@growth-labs/cms 0.5.29 → 0.5.31

package/dist/engine/publication-continuity.js

@@ -0,0 +1,94 @@
+// Publication continuity decisions (#342).
+//
+// Extracted from the Warfronts publish bridge so every site shares one rule set
+// instead of each re-deriving it. These are the decisions a continuity run makes
+// before it touches the database: is this item retired, did the published
+// revision drift from the archive, and does a live probe response mean success.
+//
+// All pure. The bridge's DB, network and filesystem work stays site-owned; only
+// the judgement moves here.
+/** An item the archive has taken down rather than published. */
+export function isRetiredItem(item) {
+    return item?.metadata?.originalStatus === 'archived';
+}
+/**
+ * Compare the fields a reader actually sees against the published revision.
+ *
+ * The site renders from the published revision payload, so an edit to any field
+ * this does not examine is classified "already in sync", skipped, and never
+ * reaches a reader — while the run reports success. That has stranded real work
+ * twice: fourteen restored article bodies, and a `featured` flag flip, both
+ * merged, both reporting `failed=0`, neither ever visible.
+ *
+ * Comparison is exact rather than a length or prefix heuristic. The entire class
+ * of bug being prevented is a cheap test that silently misses a real edit: a
+ * false "stale" costs one idempotent republish, a false "in sync" loses the edit.
+ *
+ * NOT COMPARED: tags. The revision stores them canonicalized and sorted while
+ * the archive carries raw frontmatter strings, and the engine exports no
+ * canonicalizer to reuse. Detecting a field this cannot also REPAIR would be
+ * worse than not detecting it — tag writes go through the engine, so a tag-only
+ * drift would republish unchanged and stay stale on every run, forever.
+ */
+export function payloadDrift(item, row) {
+    // The engine stores an absent body as a single space, so normalize the same
+    // way before comparing or the first resync of a body-less article would
+    // churn forever.
+    const body = item.bodyMarkdown ?? ' ';
+    const title = String(item.title ?? '');
+    const description = item.description ?? null;
+    const featured = item.featured ? 1 : 0;
+    const heroImageId = item.heroImageId ?? null;
+    const visibility = item.visibility === 'premium' ? 'premium' : 'free';
+    const channel = item.primaryCategory ?? null;
+    const fields = [];
+    if (row.rev_title !== title)
+        fields.push('title');
+    if ((row.rev_description ?? null) !== description)
+        fields.push('description');
+    if (Number(row.rev_featured ?? 0) !== featured)
+        fields.push('featured');
+    if ((row.rev_hero_image_id ?? null) !== heroImageId)
+        fields.push('heroImage');
+    if ((row.rev_visibility ?? 'free') !== visibility)
+        fields.push('visibility');
+    if ((row.rev_channel ?? null) !== channel)
+        fields.push('channel');
+    // A revision predating this check can lack the key entirely; treat an absent
+    // body as drift rather than silently matching.
+    if ((row.rev_body_markdown ?? null) !== body)
+        fields.push('body');
+    return {
+        drifted: fields.length > 0,
+        fields,
+        title,
+        description,
+        featured,
+        heroImageId,
+        visibility,
+        channel,
+        body,
+        bodyDrifted: fields.includes('body'),
+    };
+}
+/**
+ * Whether a live probe response means the publication succeeded.
+ *
+ * LIVE → 200 only.
+ * RETIRED → 301/308 (redirected to a surviving twin) or 404 (gone, with no
+ *   honest target to redirect to).
+ *
+ * The invariant: **a retired article must never answer 200.** That is the
+ * stale-row symptom a teardown exists to remove, and it is the only status this
+ * rejects for a retirement. Demanding 200 for retirements instead would fail the
+ * run forever on exactly the articles the archive deliberately took down.
+ *
+ * 301 and 308 are both permanent; a server may answer GET with one and other
+ * methods with the other, so both are accepted.
+ */
+export function acceptsProbeStatus(status, retired) {
+    if (!retired)
+        return status === 200;
+    return status === 301 || status === 308 || status === 404;
+}
+//# sourceMappingURL=publication-continuity.js.map

