@lamgig/content-schemas 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 LamGig
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,105 @@
+# @lamgig/content-schemas
+
+The **published-JSON contract**: the Zod schemas, canonical serialization, and fixtures that
+define what a LamGig site publishes and what every consumer (websites, apps) may rely on.
+Locked in Phase 2 T1 ([docs/phases/phase-2.md](../../docs/phases/phase-2.md)); changing any
+locked decision is a `schemaVersion` discussion, not an edit.
+
+## Install
+
+```bash
+npm install @lamgig/content-schemas
+```
+
+Published to npm as a **public** package from this workspace (`npm publish -w
+@lamgig/content-schemas`). It is the contract consumers depend on — websites and apps rendering
+a LamGig site — so treat its version as a public API:
+
+| Change | npm bump |
+|---|---|
+| New **optional** field or new **optional** module key | minor |
+| Anything that bumps `SCHEMA_VERSION` (required addition, removal, type change) | major |
+| Docs, fixtures-neutral internals | patch |
+
+**Consumers import the tolerant exports** (`contentFileSchema`), never the `*Strict` ones — those
+are the dashboard's gate on its own output. See the compatibility rule below.
+
+## Two parse modes, one definition
+
+Every schema exists as a pair built from a single definition (an injected object factory —
+zod's `.strip()`/`.passthrough()` do not recurse, so per-tree factories are the only way to
+get uniform strictness):
+
+| Export | Mode | Who uses it |
+|---|---|---|
+| `contentFileSchemaStrict` (+ `*SchemaStrict` per module) | `.strict()` everywhere — unknown keys are **errors** | The dashboard, validating **its own output** before publishing (producer gate) |
+| `contentFileSchema` (+ `*Schema` per module) | tolerant — unknown object keys **stripped**, unknown module keys **ignored** | Shipped consumers |
+
+## Compatibility rule (schemaVersion 1)
+
+- Within `schemaVersion: 1`, new fields **and** new module keys MUST be optional or defaulted
+  for consumers. A consumer built yesterday must accept a payload published tomorrow.
+- Adding any **required** field or required module is breaking — retained/rollback snapshots
+  will not contain it — and bumps `schemaVersion`.
+- Consumers MUST use the tolerant schemas and ignore unknown fields. The forward-compat tests
+  in [`test/contract.test.ts`](test/contract.test.ts) enforce exactly this: the v1 tolerant
+  schema accepts `full.json` plus an injected unknown optional field and an unknown module key.
+- All three v1 modules (`siteSettings`, `branding`, `menu`) are **required**. Empty states are
+  valid payloads (`menu.categories: []`), never missing keys.
+
+## Canonical serialization
+
+`canonicalize(payload)` produces recursively key-sorted JSON with no whitespace:
+
+- arrays keep their order; object keys sort by code unit (`Array.prototype.sort`);
+- object properties with value `undefined` are omitted;
+- `undefined` elsewhere, non-finite numbers, bigints, functions, symbols **throw** — nothing
+  is silently coerced.
+
+`hashContent(payload)` = `"sha256:" + hex(sha256(utf8(canonicalize(payload))))`. The publisher
+persists this as `payload_hash`; consumer tests must use the same functions so hash comparison
+is byte-exact. `hashContent` lives in the node-only subpath **`@lamgig/content-schemas/hash`**
+(it needs `node:crypto`); the main entry stays importable from client bundles. Max canonical
+payload size: `MAX_CONTENT_BYTES` (1 MiB), enforced by the publisher.
+
+## Asset URLs: paths in the DB, URLs in the payload
+
+Published payloads embed **absolute** asset URLs (`logoUrl`, `faviconUrl`, `imageUrl`) built by
+the dashboard's single URL source, `apps/dashboard/src/lib/content-urls.ts`
+(`storagePublicUrl('assets', path)` — Spike B contract). The database stores **storage paths**,
+and the SQL gather functions emit them under path-named keys (`logoPath`/`faviconPath`/
+`imagePath`) because SQL cannot know the environment-dependent public base; at publish time the
+mapping to URLs happens, and the path keys are stripped, **before** strict validation.
+Decision recorded 2026-07-22 (founder-approved).
+
+Since Phase 6 (D28) that mapping belongs to **each module's own `publisher.ts`**, as the optional
+`compose` of the `Publisher` contract — not to `modules/publishing/compose.ts`, which now iterates
+the publisher registry and names no module. A module that stores no storage paths declares no
+`compose`. The producer side of this contract is pinned by
+`apps/dashboard/src/modules/publishing/compose.test.ts`, which feeds gathered PATHS in and requires
+`fixtures/v1/full.json` and its checked-in hash back out, byte for byte.
+
+**Dependency direction: this package never imports from the app.** Fixtures contain static
+expected URL strings (base `https://example.supabase.co`); a dashboard-side test asserts the
+URL builder reproduces them exactly.
+
+## Shared patterns = DB CHECKs
+
+`LOCALE_PATTERN_SOURCE` (`^[a-z]{2}(-[A-Z]{2})?$` — the v1 BCP-47 subset `ll` / `ll-CC`),
+`HEX_COLOR_PATTERN_SOURCE`, and `CURRENCY_PATTERN_SOURCE` are the exact strings used by the
+corresponding DB CHECK constraints (`supabase/migrations/*_content_*.sql`), so the contract
+and the database can never disagree. Widening the locale subset later is additive.
+
+## Fixtures (`fixtures/v1/`)
+
+- `full.json` — realistic restaurant, every optional field populated.
+- `minimal.json` — empty menu, no optional fields; also the reference shape for the
+  fresh-site validity check (a newly provisioned site must gather to this shape).
