slug}][?w=…&h=…&fit=…&fm=…&q=…]
+```
+
+- **`assetId`** is a raw 27-character ID made of digits and letters
+  (`0-9A-Za-z`), with no prefix. IDs that start with `ast_` are retired
+  and rejected; per ADR 0043 they are replaced by the breaking migration,
+  with no compatibility period.
+- **`slug`** is optional and cosmetic: `/dam/{assetId}/spring-sale.jpg`
+  answers with a permanent redirect to `/dam/{assetId}`, keeping the query.
+  Use it when a tool insists on a URL that ends in a file extension. The
+  slug is never checked against anything, and its extension does not pick
+  the format.
+- The CLI prints the path for an ID. It is a formatter only: it makes no
+  API call and does not tell you whether the asset is public.
+
+  ```bash
+  aci dam permalink 2E9qL0001aBcDeFgHiJkLmNoPqR
+  # /dam/2E9qL0001aBcDeFgHiJkLmNoPqR
+  ```
+
+The route is served by the deployed site's hosting edge. The site's own
+dev server (`npm run dev`) only serves compiled derivatives under
+`/dam/…`, so a public link answers 404 there — test it against the
+deployed domain.
+
+## Shaping an Image
+
+Five query parameters, and only these. Full rules and worked examples:
+`references/permalink-grammar.md`.
+
+| Param | Values | Default | Notes |
+| --- | --- | --- | --- |
+| `w`, `h` | whole numbers | none | held to 16–3840, then snapped down to a fixed ladder of sizes |
+| `fit` | `max` \| `crop` | `max` | `max` fits inside the box; `crop` fills it and needs both `w` and `h` |
+| `fm` | `webp` \| `avif` \| `jpg` \| `png` | `webp` | the format is always this parameter, never the browser's `Accept` header |
+| `q` | 5–100 | 80 | snapped down to steps of 5 |
+
+Three things to know before writing a link:
+
+- **Any one parameter turns shaping on, and the rest take their
+  defaults.** `?w=640` serves WebP at quality 80, not the original format.
+  To keep a JPEG a JPEG, say `fm=jpg`.
+- **No parameters means the original.** `/dam/{assetId}` streams the
+  approved file byte for byte.
+- **Nothing is rejected.** Unknown parameter names (`utm_*`, `mkt_tok`,
+  cache busters) are dropped. Out-of-range or unrecognised values are
+  snapped to an allowed one, sizes and quality always downward: `w=333`
+  serves 256, `q=77` serves 75, `fm=gif` serves WebP. Do not expect
+  pixel-exact sizes off the ladder. A `w`, `h`, or `q` that is not a
+  whole number (`w=abc`, `q=high`) is treated as if it had been left out,
+  so a typo never shrinks an image or lowers its quality.
+
+The edge settles every link on one canonical form: the parameters in the
+order `w`, `h`, `fit`, `fm`, `q`, after snapping, with `fit`, `fm`, and
+`q` always present. A link written any other way still works. A request
+already on `/dam/{assetId}` with a noncanonical query is answered with one
+permanent redirect to the canonical link (sites hosted on CloudFront tidy
+the query without a visible redirect). A request carrying a slug and a
+noncanonical query can redirect twice: once to drop the slug, once to
+canonicalize the query. Write the canonical form when you control the URL
+and you skip those hops.
+
+Shaping only applies to JPEG, PNG, WebP, and AVIF originals. Everything
+else, SVG included, is served only as a file download, never displayed
+inline. On AWS CloudFront this holds only once the hosting fix (PR #709)
+has rolled out to the tenant; until then that lane may serve SVG or HTML
+inline. See the reference for the size limits.
+
+## What Makes a Link Serve
+
+Approving a version is the "make public" act. There is no separate flag.