package/dist/engine/publication-continuity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publication-continuity.js","sourceRoot":"","sources":["../../src/engine/publication-continuity.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAC3C,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,0EAA0E;AAC1E,gFAAgF;AAChF,EAAE;AACF,gFAAgF;AAChF,4BAA4B;AAiD5B,gEAAgE;AAChE,MAAM,UAAU,aAAa,CAAC,IAA8C;IAC3E,OAAO,IAAI,EAAE,QAAQ,EAAE,cAAc,KAAK,UAAU,CAAA;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,YAAY,CAC3B,IAA2B,EAC3B,GAA2B;IAE3B,4EAA4E;IAC5E,wEAAwE;IACxE,iBAAiB;IACjB,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,GAAG,CAAA;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;IACtC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAA;IAC5C,MAAM,QAAQ,GAAU,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAA;IAC5C,MAAM,UAAU,GAAuB,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAA;IACzF,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAA;IAE5C,MAAM,MAAM,GAA2B,EAAE,CAAA;IACzC,IAAI,GAAG,CAAC,SAAS,KAAK,KAAK;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACjD,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,KAAK,WAAW;QAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC7E,IAAI,MAAM,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACvE,IAAI,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,WAAW;QAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAC7E,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,MAAM,CAAC,KAAK,UAAU;QAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC5E,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,KAAK,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACjE,6EAA6E;IAC7E,+CAA+C;IAC/C,IAAI,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC,KAAK,IAAI;QAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAEjE,OAAO;QACN,OAAO,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC;QAC1B,MAAM;QACN,KAAK;QACL,WAAW;QACX,QAAQ;QACR,WAAW;QACX,UAAU;QACV,OAAO;QACP,IAAI;QACJ,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;KACpC,CAAA;AACF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,OAAgB;IAClE,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,KAAK,GAAG,CAAA;IACnC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAA;AAC1D,CAAC"}

package/dist/engine/publication-receipt/canonical-json.d.ts

@@ -0,0 +1,34 @@
+export declare class CanonicalJsonError extends Error {
+    readonly code: 'non_finite_number' | 'unsupported_type' | 'circular_reference';
+    constructor(code: CanonicalJsonError['code'], message: string);
+}
+type JsonPrimitive = string | number | boolean | null;
+export type JsonValue = JsonPrimitive | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+/**
+ * Serialize `value` per RFC 8785.
+ *
+ * Three things do the work, and each is load-bearing:
+ *
+ * 1. Object keys sort by UTF-16 code unit. JavaScript's default string sort is
+ *    already a UTF-16 code-unit comparison, which is exactly what §3.2.3
+ *    requires — so `.sort()` here is the specified behaviour, not a shortcut.
+ * 2. Numbers use ECMAScript `Number::toString`, which `JSON.stringify` applies.
+ *    §3.2.2.3 defers to that same algorithm, so the platform is authoritative
+ *    and reimplementing it would only introduce drift.
+ * 3. Strings use `JSON.stringify`'s escaping, which since ES2019 emits
+ *    well-formed output (lone surrogates escaped rather than passed through) —
+ *    §3.2.2.2's requirement.
+ *
+ * Non-finite numbers throw rather than becoming `null` as `JSON.stringify`
+ * would. A receipt containing `NaN` is a bug, and silently signing `null` in
+ * its place would make that bug undetectable downstream.
+ */
+export declare function canonicalJson(value: JsonValue): string;
+/** Canonical UTF-8 bytes, which are what gets hashed and signed. */
+export declare function canonicalJsonBytes(value: JsonValue): Uint8Array;
+/** Lowercase hex SHA-256 of the canonical bytes. */
+export declare function canonicalJsonSha256(value: JsonValue): Promise<string>;
+export {};
+//# sourceMappingURL=canonical-json.d.ts.map

package/dist/engine/publication-receipt/canonical-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.d.ts","sourceRoot":"","sources":["../../../src/engine/publication-receipt/canonical-json.ts"],"names":[],"mappings":"AAYA,qBAAa,kBAAmB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,mBAAmB,GAAG,kBAAkB,GAAG,oBAAoB,CAAA;gBAElE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM;CAK7D;AAED,KAAK,aAAa,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAA;AACrD,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,SAAS,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAA;AAElF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAEtD;AA4DD,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU,CAE/D;AAED,oDAAoD;AACpD,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAU3E"}