+- `hashes.json` — checked-in `hashContent` snapshots; a mismatch means serialization or a
+  fixture changed, both locked decisions.
+
+## Test
+
+```
+npm test -w @lamgig/content-schemas   # vitest
+```

package/dist/chunk-KBPOR3WL.js

@@ -0,0 +1,186 @@
+// src/index.ts
+import { z } from "zod";
+var SCHEMA_VERSION = 1;
+var MAX_CONTENT_BYTES = 1048576;
+var LOCALE_PATTERN_SOURCE = "^[a-z]{2}(-[A-Z]{2})?$";
+var LOCALE_PATTERN = new RegExp(LOCALE_PATTERN_SOURCE);
+var HEX_COLOR_PATTERN_SOURCE = "^#[0-9A-Fa-f]{6}$";
+var HEX_COLOR_PATTERN = new RegExp(HEX_COLOR_PATTERN_SOURCE);
+var CURRENCY_PATTERN_SOURCE = "^[A-Z]{3}$";
+var CURRENCY_PATTERN = new RegExp(CURRENCY_PATTERN_SOURCE);
+var COUNTRY_PATTERN_SOURCE = "^[A-Z]{2}$";
+var COUNTRY_PATTERN = new RegExp(COUNTRY_PATTERN_SOURCE);
+function isIanaTimeZone(tz) {
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: tz });
+    return true;
+  } catch {
+    return false;
+  }
+}
+var strictFactory = z.strictObject;
+var tolerantFactory = z.object;
+var makeSiteSettingsSchema = (o) => o({
+  siteName: z.string().min(1).max(120),
+  tagline: z.string().max(200).optional(),
+  contact: o({
+    email: z.email().optional(),
+    phone: z.string().min(1).optional(),
+    address: o({
+      line1: z.string().min(1),
+      line2: z.string().min(1).optional(),
+      city: z.string().min(1),
+      region: z.string().min(1),
+      postalCode: z.string().min(1),
+      country: z.string().regex(COUNTRY_PATTERN)
+    }).optional()
+  }),
+  // Explicit known keys (NOT a record): strict rejects unknown platforms,
+  // tolerant strips them — adding a platform later is additive.
+  socialLinks: o({
+    facebook: z.url().optional(),
+    instagram: z.url().optional(),
+    tiktok: z.url().optional(),
+    x: z.url().optional(),
+    youtube: z.url().optional(),
+    yelp: z.url().optional(),
+    google: z.url().optional()
+  }).optional(),
+  locale: z.string().regex(LOCALE_PATTERN).default("en-US"),
+  timezone: z.string().min(1).refine(isIanaTimeZone, "must be an IANA time zone name").default("America/Los_Angeles")
+});
+var siteSettingsSchemaStrict = makeSiteSettingsSchema(strictFactory);
+var siteSettingsSchema = makeSiteSettingsSchema(tolerantFactory);
+var makeBrandingSchema = (o) => o({
+  // Absolute URLs produced by the dashboard's storagePublicUrl builder
+  // (apps/dashboard/src/lib/content-urls.ts). The DB stores storage PATHS;
+  // the publish-time compose maps path -> URL. This package never imports
+  // from the app (dependency direction, phase-2.md T1.7).
+  logoUrl: z.url().optional(),
+  faviconUrl: z.url().optional(),
+  colors: o({
+    primary: z.string().regex(HEX_COLOR_PATTERN),
+    secondary: z.string().regex(HEX_COLOR_PATTERN).optional(),
+    accent: z.string().regex(HEX_COLOR_PATTERN).optional(),
+    background: z.string().regex(HEX_COLOR_PATTERN).optional(),
+    text: z.string().regex(HEX_COLOR_PATTERN).optional()
+  }),
+  fonts: o({
+    heading: z.string().min(1).optional(),
+    body: z.string().min(1).optional()
+  }).optional()
+});
+var brandingSchemaStrict = makeBrandingSchema(strictFactory);
+var brandingSchema = makeBrandingSchema(tolerantFactory);
+var makeMenuItemSchema = (o) => o({
+  /** Stable DB UUID — identical across publishes (phase-2.md T1.3). */
+  id: z.uuid(),
+  name: z.string().min(1).max(200),
+  description: z.string().max(2e3).optional(),
+  price: o({
+    /** Integer minor units (e.g. cents). */
+    amount: z.number().int().min(0),
+    currency: z.string().regex(CURRENCY_PATTERN)
+  }),
+  imageUrl: z.url().optional(),
+  tags: z.array(z.string().min(1)).max(20),
+  sortOrder: z.number().int().min(0).max(1e5),
+  isAvailable: z.boolean()
+});
+var makeMenuCategorySchema = (o) => o({
+  id: z.uuid(),
+  name: z.string().min(1).max(200),
+  description: z.string().max(2e3).optional(),
+  sortOrder: z.number().int().min(0).max(1e5),
+  items: z.array(makeMenuItemSchema(o))
+});
+var makeMenuSchema = (o) => o({
+  /** Archived/deleted entities are simply ABSENT; empty menu = `[]`, never a missing key. */
+  categories: z.array(makeMenuCategorySchema(o))
+});
+var menuSchemaStrict = makeMenuSchema(strictFactory);
+var menuSchema = makeMenuSchema(tolerantFactory);
+var makeContentFileSchema = (o) => o({
+  schemaVersion: z.literal(1),
+  site: o({ id: z.uuid(), slug: z.string().min(1) }),
+  publishedAt: z.iso.datetime(),
+  // All three modules REQUIRED; empty states are valid module payloads
+  // (e.g. menu.categories: []), never missing keys. A new required module is
+  // breaking (retained/rollback snapshots won't contain it) — bump
+  // SCHEMA_VERSION instead.