+
+```
+POST /v1/dam/assets/{assetId}/lifecycle
+{ "action": "approve", "versionId": "…", "expectedHead": "…" }
+```
+
+Read `effects` in the response to see what happened:
+
+| Effect | Meaning |
+| --- | --- |
+| `live_published` | the link now serves this version |
+| `public_admission_vetoed:<cause>` | the version is approved but **not public**: its expiry date has already passed, an embargo is still in force, a usage block, or a license that does not allow publication. A future expiry date does not veto; the link serves until that date. The link keeps serving the previous public version, if there is one |
+| `live_plane_unconfigured` | a local or dev stack with no delivery wired; nothing was made public |
+
+On the asset record (`GET /v1/dam/assets/{assetId}`), a public version
+shows `deliveryTier: "public"` in its governance, and a refused one shows
+`tierAdmissionVeto`.
+
+- **A newer approved version takes over the same link.** Nothing needs
+  re-pasting.
+- **To take a link down**, `demote` the version (the link falls back to
+  the previous public version, or stops serving if there is none) or
+  `archive` the asset. Both use the same lifecycle endpoint.
+- **Governance that would have blocked the approval cannot be added while
+  a version is public.** A patch adding a past expiry date, an embargo, a
+  usage block, or a license without publication is refused with a
+  conflict that tells you to demote first. A future expiry date can be
+  set, moved, or cleared on a public version; the link stops serving the
+  version when that date arrives.
+- **Changes take up to five minutes to show everywhere.** Responses are
+  `Cache-Control: public, max-age=300`, so a new version or a take-down
+  can lag by that long in browsers and CDN caches. On AWS CloudFront,
+  cached copies can currently outlive that window — the image pipeline
+  sets a one-year TTL and the distribution permits it — until the hosting
+  lane is corrected; the five minutes holds for Vercel and Cloudflare. Do
+  not treat a public link as instantly revocable, and do not re-cache it
+  for longer downstream.
+
+## Pre-Baked Derivatives or a Public Link?
+
+- **Images a page renders from content: keep using the pre-baked
+  pipeline.** Declare `imageSlots` in the contract and render with
+  `imageAttrs()` or `Picture`. The build produces fixed sizes per slot and
+  you never construct a URL. See the authoring skill.
+- **A URL that lives outside the build: use the public link.** A field in
+  an external CMS, an email, a social card, a partner page, or a one-off
+  size that no slot declares.
+
+The difference that matters: a pre-baked image is fixed at publish time
+and changes with the next publish. A public link follows approval and
+take-down on its own, within the five-minute window.
+
+Published content may carry `/dam/{assetId}` links. The publish check
+rejects a payload that contains a raw source path (`dam/blobs/…`) or a
+retired `/dam/a/` or `/dam/i/` path.
+
+## Email and External CMS Fields
+
+1. **Paste the link; never let the tool import the bytes.** Many email
+   tools offer to "import" or "copy" images to their own CDN. Refuse. An
+   imported copy escapes approval and take-down forever; the link is the
+   governed pointer.
+2. **Always set `fm=jpg` or `fm=png` in email.** The default is WebP, and
+   Outlook desktop cannot render WebP.
+3. **Use the slug form when a tool wants a file extension:**
+   `/dam/{assetId}/spring-sale.jpg?w=640&fm=jpg`.
+4. **`block_new_usage` does not take a public link down.** The link cannot
+   tell an old placement from a new one, so an asset under that
+   restriction keeps serving where it is already pasted. To stop serving,
+   demote or archive.
+
+## When a Link Does Not Serve
+
+Errors are never cached (`no-store`) on Vercel and Cloudflare. On AWS
+CloudFront, 403 and 5xx responses may be cached by the distribution for up
+to about ten seconds regardless of `no-store`. Exact codes differ slightly
+between hosting providers, so treat any 4xx as "not served".