package/dist/engine/publication-receipt/canonical-json.js

@@ -0,0 +1,100 @@
+// RFC 8785 JSON Canonicalization Scheme (#342).
+//
+// A publication receipt is hashed and signed, and the same bytes must be
+// reproducible by Foundry from the same object. Canonicalization is what makes
+// that true: `JSON.stringify` alone is not stable, because object key order
+// follows insertion order rather than a defined sort.
+//
+// Deliberately implemented rather than pulled from a dependency. The whole
+// value here is that both sides agree byte-for-byte, so the algorithm should be
+// readable, pinned, and covered by the RFC's own vectors rather than tracking
+// someone else's semver.
+export class CanonicalJsonError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'CanonicalJsonError';
+        this.code = code;
+    }
+}
+/**
+ * Serialize `value` per RFC 8785.
+ *
+ * Three things do the work, and each is load-bearing:
+ *
+ * 1. Object keys sort by UTF-16 code unit. JavaScript's default string sort is
+ *    already a UTF-16 code-unit comparison, which is exactly what §3.2.3
+ *    requires — so `.sort()` here is the specified behaviour, not a shortcut.
+ * 2. Numbers use ECMAScript `Number::toString`, which `JSON.stringify` applies.
+ *    §3.2.2.3 defers to that same algorithm, so the platform is authoritative
+ *    and reimplementing it would only introduce drift.
+ * 3. Strings use `JSON.stringify`'s escaping, which since ES2019 emits
+ *    well-formed output (lone surrogates escaped rather than passed through) —
+ *    §3.2.2.2's requirement.
+ *
+ * Non-finite numbers throw rather than becoming `null` as `JSON.stringify`
+ * would. A receipt containing `NaN` is a bug, and silently signing `null` in
+ * its place would make that bug undetectable downstream.
+ */
+export function canonicalJson(value) {
+    return write(value, new Set());
+}
+function write(value, seen) {
+    if (value === null)
+        return 'null';
+    switch (typeof value) {
+        case 'boolean':
+            return value ? 'true' : 'false';
+        case 'number': {
+            if (!Number.isFinite(value)) {
+                throw new CanonicalJsonError('non_finite_number', `Cannot canonicalize non-finite number: ${String(value)}`);
+            }
+            // -0 serializes as "0" per RFC 8785 §3.2.2.3; JSON.stringify agrees.
+            return JSON.stringify(value);
+        }
+        case 'string':
+            return JSON.stringify(value);
+        case 'object':
+            break;
+        default:
+            throw new CanonicalJsonError('unsupported_type', `Cannot canonicalize value of type ${typeof value}`);
+    }
+    const object = value;
+    if (seen.has(object)) {
+        throw new CanonicalJsonError('circular_reference', 'Cannot canonicalize a circular structure');
+    }
+    seen.add(object);
+    try {
+        if (Array.isArray(value)) {
+            return `[${value.map((entry) => write(entry, seen)).join(',')}]`;
+        }
+        const record = value;
+        // Undefined-valued keys are omitted, matching JSON.stringify. RFC 8785
+        // has no representation for them.
+        const keys = Object.keys(record)
+            .filter((key) => record[key] !== undefined)
+            .sort();
+        const members = keys.map((key) => `${JSON.stringify(key)}:${write(record[key], seen)}`);
+        return `{${members.join(',')}}`;
+    }
+    finally {
+        seen.delete(object);
+    }
+}
+/** Canonical UTF-8 bytes, which are what gets hashed and signed. */
+export function canonicalJsonBytes(value) {
+    return new TextEncoder().encode(canonicalJson(value));
+}
+/** Lowercase hex SHA-256 of the canonical bytes. */
+export async function canonicalJsonSha256(value) {
+    // `Uint8Array.from` yields an ArrayBuffer-backed copy. TextEncoder returns
+    // `Uint8Array<ArrayBufferLike>`, which may be SharedArrayBuffer-backed and
+    // so is not a `BufferSource`. Same idiom as sha256Hex in
+    // @growth-labs/monitoring's site-agent signature helper.
+    const copy = Uint8Array.from(canonicalJsonBytes(value));
+    const digest = await globalThis.crypto.subtle.digest('SHA-256', copy);
+    return Array.from(new Uint8Array(digest))
+        .map((byte) => byte.toString(16).padStart(2, '0'))
+        .join('');
+}
+//# sourceMappingURL=canonical-json.js.map