+  modules: o({
+    siteSettings: makeSiteSettingsSchema(o),
+    branding: makeBrandingSchema(o),
+    menu: makeMenuSchema(o)
+  })
+});
+var contentFileSchemaStrict = makeContentFileSchema(strictFactory);
+var contentFileSchema = makeContentFileSchema(tolerantFactory);
+function canonicalize(payload) {
+  const out = serialize(payload);
+  if (out === void 0) {
+    throw new TypeError("canonicalize: payload itself serializes to nothing (undefined)");
+  }
+  return out;
+}
+function serialize(value) {
+  if (value === void 0) return void 0;
+  if (value === null) return "null";
+  switch (typeof value) {
+    case "string":
+    case "boolean":
+      return JSON.stringify(value);
+    case "number":
+      if (!Number.isFinite(value)) {
+        throw new TypeError(`canonicalize: non-finite number ${String(value)}`);
+      }
+      return JSON.stringify(value);
+    case "object":
+      break;
+    default:
+      throw new TypeError(`canonicalize: unsupported value of type ${typeof value}`);
+  }
+  if (Array.isArray(value)) {
+    const parts2 = value.map((entry) => {
+      const s = serialize(entry);
+      if (s === void 0) {
+        throw new TypeError("canonicalize: undefined array element");
+      }
+      return s;
+    });
+    return `[${parts2.join(",")}]`;
+  }
+  const record = value;
+  const keys = Object.keys(record).sort();
+  const parts = [];
+  for (const key of keys) {
+    const s = serialize(record[key]);
+    if (s === void 0) continue;
+    parts.push(`${JSON.stringify(key)}:${s}`);
+  }
+  return `{${parts.join(",")}}`;
+}
+
+export {
+  SCHEMA_VERSION,
+  MAX_CONTENT_BYTES,
+  LOCALE_PATTERN_SOURCE,
+  LOCALE_PATTERN,
+  HEX_COLOR_PATTERN_SOURCE,
+  HEX_COLOR_PATTERN,
+  CURRENCY_PATTERN_SOURCE,
+  CURRENCY_PATTERN,
+  COUNTRY_PATTERN_SOURCE,
+  COUNTRY_PATTERN,
+  isIanaTimeZone,
+  siteSettingsSchemaStrict,
+  siteSettingsSchema,
+  brandingSchemaStrict,
+  brandingSchema,
+  menuSchemaStrict,
+  menuSchema,
+  contentFileSchemaStrict,
+  contentFileSchema,
+  canonicalize
+};
+//# sourceMappingURL=chunk-KBPOR3WL.js.map

package/dist/chunk-KBPOR3WL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { z } from 'zod';\n\n/**\n * Version of the published-JSON contract. Additive changes (new OPTIONAL fields\n * and new OPTIONAL module keys) keep this number; any required addition is\n * breaking and bumps it. The full compatibility rule lives in this package's\n * README. See PLAN.md § Published JSON delivery and phase-2.md T1.5.\n */\nexport const SCHEMA_VERSION = 1;\n\n/** Publisher-enforced ceiling on the canonical payload size (1 MiB). */\nexport const MAX_CONTENT_BYTES = 1_048_576;\n\n// ---------------------------------------------------------------------------\n// Shared value patterns — single source of truth.\n//\n// LOCALE_PATTERN_SOURCE is the EXACT string used by the `site_settings.locale`\n// DB CHECK (supabase/migrations/*_content_site_settings.sql). Contract and\n// database must never disagree (phase-2.md T1.1): v1 supports the named BCP-47\n// subset `ll` or `ll-CC` only (e.g. `en`, `en-US`); script/numeric-region forms\n// (`zh-Hant`, `es-419`) are out of scope — widening later is additive.\n// HEX_COLOR / CURRENCY are likewise mirrored by DB CHECKs on `branding.colors`\n// and `menu_items.price_currency`.\n// ---------------------------------------------------------------------------\n\nexport const LOCALE_PATTERN_SOURCE = '^[a-z]{2}(-[A-Z]{2})?$';\nexport const LOCALE_PATTERN = new RegExp(LOCALE_PATTERN_SOURCE);\n\nexport const HEX_COLOR_PATTERN_SOURCE = '^#[0-9A-Fa-f]{6}$';\nexport const HEX_COLOR_PATTERN = new RegExp(HEX_COLOR_PATTERN_SOURCE);\n\n/** ISO 4217 alpha code shape (mirrored by the `price_currency` DB CHECK). */\nexport const CURRENCY_PATTERN_SOURCE = '^[A-Z]{3}$';\nexport const CURRENCY_PATTERN = new RegExp(CURRENCY_PATTERN_SOURCE);\n\n/** ISO 3166-1 alpha-2 country code shape. */\nexport const COUNTRY_PATTERN_SOURCE = '^[A-Z]{2}$';\nexport const COUNTRY_PATTERN = new RegExp(COUNTRY_PATTERN_SOURCE);\n\n/** IANA time zone check via the runtime's own tz database. */\nexport function isIanaTimeZone(tz: string): boolean {\n  try {\n    new Intl.DateTimeFormat('en-US', { timeZone: tz });\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Two parse modes from ONE schema definition (phase-2.md T1):\n//\n//   - producer-strict  — `.strict()` everywhere; the dashboard validates its own\n//     output against this before publishing. Unknown keys are defects.