+
+| You see | Why | Do |
+| --- | --- | --- |
+| 301 | a slug was dropped or the query was put in canonical form | follow it; write the canonical link next time |
+| 403 | the asset has no public version (never approved, approval vetoed, demoted, archived, or expired), or the ID is malformed | check `effects` from the approve call and `deliveryTier` on the asset record |
+| 404 | a retired `/dam/a/…` or `/dam/i/…` path, DAM delivery is not enabled for this site, or you are on the local dev server | rewrite the link; ask the operator to enable DAM delivery |
+| 413 | the original is too large to shape | drop the query to get the original, or upload a smaller master |
+| 415 | shaping was asked of a non-image original | drop the query |
+| 503 | delivery could not read its own state and refused rather than guess | retry; if it persists, it is an operator issue |
+| A download instead of an image | the original is not JPEG, PNG, WebP, or AVIF | by design; render SVGs through the site's own image pipeline |
+
+## Draft Previews (Management Surfaces Only)
+
+The public link never serves a draft. A draft or rejected version is
+reachable only by an authenticated caller with read permission on the
+asset, and only by naming the exact version:
+
+```
+GET /v1/dam/assets/{assetId}/versions/{versionId}/preview
+```
+
+It answers `302` to a short-lived signed URL: for JPEG, PNG, GIF, and WebP
+up to 20 MiB, a WebP of that version downsampled at upload (longest edge
+1024 px, never upscaled); for SVG, formats the server does not decode
+(HEIC, AVIF, TIFF, BMP), or a version whose preview is not generated yet,
+the original. Follow the redirect without forwarding your bearer token. It
+takes no shaping parameters. Use it for editorial UIs and thumbnails,
+never for site rendering.

package/templates/common/.agents/skills/dam-delivery/references/permalink-grammar.md

@@ -0,0 +1,167 @@
+# Public Link Grammar Reference (`/dam/{assetId}`)
+
+The one public address for a DAM asset:
+
+```
+/dam/{assetId}[/{slug}]?w=640&h=384&fit=crop&fm=jpg&q=80
+```
+
+Permanent, built from the asset ID alone, and always serving the newest
+approved public version. Everything below is enforced at the hosting edge.
+No API call sits in the path of a view, and no API hands these links out —
+you write them.
+
+## Asset ID
+
+Exactly 27 characters from `0-9A-Za-z`, no prefix. IDs that start with
+`ast_` are retired and refused; per ADR 0043 the migration to the new IDs
+is breaking, with no compatibility period. Anything else is refused.
+
+## Parameters
+
+Only these five names mean anything. Every other name is dropped, so
+tracking decorations (`utm_*`, `mkt_tok`) cannot break an image.
+
+| Param | Values | Default | Snapping |
+| --- | --- | --- | --- |
+| `w`, `h` | whole numbers | none | below 16 becomes 16, above 3840 becomes 3840, otherwise snapped DOWN to the ladder `16, 32, 48, 64, 96, 128, 256, 384, 640, 750, 828, 1080, 1200, 1920, 2048, 3840` |
+| `fit` | `max` \| `crop` | `max` | any other value becomes `max` |
+| `fm` | `webp` \| `avif` \| `jpg` \| `png` | `webp` | any other value becomes `webp` |
+| `q` | whole numbers | 80 | below 5 becomes 5, above 100 becomes 100, otherwise snapped DOWN to a step of 5 |
+
+Nothing in the query is ever answered with an error. A value the address
+cannot read is treated as if that parameter had been left out, so a typo
+never shrinks an image or lowers its quality. The reading rules are the
+same on every hosting provider:
+
+- **Any of the five names turns shaping on**, whatever its value, even an
+  empty one (`?w=`).
+- **`w`, `h`, and `q` are read only as a whole number in plain digits**,
+  with an optional leading minus sign. Zero and negative numbers count as
+  below the minimum (`w=-1` serves 16, `q=0` serves 5). Anything else is
+  read as left out: an empty value, letters (`w=abc`, `w=640px`), a
+  decimal point (`w=640.7`), an exponent (`w=1e3`), a plus sign, spaces,
+  or a number larger in size than 9007199254740991. A `w` or `h` read as
+  left out sets no size; a `q` read as left out is 80.
+- **An unrecognised or empty `fit` or `fm` takes its default** (`max`,
+  `webp`).
+- **Names, and the values of `fit` and `fm`, are lowercase only.** `W=640`
+  is an unknown name and is dropped; `fm=JPG` serves WebP.
+- **When a name repeats, the first one decides**, even when it cannot be
+  read: `?w=abc&w=640` sets no width.