package/dist/engine/publication-receipt/canonical-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.js","sourceRoot":"","sources":["../../../src/engine/publication-receipt/canonical-json.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,yEAAyE;AACzE,+EAA+E;AAC/E,4EAA4E;AAC5E,sDAAsD;AACtD,EAAE;AACF,2EAA2E;AAC3E,gFAAgF;AAChF,8EAA8E;AAC9E,yBAAyB;AAEzB,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACnC,IAAI,CAAiE;IAE9E,YAAY,IAAgC,EAAE,OAAe;QAC5D,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IACjB,CAAC;CACD;AAKD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,aAAa,CAAC,KAAgB;IAC7C,OAAO,KAAK,CAAC,KAAK,EAAE,IAAI,GAAG,EAAE,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,KAAK,CAAC,KAAgB,EAAE,IAAiB;IACjD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAA;IAEjC,QAAQ,OAAO,KAAK,EAAE,CAAC;QACtB,KAAK,SAAS;YACb,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;QAEhC,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,kBAAkB,CAC3B,mBAAmB,EACnB,0CAA0C,MAAM,CAAC,KAAK,CAAC,EAAE,CACzD,CAAA;YACF,CAAC;YACD,qEAAqE;YACrE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAC7B,CAAC;QAED,KAAK,QAAQ;YACZ,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAE7B,KAAK,QAAQ;YACZ,MAAK;QAEN;YACC,MAAM,IAAI,kBAAkB,CAC3B,kBAAkB,EAClB,qCAAqC,OAAO,KAAK,EAAE,CACnD,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,KAAe,CAAA;IAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,0CAA0C,CAAC,CAAA;IAC/F,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAEhB,IAAI,CAAC;QACJ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;QACjE,CAAC;QAED,MAAM,MAAM,GAAG,KAAqC,CAAA;QACpD,uEAAuE;QACvE,kCAAkC;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;aAC9B,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;aAC1C,IAAI,EAAE,CAAA;QAER,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CACvB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAc,EAAE,IAAI,CAAC,EAAE,CAC1E,CAAA;QACD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAChC,CAAC;YAAS,CAAC;QACV,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACpB,CAAC;AACF,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,kBAAkB,CAAC,KAAgB;IAClD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAA;AACtD,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAgB;IACzD,2EAA2E;IAC3E,2EAA2E;IAC3E,yDAAyD;IACzD,yDAAyD;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAA;IACvD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IACrE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;SACvC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACjD,IAAI,CAAC,EAAE,CAAC,CAAA;AACX,CAAC"}