\n//   - consumer-tolerant — unknown object keys are STRIPPED and unknown module\n//     keys ignored, so a shipped consumer accepts a v1 payload that later gained\n//     an optional field or a new module key (the additive changes the\n//     compatibility rule promises).\n//\n// zod v4's `.strip()`/`.passthrough()` do NOT recurse into nested objects, so a\n// post-hoc transform of one tree silently leaves nested objects in the original\n// mode. Instead every object in the tree is built through an injected object\n// factory: `z.strictObject` for the strict pair, `z.object` (strips unknown\n// keys) for the tolerant pair. One definition, two instantiations.\n// ---------------------------------------------------------------------------\n\ntype ObjectFactory = <T extends z.ZodRawShape>(shape: T) => z.ZodObject<T>;\n\nconst strictFactory = z.strictObject as ObjectFactory;\nconst tolerantFactory = z.object as ObjectFactory;\n\n// --- siteSettings ----------------------------------------------------------\n\nconst makeSiteSettingsSchema = (o: ObjectFactory) =>\n  o({\n    siteName: z.string().min(1).max(120),\n    tagline: z.string().max(200).optional(),\n    contact: o({\n      email: z.email().optional(),\n      phone: z.string().min(1).optional(),\n      address: o({\n        line1: z.string().min(1),\n        line2: z.string().min(1).optional(),\n        city: z.string().min(1),\n        region: z.string().min(1),\n        postalCode: z.string().min(1),\n        country: z.string().regex(COUNTRY_PATTERN),\n      }).optional(),\n    }),\n    // Explicit known keys (NOT a record): strict rejects unknown platforms,\n    // tolerant strips them — adding a platform later is additive.\n    socialLinks: o({\n      facebook: z.url().optional(),\n      instagram: z.url().optional(),\n      tiktok: z.url().optional(),\n      x: z.url().optional(),\n      youtube: z.url().optional(),\n      yelp: z.url().optional(),\n      google: z.url().optional(),\n    }).optional(),\n    locale: z.string().regex(LOCALE_PATTERN).default('en-US'),\n    timezone: z\n      .string()\n      .min(1)\n      .refine(isIanaTimeZone, 'must be an IANA time zone name')\n      .default('America/Los_Angeles'),\n  });\n\nexport const siteSettingsSchemaStrict = makeSiteSettingsSchema(strictFactory);\nexport const siteSettingsSchema = makeSiteSettingsSchema(tolerantFactory);\n\n// --- branding --------------------------------------------------------------\n\nconst makeBrandingSchema = (o: ObjectFactory) =>\n  o({\n    // Absolute URLs produced by the dashboard's storagePublicUrl builder\n    // (apps/dashboard/src/lib/content-urls.ts). The DB stores storage PATHS;\n    // the publish-time compose maps path -> URL. This package never imports\n    // from the app (dependency direction, phase-2.md T1.7).\n    logoUrl: z.url().optional(),\n    faviconUrl: z.url().optional(),\n    colors: o({\n      primary: z.string().regex(HEX_COLOR_PATTERN),\n      secondary: z.string().regex(HEX_COLOR_PATTERN).optional(),\n      accent: z.string().regex(HEX_COLOR_PATTERN).optional(),\n      background: z.string().regex(HEX_COLOR_PATTERN).optional(),\n      text: z.string().regex(HEX_COLOR_PATTERN).optional(),\n    }),\n    fonts: o({\n      heading: z.string().min(1).optional(),\n      body: z.string().min(1).optional(),\n    }).optional(),\n  });\n\nexport const brandingSchemaStrict = makeBrandingSchema(strictFactory);\nexport const brandingSchema = makeBrandingSchema(tolerantFactory);\n\n// --- menu ------------------------------------------------------------------\n\nconst makeMenuItemSchema = (o: ObjectFactory) =>\n  o({\n    /** Stable DB UUID — identical across publishes (phase-2.md T1.3). */\n    id: z.uuid(),\n    name: z.string().min(1).max(200),\n    description: z.string().max(2000).optional(),\n    price: o({\n      /** Integer minor units (e.g. cents). */\n      amount: z.number().int().min(0),\n      currency: z.string().regex(CURRENCY_PATTERN),\n    }),\n    imageUrl: z.url().optional(),\n    tags: z.array(z.string().min(1)).max(20),\n    sortOrder: z.number().int().min(0).max(100_000),\n    isAvailable: z.boolean(),\n  });\n\nconst makeMenuCategorySchema = (o: ObjectFactory) =>\n  o({\n    id: z.uuid(),\n    name: z.string().min(1).max(200),\n    description: z.string().max(2000).optional(),\n    sortOrder: z.number().int().min(0).max(100_000),\n    items: z.array(makeMenuItemSchema(o)),\n  });\n\nconst makeMenuSchema = (o: ObjectFactory) =>\n  o({\n    /** Archived/deleted entities are simply ABSENT; empty menu = `[]`, never a missing key. */\n    categories: z.array(makeMenuCategorySchema(o)),\n  });\n\nexport const menuSchemaStrict = makeMenuSchema(strictFactory);\nexport const menuSchema = makeMenuSchema(tolerantFactory);\n\n// --- content file ----------------------------------------------------------\n\nconst makeContentFileSchema = (o: ObjectFactory) =>\n  o({\n    schemaVersion: z.literal(1),\n    site: o({ id: z.uuid(), slug: z.string().min(1) }),\n    publishedAt: z.iso.datetime(),\n    // All three modules REQUIRED; empty states are valid module payloads\n    // (e.g. menu.categories: []), never missing keys. A new required module is\n    // breaking (retained/rollback snapshots won't contain it) — bump\n    // SCHEMA_VERSION instead.