+
+The ladder is the Next.js image `srcset` ladder, so breakpoints written
+for any modern framework land on a rung instead of snapping visibly.
+Snapping is deliberate: it keeps the number of distinct renditions per
+asset small and bounded.
+
+How `fit` behaves:
+
+- **`max`** scales the image to fit inside `w` × `h`, keeps its
+  proportions, and never crops. Give one dimension and the other follows.
+- **`crop`** scales and crops to fill `w` × `h` exactly. With only one
+  dimension there is nothing to crop to, so it behaves like `max`.
+- Neither enlarges: asking for more pixels than the original has serves
+  the original size.
+
+Deliberately **not** in the grammar:
+
+- No `dpr`. Pick a larger `w` rung instead, the way `srcset` does.
+- No crop position or focal point.
+- No format negotiation from the browser's `Accept` header. The format is
+  always the explicit `fm`.
+- No recipes or named presets, no signatures, no expiry.
+
+## Canonical Form
+
+One spelling per rendition: `w`, `h`, `fit`, `fm`, `q` in that order,
+after snapping. `w` and `h` appear only when given; `fit`, `fm`, and `q`
+always appear once any of the five is present.
+
+| You write | Canonical link |
+| --- | --- |
+| `/dam/{id}?w=640` | `/dam/{id}?w=640&fit=max&fm=webp&q=80` |
+| `/dam/{id}?q=77&w=333&utm_source=mail` | `/dam/{id}?w=256&fit=max&fm=webp&q=75` |
+| `/dam/{id}?fm=jpg` | `/dam/{id}?fit=max&fm=jpg&q=80` (a format change at the original size) |
+| `/dam/{id}?w=640&q=high` | `/dam/{id}?w=640&fit=max&fm=webp&q=80` (the unreadable quality is read as left out) |
+| `/dam/{id}?w=abc` | `/dam/{id}?fit=max&fm=webp&q=80` (no width, but still shaped: WebP at the original size) |
+| `/dam/{id}?utm_source=mail` | `/dam/{id}` (no shaping asked for, so the original) |
+| `/dam/{id}/spring-sale.jpg?w=640` | `/dam/{id}?w=640`, then as the first row |
+
+A link that is not canonical is answered with one permanent redirect
+(`301`, cacheable for an hour) to the canonical link, before any image
+work is done. The image itself is cached once, under the canonical link.
+A slug costs its own redirect first, with the query carried over as
+written.
+
+Sites hosted on CloudFront put the query in canonical form without a
+visible redirect; a slug still redirects there.
+
+## Responses
+
+Only `GET` and `HEAD` are served. Error responses are `no-store` on
+Vercel and Cloudflare; on AWS CloudFront, 403 and 5xx responses may be
+cached by the distribution for up to about ten seconds regardless of
+`no-store`. Exact error codes differ slightly between hosting providers;
+treat any 4xx as "not served".
+
+| Response | Meaning |
+| --- | --- |
+| 200, `Cache-Control: public, max-age=300` | serving |
+| 301 | a slug was dropped, or the query was put in canonical form |
+| 403, `no-store` | the asset has no public version (never approved, approval vetoed, demoted, archived, or expired), or the ID is malformed |
+| 404, `no-store` | a retired `/dam/a/…` or `/dam/i/…` path, or DAM delivery is not enabled for the site |
+| 413, `no-store` | the original is too large to shape (limits below) |
+| 415, `no-store` | shaping was asked of an original that is not JPEG, PNG, WebP, or AVIF |
+| 503, `no-store` | delivery could not read its own state; it refuses rather than guess |
+
+The five-minute `max-age` is the whole revocation story. After a
+take-down, an already-cached copy can keep showing for up to five minutes;
+the next uncached request is checked again and refused. A newly approved
+version takes over the link within the same window. This holds for Vercel
+and Cloudflare; on AWS CloudFront, cached copies can currently outlive the
+window — the image pipeline sets a one-year TTL and the distribution
+permits it — until the hosting lane is corrected.
+
+## Originals That Are Not Shaped
+
+- **No query:** the approved file is streamed byte for byte, whatever its
+  size.