package/dist/engine/publication-receipt/receipt.d.ts

@@ -0,0 +1,316 @@
+import { z } from 'zod';
+export declare const SITE_PUBLICATION_RECEIPT_SCHEMA: "site.publication.receipt.v1";
+export declare const SITE_PUBLICATION_RECEIPT_AUDIENCE: "foundry:site-publication-receipt";
+export declare const publicationProbeSchema: z.ZodObject<{
+    /** What was probed, e.g. `html` or `markdown`. */
+    kind: z.ZodEnum<["html", "markdown"]>;
+    url: z.ZodString;
+    status: z.ZodNumber;
+    /** SHA-256 of the exact bytes observed, so Foundry can compare. */
+    digest: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    status: number;
+    kind: "html" | "markdown";
+    url: string;
+    digest: string;
+}, {
+    status: number;
+    kind: "html" | "markdown";
+    url: string;
+    digest: string;
+}>;
+export declare const publicationProjectionCountsSchema: z.ZodObject<{
+    seo: z.ZodNumber;
+    search: z.ZodNumber;
+    sitemap: z.ZodNumber;
+    feed: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    search: number;
+    seo: number;
+    sitemap: number;
+    feed: number;
+}, {
+    search: number;
+    seo: number;
+    sitemap: number;
+    feed: number;
+}>;
+export declare const sitePublicationReceiptBodySchema: z.ZodEffects<z.ZodObject<{
+    schema: z.ZodLiteral<"site.publication.receipt.v1">;
+    audience: z.ZodLiteral<"foundry:site-publication-receipt">;
+    /** Success and failure are both signed; a silent failure is unverifiable. */
+    outcome: z.ZodEnum<["success", "failure"]>;
+    /** Identity of the publishing property (the site). */
+    property: z.ZodObject<{
+        id: z.ZodString;
+        origin: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        origin: string;
+    }, {
+        id: string;
+        origin: string;
+    }>;
+    /** Identity of the thing published, stable across revisions. */
+    content: z.ZodObject<{
+        stableId: z.ZodString;
+        slug: z.ZodString;
+        revisionId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        slug: string;
+        revisionId: string;
+        stableId: string;
+    }, {
+        slug: string;
+        revisionId: string;
+        stableId: string;
+    }>;
+    /** What produced it. */
+    source: z.ZodObject<{
+        commit: z.ZodString;
+        foundryHandoffId: z.ZodString;
+        foundryRunId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        commit: string;
+        foundryHandoffId: string;
+        foundryRunId: string;
+    }, {
+        commit: string;
+        foundryHandoffId: string;
+        foundryRunId: string;
+    }>;
+    /** Logical database identity — never a connection string or credential. */
+    database: z.ZodObject<{
+        logicalId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        logicalId: string;
+    }, {
+        logicalId: string;
+    }>;
+    /** Hash of the public media manifest, not the media itself. */
+    publicMediaManifestHash: z.ZodString;
+    projections: z.ZodObject<{
+        seo: z.ZodNumber;
+        search: z.ZodNumber;
+        sitemap: z.ZodNumber;
+        feed: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        search: number;
+        seo: number;
+        sitemap: number;
+        feed: number;
+    }, {
+        search: number;
+        seo: number;
+        sitemap: number;
+        feed: number;
+    }>;
+    probes: z.ZodArray<z.ZodObject<{
+        /** What was probed, e.g. `html` or `markdown`. */
+        kind: z.ZodEnum<["html", "markdown"]>;
+        url: z.ZodString;
+        status: z.ZodNumber;
+        /** SHA-256 of the exact bytes observed, so Foundry can compare. */
+        digest: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        status: number;
+        kind: "html" | "markdown";
+        url: string;
+        digest: string;
+    }, {
+        status: number;
+        kind: "html" | "markdown";
+        url: string;
+        digest: string;
+    }>, "many">;
+    /** How to undo this publication. */
+    rollback: z.ZodObject<{
+        pointer: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        pointer: string;
+    }, {
+        pointer: string;
+    }>;
+    /** Replay identity. Supplied by the caller and persisted, never generated here. */
+    nonce: z.ZodString;
+    issuedAt: z.ZodString;
+    /** Present only when `outcome` is `failure`, and bounded. */
+    failureReason: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    rollback: {
+        pointer: string;
+    };
+    source: {
+        commit: string;
+        foundryHandoffId: string;
+        foundryRunId: string;
+    };
+    content: {
+        slug: string;
+        revisionId: string;
+        stableId: string;
+    };
+    audience: "foundry:site-publication-receipt";
+    schema: "site.publication.receipt.v1";
+    outcome: "success" | "failure";
+    property: {
+        id: string;
+        origin: string;
+    };
+    database: {
+        logicalId: string;
+    };
+    publicMediaManifestHash: string;
+    projections: {
+        search: number;
+        seo: number;
+        sitemap: number;
+        feed: number;
+    };
+    probes: {
+        status: number;
+        kind: "html" | "markdown";
+        url: string;
+        digest: string;
+    }[];
+    nonce: string;
+    issuedAt: string;
+    failureReason?: string | undefined;
+}, {
+    rollback: {
+        pointer: string;
+    };
+    source: {
+        commit: string;
+        foundryHandoffId: string;
+        foundryRunId: string;
+    };
+    content: {
+        slug: string;
+        revisionId: string;
+        stableId: string;
+    };
+    audience: "foundry:site-publication-receipt";
+    schema: "site.publication.receipt.v1";
+    outcome: "success" | "failure";
+    property: {
+        id: string;
+        origin: string;
+    };
+    database: {
+        logicalId: string;
+    };
+    publicMediaManifestHash: string;
+    projections: {
+        search: number;
+        seo: number;
+        sitemap: number;
+        feed: number;
+    };
+    probes: {
+        status: number;
+        kind: "html" | "markdown";
+        url: string;
+        digest: string;
+    }[];
+    nonce: string;
+    issuedAt: string;
+    failureReason?: string | undefined;
+}>, {
+    rollback: {
+        pointer: string;
+    };
+    source: {
+        commit: string;
+        foundryHandoffId: string;
+        foundryRunId: string;
+    };
+    content: {
+        slug: string;
+        revisionId: string;
+        stableId: string;
+    };
+    audience: "foundry:site-publication-receipt";
+    schema: "site.publication.receipt.v1";
+    outcome: "success" | "failure";
+    property: {
+        id: string;
+        origin: string;
+    };
+    database: {
+        logicalId: string;
+    };
+    publicMediaManifestHash: string;
+    projections: {
+        search: number;
+        seo: number;
+        sitemap: number;
+        feed: number;
+    };
+    probes: {
+        status: number;
+        kind: "html" | "markdown";
+        url: string;
+        digest: string;
+    }[];
+    nonce: string;
+    issuedAt: string;
+    failureReason?: string | undefined;
+}, {
+    rollback: {
+        pointer: string;
+    };
+    source: {
+        commit: string;
+        foundryHandoffId: string;
+        foundryRunId: string;
+    };
+    content: {
+        slug: string;
+        revisionId: string;
+        stableId: string;
+    };
+    audience: "foundry:site-publication-receipt";
+    schema: "site.publication.receipt.v1";
+    outcome: "success" | "failure";
+    property: {
+        id: string;
+        origin: string;
+    };
+    database: {
+        logicalId: string;
+    };
+    publicMediaManifestHash: string;
+    projections: {
+        search: number;
+        seo: number;
+        sitemap: number;
+        feed: number;
+    };
+    probes: {
+        status: number;
+        kind: "html" | "markdown";
+        url: string;
+        digest: string;
+    }[];
+    nonce: string;
+    issuedAt: string;
+    failureReason?: string | undefined;
+}>;
+export type SitePublicationReceiptBody = z.infer<typeof sitePublicationReceiptBodySchema>;
+export declare class PublicationReceiptError extends Error {
+    readonly code: 'invalid_body' | 'invalid_key';
+    constructor(code: PublicationReceiptError['code'], message: string);
+}
+/**
+ * Validate a receipt body and return its canonical RFC 8785 form.
+ *
+ * Validation happens before canonicalization on purpose: signing an unvalidated
+ * body would produce a verifiable signature over a malformed claim, which is
+ * strictly worse than refusing, because downstream would trust it.
+ */
+export declare function canonicalizeReceiptBody(body: unknown): {
+    body: SitePublicationReceiptBody;
+    canonical: string;
+};
+//# sourceMappingURL=receipt.d.ts.map