\n    modules: o({\n      siteSettings: makeSiteSettingsSchema(o),\n      branding: makeBrandingSchema(o),\n      menu: makeMenuSchema(o),\n    }),\n  });\n\n/** Producer gate: the dashboard validates its own output against this. */\nexport const contentFileSchemaStrict = makeContentFileSchema(strictFactory);\n/** Public consumer schema: tolerant of additive v1 changes. */\nexport const contentFileSchema = makeContentFileSchema(tolerantFactory);\n\nexport type SiteSettings = z.infer<typeof siteSettingsSchemaStrict>;\nexport type Branding = z.infer<typeof brandingSchemaStrict>;\nexport type Menu = z.infer<typeof menuSchemaStrict>;\nexport type MenuCategory = Menu['categories'][number];\nexport type MenuItem = MenuCategory['items'][number];\nexport type ContentFile = z.infer<typeof contentFileSchemaStrict>;\n\n// ---------------------------------------------------------------------------\n// Canonical serialization (phase-2.md T1.6).\n//\n// Recursively key-sorted JSON with no whitespace, produced by a hand-rolled\n// serializer rather than JSON.stringify over a re-built object — rebuilding\n// depends on JS insertion-order semantics and silently reorders integer-like\n// keys. Determinism here is what makes `hashContent` a byte-equality contract\n// shared by the publisher and every consumer test.\n//\n// Rules (documented in the README):\n//   - arrays keep their order; object keys are sorted with Array.prototype.sort\n//     (code-unit order);\n//   - object properties whose value is `undefined` are omitted (JSON semantics);\n//   - `undefined` anywhere else, non-finite numbers, bigint, functions and\n//     symbols THROW — never silently coerced the way JSON.stringify would.\n// ---------------------------------------------------------------------------\n\nexport function canonicalize(payload: unknown): string {\n  const out = serialize(payload);\n  if (out === undefined) {\n    throw new TypeError('canonicalize: payload itself serializes to nothing (undefined)');\n  }\n  return out;\n}\n\nfunction serialize(value: unknown): string | undefined {\n  if (value === undefined) return undefined;\n  if (value === null) return 'null';\n  switch (typeof value) {\n    case 'string':\n    case 'boolean':\n      return JSON.stringify(value);\n    case 'number':\n      if (!Number.isFinite(value)) {\n        throw new TypeError(`canonicalize: non-finite number ${String(value)}`);\n      }\n      return JSON.stringify(value);\n    case 'object':\n      break;\n    default:\n      throw new TypeError(`canonicalize: unsupported value of type ${typeof value}`);\n  }\n  if (Array.isArray(value)) {\n    const parts = value.map((entry) => {\n      const s = serialize(entry);\n      if (s === undefined) {\n        throw new TypeError('canonicalize: undefined array element');\n      }\n      return s;\n    });\n    return `[${parts.join(',')}]`;\n  }\n  const record = value as Record<string, unknown>;\n  const keys = Object.keys(record).sort();\n  const parts: string[] = [];\n  for (const key of keys) {\n    const s = serialize(record[key]);\n    if (s === undefined) continue; // undefined property -> omitted key\n    parts.push(`${JSON.stringify(key)}:${s}`);\n  }\n  return `{${parts.join(',')}}`;\n}\n"],"mappings":";AAAA,SAAS,SAAS;AAQX,IAAM,iBAAiB;AAGvB,IAAM,oBAAoB;AAc1B,IAAM,wBAAwB;AAC9B,IAAM,iBAAiB,IAAI,OAAO,qBAAqB;AAEvD,IAAM,2BAA2B;AACjC,IAAM,oBAAoB,IAAI,OAAO,wBAAwB;AAG7D,IAAM,0BAA0B;AAChC,IAAM,mBAAmB,IAAI,OAAO,uBAAuB;AAG3D,IAAM,yBAAyB;AAC/B,IAAM,kBAAkB,IAAI,OAAO,sBAAsB;AAGzD,SAAS,eAAe,IAAqB;AAClD,MAAI;AACF,QAAI,KAAK,eAAe,SAAS,EAAE,UAAU,GAAG,CAAC;AACjD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAqBA,IAAM,gBAAgB,EAAE;AACxB,IAAM,kBAAkB,EAAE;AAI1B,IAAM,yBAAyB,CAAC,MAC9B,EAAE;AAAA,EACA,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACtC,SAAS,EAAE;AAAA,IACT,OAAO,EAAE,MAAM,EAAE,SAAS;AAAA,IAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IAClC,SAAS,EAAE;AAAA,MACT,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACvB,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,MAClC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACtB,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACxB,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MAC5B,SAAS,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,IAC3C,CAAC,EAAE,SAAS;AAAA,EACd,CAAC;AAAA;AAAA;AAAA,EAGD,aAAa,EAAE;AAAA,IACb,UAAU,EAAE,IAAI,EAAE,SAAS;AAAA,IAC3B,WAAW,EAAE,IAAI,EAAE,SAAS;AAAA,IAC5B,QAAQ,EAAE,IAAI,EAAE,SAAS;AAAA,IACzB,GAAG,EAAE,IAAI,EAAE,SAAS;AAAA,IACpB,SAAS,EAAE,IAAI,EAAE,SAAS;AAAA,IAC1B,MAAM,EAAE,IAAI,EAAE,SAAS;AAAA,IACvB,QAAQ,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3B,CAAC,EAAE,SAAS;AAAA,EACZ,QAAQ,EAAE,OAAO,EAAE,MAAM,cAAc,EAAE,QAAQ,OAAO;AAAA,EACxD,UAAU,EACP,OAAO,EACP,IAAI,CAAC,EACL,OAAO,gBAAgB,gCAAgC,EACvD,QAAQ,qBAAqB;AAClC,CAAC;AAEI,IAAM,2BAA2B,uBAAuB,aAAa;AACrE,IAAM,qBAAqB,uBAAuB,eAAe;AAIxE,IAAM,qBAAqB,CAAC,MAC1B,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,SAAS,EAAE,IAAI,EAAE,SAAS;AAAA,EAC1B,YAAY,EAAE,IAAI,EAAE,SAAS;AAAA,EAC7B,QAAQ,EAAE;AAAA,IACR,SAAS,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,IAC3C,WAAW,EAAE,OAAO,EAAE,MAAM,iBAAiB,EAAE,SAAS;AAAA,IACxD,QAAQ,EAAE,OAAO,EAAE,MAAM,iBAAiB,EAAE,SAAS;AAAA,IACrD,YAAY,EAAE,OAAO,EAAE,MAAM,iBAAiB,EAAE,SAAS;AAAA,IACzD,MAAM,EAAE,OAAO,EAAE,MAAM,iBAAiB,EAAE,SAAS;AAAA,EACrD,CAAC;AAAA,EACD,OAAO,EAAE;AAAA,IACP,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IACpC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnC,CAAC,EAAE,SAAS;AACd,CAAC;AAEI,IAAM,uBAAuB,mBAAmB,aAAa;AAC7D,IAAM,iBAAiB,mBAAmB,eAAe;AAIhE,IAAM,qBAAqB,CAAC,MAC1B,EAAE;AAAA;AAAA,EAEA,IAAI,EAAE,KAAK;AAAA,EACX,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,aAAa,EAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC3C,OAAO,EAAE;AAAA;AAAA,IAEP,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,IAC9B,UAAU,EAAE,OAAO,EAAE,MAAM,gBAAgB;AAAA,EAC7C,CAAC;AAAA,EACD,UAAU,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE;AAAA,EACvC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAO;AAAA,EAC9C,aAAa,EAAE,QAAQ;AACzB,CAAC;AAEH,IAAM,yBAAyB,CAAC,MAC9B,EAAE;AAAA,EACA,IAAI,EAAE,KAAK;AAAA,EACX,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,aAAa,EAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC3C,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAO;AAAA,EAC9C,OAAO,EAAE,MAAM,mBAAmB,CAAC,CAAC;AACtC,CAAC;AAEH,IAAM,iBAAiB,CAAC,MACtB,EAAE;AAAA;AAAA,EAEA,YAAY,EAAE,MAAM,uBAAuB,CAAC,CAAC;AAC/C,CAAC;AAEI,IAAM,mBAAmB,eAAe,aAAa;AACrD,IAAM,aAAa,eAAe,eAAe;AAIxD,IAAM,wBAAwB,CAAC,MAC7B,EAAE;AAAA,EACA,eAAe,EAAE,QAAQ,CAAC;AAAA,EAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,EACjD,aAAa,EAAE,IAAI,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK5B,SAAS,EAAE;AAAA,IACT,cAAc,uBAAuB,CAAC;AAAA,IACtC,UAAU,mBAAmB,CAAC;AAAA,IAC9B,MAAM,eAAe,CAAC;AAAA,EACxB,CAAC;AACH,CAAC;AAGI,IAAM,0BAA0B,sBAAsB,aAAa;AAEnE,IAAM,oBAAoB,sBAAsB,eAAe;AA0B/D,SAAS,aAAa,SAA0B;AACrD,QAAM,MAAM,UAAU,OAAO;AAC7B,MAAI,QAAQ,QAAW;AACrB,UAAM,IAAI,UAAU,gEAAgE;AAAA,EACtF;AACA,SAAO;AACT;AAEA,SAAS,UAAU,OAAoC;AACrD,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,UAAU,KAAM,QAAO;AAC3B,UAAQ,OAAO,OAAO;AAAA,IACpB,KAAK;AAAA,IACL,KAAK;AACH,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B,KAAK;AACH,UAAI,CAAC,OAAO,SAAS,KAAK,GAAG;AAC3B,cAAM,IAAI,UAAU,mCAAmC,OAAO,KAAK,CAAC,EAAE;AAAA,MACxE;AACA,aAAO,KAAK,UAAU,KAAK;AAAA,IAC7B,KAAK;AACH;AAAA,IACF;AACE,YAAM,IAAI,UAAU,2CAA2C,OAAO,KAAK,EAAE;AAAA,EACjF;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAMA,SAAQ,MAAM,IAAI,CAAC,UAAU;AACjC,YAAM,IAAI,UAAU,KAAK;AACzB,UAAI,MAAM,QAAW;AACnB,cAAM,IAAI,UAAU,uCAAuC;AAAA,MAC7D;AACA,aAAO;AAAA,IACT,CAAC;AACD,WAAO,IAAIA,OAAM,KAAK,GAAG,CAAC;AAAA,EAC5B;AACA,QAAM,SAAS;AACf,QAAM,OAAO,OAAO,KAAK,MAAM,EAAE,KAAK;AACtC,QAAM,QAAkB,CAAC;AACzB,aAAW,OAAO,MAAM;AACtB,UAAM,IAAI,UAAU,OAAO,GAAG,CAAC;AAC/B,QAAI,MAAM,OAAW;AACrB,UAAM,KAAK,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,CAAC,EAAE;AAAA,EAC1C;AACA,SAAO,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5B;","names":["parts"]}

package/dist/hash.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `sha256:` + hex digest of the canonical UTF-8 bytes. The publisher persists
+ * this as `payload_hash`; consumer tests use the SAME function so hash
+ * comparisons are always over identical canonical bytes (phase-2.md T1.6).
+ *
+ * Node-only subpath (`@lamgig/content-schemas/hash`): it needs `node:crypto`
+ * for a synchronous digest, and the main entry must stay importable from
+ * client bundles (form schemas reuse its patterns).