+- **Shapeable originals** are JPEG, PNG, WebP, and AVIF.
+- **Everything else** (SVG, GIF, PDF, video, documents) is served only as
+  a file download (`Content-Disposition: attachment`, with
+  `X-Content-Type-Options: nosniff`) and never displayed inline. An
+  `<img>` pointing at such a link will not render. On AWS CloudFront this
+  holds only once the hosting fix (PR #709) has rolled out to the tenant;
+  until then that lane may serve SVG or HTML inline.
+- **Size limits for shaping:** the original must be at most 20 MB, at most
+  8192 pixels on either side, and at most 40 megapixels. Past any of
+  those, a shaped link is refused; the plain link still serves the
+  original. Provider gap: the AWS CloudFront lane does not currently
+  enforce these bounds, so an over-limit request is not refused there — do
+  not rely on enforcement on CloudFront.
+
+## Examples
+
+```html
+<!-- Fixed-size email hero, JPEG for Outlook, explicit quality.
+     640 and 384 are ladder rungs; keep the HTML width/height on the same
+     rungs so the served crop and the layout box agree exactly -->
+<img src="https://www.example.com/dam/2E9qL0001aBcDeFgHiJkLmNoPqR?w=640&h=384&fit=crop&fm=jpg&q=80"
+     width="640" height="384" alt="Spring sale hero">
+
+<!-- Responsive srcset on ladder rungs, canonical form (no dpr — use w) -->
+<img src="https://www.example.com/dam/2E9qL0001aBcDeFgHiJkLmNoPqR?w=828&fit=max&fm=webp&q=80"
+     srcset="https://www.example.com/dam/2E9qL0001aBcDeFgHiJkLmNoPqR?w=640&fit=max&fm=webp&q=80 640w,
+             https://www.example.com/dam/2E9qL0001aBcDeFgHiJkLmNoPqR?w=828&fit=max&fm=webp&q=80 828w,
+             https://www.example.com/dam/2E9qL0001aBcDeFgHiJkLmNoPqR?w=1200&fit=max&fm=webp&q=80 1200w"
+     sizes="(max-width: 640px) 100vw, 640px" alt="…">
+
+<!-- Slug form for editors that check for a file extension: one cached
+     redirect to the link without the slug. The extension is cosmetic;
+     fm still picks the format -->
+https://www.example.com/dam/2E9qL0001aBcDeFgHiJkLmNoPqR/spring-sale.jpg?w=640&fit=max&fm=jpg&q=80
+```
+
+Snapping in practice: `?w=333&q=77` and `?w=256&q=75` serve the identical
+rendition (333 snaps to 256, 77 snaps to 75).

package/templates/common/.agents/skills/migration/references/canon-migration.md

@@ -92,29 +92,12 @@ export default function Layout({ children }: { children: ReactNode }) {
 }
 ```
 
-### 7. Layout Contracts: Use SDK Helpers
+### 7. Replace Layout Contracts With Content Templates
 
-Replace plain object literals with SDK helpers:
-
-```ts
-// src/cms/contracts/layouts/index.ts
-import { defineLayoutContract, slot, fragmentDefault } from '@gradial/aci';
-
-export default [
-  defineLayoutContract({
-    name: 'default',
-    slots: [
-      slot('header'),
-      slot('main', true),
-      slot('footer'),
-    ],
-    defaults: {
-      header: fragmentDefault('navbar'),
-      footer: fragmentDefault('site-footer'),
-    },
-  }),
-];
-```
+Convert each legacy code layout into `.content/templates/<name>.json`. The
+template owns ordered regions, placement policy, requiredness, and fragment
+defaults. Bind pages with `template` (or a route binding), then delete the
+layout contract and remove `layoutRegistry` from `.aci.yaml`.
 
 ### 8. Content Compilation: Standardize CLI Command
 
@@ -235,23 +218,15 @@ conformancePreset({
    `dam` rewrite from `next.config.ts`. The SDK asset route handles
    both dev-mode file serving and deployed S3 serving.