package/dist/engine/publication-receipt/receipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt.d.ts","sourceRoot":"","sources":["../../../src/engine/publication-receipt/receipt.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,eAAO,MAAM,+BAA+B,EAAG,6BAAsC,CAAA;AACrF,eAAO,MAAM,iCAAiC,EAAG,kCAA2C,CAAA;AAoB5F,eAAO,MAAM,sBAAsB;IAEjC,kDAAkD;;;;IAIlD,mEAAmE;;;;;;;;;;;;EAG3D,CAAA;AAEV,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;EAOpC,CAAA;AAEV,eAAO,MAAM,gCAAgC;;;IAK3C,6EAA6E;;IAG7E,sDAAsD;;;;;;;;;;;IAGtD,gEAAgE;;;;;;;;;;;;;;IAShE,wBAAwB;;;;;;;;;;;;;;IASxB,2EAA2E;;;;;;;;IAG3E,+DAA+D;;;;;;;;;;;;;;;;;;;QAlD/D,kDAAkD;;;;QAIlD,mEAAmE;;;;;;;;;;;;;IAoDnE,oCAAoC;;;;;;;;IAGpC,mFAAmF;;;IAInF,6DAA6D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmB5D,CAAA;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAA;AAEzF,qBAAa,uBAAwB,SAAQ,KAAK;IACjD,QAAQ,CAAC,IAAI,EAAE,cAAc,GAAG,aAAa,CAAA;gBAEjC,IAAI,EAAE,uBAAuB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM;CAKlE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,OAAO,GAAG;IACvD,IAAI,EAAE,0BAA0B,CAAA;IAChC,SAAS,EAAE,MAAM,CAAA;CACjB,CAcA"}