+ */
+declare function hashContent(payload: unknown): string;
+
+export { hashContent };

package/dist/hash.js

@@ -0,0 +1,14 @@
+import {
+  canonicalize
+} from "./chunk-KBPOR3WL.js";
+
+// src/hash.ts
+import { createHash } from "crypto";
+function hashContent(payload) {
+  const canonical = canonicalize(payload);
+  return `sha256:${createHash("sha256").update(canonical, "utf8").digest("hex")}`;
+}
+export {
+  hashContent
+};
+//# sourceMappingURL=hash.js.map

package/dist/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/hash.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\n\nimport { canonicalize } from './index.js';\n\n/**\n * `sha256:` + hex digest of the canonical UTF-8 bytes. The publisher persists\n * this as `payload_hash`; consumer tests use the SAME function so hash\n * comparisons are always over identical canonical bytes (phase-2.md T1.6).\n *\n * Node-only subpath (`@lamgig/content-schemas/hash`): it needs `node:crypto`\n * for a synchronous digest, and the main entry must stay importable from\n * client bundles (form schemas reuse its patterns).\n */\nexport function hashContent(payload: unknown): string {\n  const canonical = canonicalize(payload);\n  return `sha256:${createHash('sha256').update(canonical, 'utf8').digest('hex')}`;\n}\n"],"mappings":";;;;;AAAA,SAAS,kBAAkB;AAapB,SAAS,YAAY,SAA0B;AACpD,QAAM,YAAY,aAAa,OAAO;AACtC,SAAO,UAAU,WAAW,QAAQ,EAAE,OAAO,WAAW,MAAM,EAAE,OAAO,KAAK,CAAC;AAC/E;","names":[]}

package/dist/index.d.ts

@@ -0,0 +1,318 @@
+import { z } from 'zod';
+
+/**
+ * Version of the published-JSON contract. Additive changes (new OPTIONAL fields
+ * and new OPTIONAL module keys) keep this number; any required addition is
+ * breaking and bumps it. The full compatibility rule lives in this package's
+ * README. See PLAN.md § Published JSON delivery and phase-2.md T1.5.
+ */
+declare const SCHEMA_VERSION = 1;
+/** Publisher-enforced ceiling on the canonical payload size (1 MiB). */
+declare const MAX_CONTENT_BYTES = 1048576;
+declare const LOCALE_PATTERN_SOURCE = "^[a-z]{2}(-[A-Z]{2})?$";
+declare const LOCALE_PATTERN: RegExp;
+declare const HEX_COLOR_PATTERN_SOURCE = "^#[0-9A-Fa-f]{6}$";
+declare const HEX_COLOR_PATTERN: RegExp;
+/** ISO 4217 alpha code shape (mirrored by the `price_currency` DB CHECK). */
+declare const CURRENCY_PATTERN_SOURCE = "^[A-Z]{3}$";
+declare const CURRENCY_PATTERN: RegExp;
+/** ISO 3166-1 alpha-2 country code shape. */
+declare const COUNTRY_PATTERN_SOURCE = "^[A-Z]{2}$";
+declare const COUNTRY_PATTERN: RegExp;
+/** IANA time zone check via the runtime's own tz database. */
+declare function isIanaTimeZone(tz: string): boolean;
+declare const siteSettingsSchemaStrict: z.ZodObject<{
+    siteName: z.ZodString;
+    tagline: z.ZodOptional<z.ZodString>;
+    contact: z.ZodObject<{
+        email: z.ZodOptional<z.ZodEmail>;
+        phone: z.ZodOptional<z.ZodString>;
+        address: z.ZodOptional<z.ZodObject<{
+            line1: z.ZodString;
+            line2: z.ZodOptional<z.ZodString>;
+            city: z.ZodString;
+            region: z.ZodString;
+            postalCode: z.ZodString;
+            country: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    socialLinks: z.ZodOptional<z.ZodObject<{
+        facebook: z.ZodOptional<z.ZodURL>;
+        instagram: z.ZodOptional<z.ZodURL>;
+        tiktok: z.ZodOptional<z.ZodURL>;
+        x: z.ZodOptional<z.ZodURL>;
+        youtube: z.ZodOptional<z.ZodURL>;
+        yelp: z.ZodOptional<z.ZodURL>;
+        google: z.ZodOptional<z.ZodURL>;
+    }, z.core.$strip>>;
+    locale: z.ZodDefault<z.ZodString>;
+    timezone: z.ZodDefault<z.ZodString>;
+}, z.core.$strip>;
+declare const siteSettingsSchema: z.ZodObject<{
+    siteName: z.ZodString;
+    tagline: z.ZodOptional<z.ZodString>;
+    contact: z.ZodObject<{
+        email: z.ZodOptional<z.ZodEmail>;
+        phone: z.ZodOptional<z.ZodString>;
+        address: z.ZodOptional<z.ZodObject<{
+            line1: z.ZodString;
+            line2: z.ZodOptional<z.ZodString>;
+            city: z.ZodString;
+            region: z.ZodString;
+            postalCode: z.ZodString;
+            country: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    socialLinks: z.ZodOptional<z.ZodObject<{
+        facebook: z.ZodOptional<z.ZodURL>;
+        instagram: z.ZodOptional<z.ZodURL>;
+        tiktok: z.ZodOptional<z.ZodURL>;
+        x: z.ZodOptional<z.ZodURL>;
+        youtube: z.ZodOptional<z.ZodURL>;
+        yelp: z.ZodOptional<z.ZodURL>;
+        google: z.ZodOptional<z.ZodURL>;
+    }, z.core.$strip>>;
+    locale: z.ZodDefault<z.ZodString>;
+    timezone: z.ZodDefault<z.ZodString>;
+}, z.core.$strip>;
+declare const brandingSchemaStrict: z.ZodObject<{
+    logoUrl: z.ZodOptional<z.ZodURL>;
+    faviconUrl: z.ZodOptional<z.ZodURL>;
+    colors: z.ZodObject<{
+        primary: z.ZodString;
+        secondary: z.ZodOptional<z.ZodString>;
+        accent: z.ZodOptional<z.ZodString>;
+        background: z.ZodOptional<z.ZodString>;