 
-6. **Delete Runtime `layouts.ts`**
+6. **Replace All Layout Definitions**
 
-   Delete `src/cms/layouts.ts` (runtime layout definition duplicating the
-   contract-side definition). `createPage` reads layouts from the contract/
-   compiled data, not a runtime definition.
+   Convert `src/cms/layouts.ts` and any `src/cms/contracts/layouts` definition
+   into `.content/templates`. Move navbar/footer fragment defaults into the
+   template regions, bind pages with `template`, and delete the old files.
 
-7. **Update Layout Contract Defaults**
+7. **Remove Retired Config**
 
-   Replace raw `{kind: 'fragment-ref' as const, ...}` objects with
-   `fragmentDefault()`:
-
-   ```ts
-   defaults: {
-     header: fragmentDefault('navbar'),
-     footer: fragmentDefault('site-footer'),
-   }
-   ```
+   Remove `layoutRegistry` from `.aci.yaml`; current config rejects it.
 
 8. **Update `.aci.yaml` siteId**
 
@@ -272,29 +247,11 @@ conformancePreset({
 
 #### Required Changes
 
-1. **Update Layout Contract Style**
+1. **Replace Layout Contracts With Templates**
 
-   Replace plain object literals with SDK helpers:
-
-   ```ts
-   // src/cms/contracts/layouts/index.ts
-   import { defineLayoutContract, slot, fragmentDefault } from '@gradial/aci';
-
-   export default [
-     defineLayoutContract({
-       name: 'default',
-       slots: [
-         slot('header'),
-         slot('main', true),
-         slot('footer'),
-       ],
-       defaults: {
-         header: fragmentDefault('navbar'),
-         footer: fragmentDefault('site-footer'),
-       },
-     }),
-   ];
-   ```
+   Convert the layout contract into `.content/templates/default.json`, move
+   fragment defaults into template regions, bind pages with `template`, and
+   delete the code layout registry.
 
 2. **Remove Customer Middleware**
 
@@ -359,16 +316,10 @@ conformancePreset({
    already in place and handles DAM asset serving automatically with immutable
    caching (`max-age=31536000`).
 
-3. **Update Layout Contract Defaults**
+3. **Move Layout Defaults Into Templates**
 
-   Replace raw inline objects with `fragmentDefault()`:
-
-   ```ts
-   defaults: {
-     header: fragmentDefault('navbar'),
-     footer: fragmentDefault('site-footer'),
-   }
-   ```
+   Move navbar/footer defaults into `.content/templates` regions and delete
+   the code layout definition.
 
 4. **General Migration Steps**
 

package/templates/common/.agents/skills/migration/references/selector-map.md

@@ -13,7 +13,7 @@ Location: `artifacts/source-vs-target/selector-map.json`
   "targetUrl": "http://localhost:3000/",
   "breakpoints": [360, 768, 1024, 1280, 1400],
   "entries": {
-    "content/pages/home/_index.json blocks[\"home-hero\"]": {
+    "content/pages/_index.json blocks[\"home-hero\"]": {
       "source": ".home-hero",
       "target": ".home-hero",
       "viewport": "both",

package/templates/common/.content/fragments/navbar/_index.json

@@ -0,0 +1,24 @@
+{
+  "$type": "fragment",
+  "fragmentId": "navbar",
+  "block": {
+    "$type": "component",
+    "component": "site-navigation",
+    "props": {
+      "brandHref": "/",
+      "brandLabel": "Meridian",
+      "navigation": [
+        { "id": "home", "label": "Home", "href": "/" },
+        { "id": "plans", "label": "Plans", "href": "/plans/" },
+        { "id": "devices", "label": "Devices", "href": "/devices/" },
+        { "id": "business", "label": "Business", "href": "/business/" },
+        { "id": "blog", "label": "Blog", "href": "/blog/" },
+        { "id": "about", "label": "About", "href": "/about/" }
+      ],
+      "utilities": [
+        { "id": "sign-in", "label": "Sign in", "href": "/sign-in/", "variant": "ghost" },
+        { "id": "contact-sales", "label": "Contact sales", "href": "/contact-sales/", "variant": "primary" }
+      ]
+    }
+  }
+}

package/templates/common/.content/fragments/site-footer/_index.json

@@ -0,0 +1,61 @@
+{
+  "$type": "fragment",
+  "fragmentId": "site-footer",
+  "block": {
+    "$type": "component",
+    "component": "site-footer",
+    "props": {
+      "brandHref": "/",
+      "brandLabel": "Meridian",
+      "columns": [
+        {
+          "id": "products",
+          "title": "Products",
+          "links": [
+            { "id": "plans", "label": "Plans", "href": "/plans/" },
+            { "id": "devices", "label": "Devices", "href": "/devices/" },
+            { "id": "coverage", "label": "Coverage", "href": "/coverage/" }
+          ]
+        },
+        {
+          "id": "solutions",
+          "title": "Solutions",
+          "links": [
+            { "id": "business", "label": "Business", "href": "/business/" },
+            { "id": "maritime", "label": "Maritime", "href": "/business/maritime/" },
+            { "id": "aerospace", "label": "Aerospace", "href": "/business/aerospace/" }
+          ]
+        },
+        {
+          "id": "resources",
+          "title": "Resources",
+          "links": [
+            { "id": "blog", "label": "Blog", "href": "/blog/" },
+            { "id": "documentation", "label": "Documentation", "href": "/docs/" },
+            { "id": "support", "label": "Support", "href": "/support/" }
+          ]
+        },
+        {
+          "id": "company",
+          "title": "Company",
+          "links": [
+            { "id": "about", "label": "About us", "href": "/about/" },
+            { "id": "careers", "label": "Careers", "href": "/careers/" },
+            { "id": "contact", "label": "Contact", "href": "/contact/" }
+          ]
+        }
+      ],
+      "social": [
+        { "id": "x", "label": "X", "href": "https://x.com/meridian", "icon": "X" },
+        { "id": "linkedin", "label": "LinkedIn", "href": "https://www.linkedin.com/company/meridian", "icon": "in" },
+        { "id": "youtube", "label": "YouTube", "href": "https://www.youtube.com/meridian", "icon": "YT" }
+      ],
+      "legalLinks": [
+        { "id": "terms", "label": "Terms of Service", "href": "/terms/" },
+        { "id": "privacy", "label": "Privacy Policy", "href": "/privacy/" },
+        { "id": "security", "label": "Security", "href": "/security/" }
+      ],
+      "copyright": "Copyright (c) 2026 Meridian Satellite Networks, Inc. All rights reserved."
+    }
+  }
+}

package/templates/common/.content/pages/404/_index.json

@@ -2,15 +2,17 @@
   "$type": "page",
   "id": "meridian-not-found",
   "status": "published",
-  "layout": "default",
   "metadata": {
     "title": "Page not found — Meridian",
     "description": "The page you are looking for does not exist.",
-    "sitemap": { "visible": false }
+    "sitemap": {
+      "visible": false
+    }
   },
   "regions": {
     "main": [
       {
+        "$type": "component",
         "id": "not-found-hero",
         "component": "home_hero",
         "props": {

package/templates/common/.content/pages/_index.json

@@ -2,7 +2,6 @@
   "$type": "page",
   "id": "meridian-home",
   "status": "published",
-  "layout": "default",
   "metadata": {
     "title": "Meridian — Global Satellite Internet",
     "description": "Connect from anywhere on Earth. Low-latency satellite internet for homes, businesses, and beyond.",

package/templates/common/.content/pages/error/_index.json

@@ -2,15 +2,17 @@
   "$type": "page",
   "id": "meridian-error",
   "status": "published",
-  "layout": "default",
   "metadata": {
     "title": "Something went wrong — Meridian",
     "description": "An unexpected error occurred while serving this page.",
-    "sitemap": { "visible": false }
+    "sitemap": {
+      "visible": false
+    }
   },
   "regions": {
     "main": [
       {
+        "$type": "component",
         "id": "error-hero",
         "component": "home_hero",
         "props": {