+        text: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    fonts: z.ZodOptional<z.ZodObject<{
+        heading: z.ZodOptional<z.ZodString>;
+        body: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+declare const brandingSchema: z.ZodObject<{
+    logoUrl: z.ZodOptional<z.ZodURL>;
+    faviconUrl: z.ZodOptional<z.ZodURL>;
+    colors: z.ZodObject<{
+        primary: z.ZodString;
+        secondary: z.ZodOptional<z.ZodString>;
+        accent: z.ZodOptional<z.ZodString>;
+        background: z.ZodOptional<z.ZodString>;
+        text: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    fonts: z.ZodOptional<z.ZodObject<{
+        heading: z.ZodOptional<z.ZodString>;
+        body: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+declare const menuSchemaStrict: z.ZodObject<{
+    /** Archived/deleted entities are simply ABSENT; empty menu = `[]`, never a missing key. */
+    categories: z.ZodArray<z.ZodObject<{
+        id: z.ZodUUID;
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        sortOrder: z.ZodNumber;
+        items: z.ZodArray<z.ZodObject<{
+            /** Stable DB UUID — identical across publishes (phase-2.md T1.3). */
+            id: z.ZodUUID;
+            name: z.ZodString;
+            description: z.ZodOptional<z.ZodString>;
+            price: z.ZodObject<{
+                /** Integer minor units (e.g. cents). */
+                amount: z.ZodNumber;
+                currency: z.ZodString;
+            }, z.core.$strip>;
+            imageUrl: z.ZodOptional<z.ZodURL>;
+            tags: z.ZodArray<z.ZodString>;
+            sortOrder: z.ZodNumber;
+            isAvailable: z.ZodBoolean;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+declare const menuSchema: z.ZodObject<{
+    /** Archived/deleted entities are simply ABSENT; empty menu = `[]`, never a missing key. */
+    categories: z.ZodArray<z.ZodObject<{
+        id: z.ZodUUID;
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        sortOrder: z.ZodNumber;
+        items: z.ZodArray<z.ZodObject<{
+            /** Stable DB UUID — identical across publishes (phase-2.md T1.3). */
+            id: z.ZodUUID;
+            name: z.ZodString;
+            description: z.ZodOptional<z.ZodString>;
+            price: z.ZodObject<{
+                /** Integer minor units (e.g. cents). */
+                amount: z.ZodNumber;
+                currency: z.ZodString;
+            }, z.core.$strip>;
+            imageUrl: z.ZodOptional<z.ZodURL>;
+            tags: z.ZodArray<z.ZodString>;
+            sortOrder: z.ZodNumber;
+            isAvailable: z.ZodBoolean;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/** Producer gate: the dashboard validates its own output against this. */
+declare const contentFileSchemaStrict: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    site: z.ZodObject<{
+        id: z.ZodUUID;
+        slug: z.ZodString;
+    }, z.core.$strip>;
+    publishedAt: z.ZodISODateTime;
+    modules: z.ZodObject<{
+        siteSettings: z.ZodObject<{
+            siteName: z.ZodString;
+            tagline: z.ZodOptional<z.ZodString>;
+            contact: z.ZodObject<{
+                email: z.ZodOptional<z.ZodEmail>;
+                phone: z.ZodOptional<z.ZodString>;
+                address: z.ZodOptional<z.ZodObject<{
+                    line1: z.ZodString;
+                    line2: z.ZodOptional<z.ZodString>;
+                    city: z.ZodString;
+                    region: z.ZodString;
+                    postalCode: z.ZodString;
+                    country: z.ZodString;
+                }, z.core.$strip>>;
+            }, z.core.$strip>;
+            socialLinks: z.ZodOptional<z.ZodObject<{
+                facebook: z.ZodOptional<z.ZodURL>;
+                instagram: z.ZodOptional<z.ZodURL>;
+                tiktok: z.ZodOptional<z.ZodURL>;
+                x: z.ZodOptional<z.ZodURL>;
+                youtube: z.ZodOptional<z.ZodURL>;
+                yelp: z.ZodOptional<z.ZodURL>;
+                google: z.ZodOptional<z.ZodURL>;
+            }, z.core.$strip>>;
+            locale: z.ZodDefault<z.ZodString>;
+            timezone: z.ZodDefault<z.ZodString>;
+        }, z.core.$strip>;
+        branding: z.ZodObject<{
+            logoUrl: z.ZodOptional<z.ZodURL>;
+            faviconUrl: z.ZodOptional<z.ZodURL>;
+            colors: z.ZodObject<{
+                primary: z.ZodString;
+                secondary: z.ZodOptional<z.ZodString>;
+                accent: z.ZodOptional<z.ZodString>;
+                background: z.ZodOptional<z.ZodString>;
+                text: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+            fonts: z.ZodOptional<z.ZodObject<{
+                heading: z.ZodOptional<z.ZodString>;
+                body: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+        menu: z.ZodObject<{
+            /** Archived/deleted entities are simply ABSENT; empty menu = `[]`, never a missing key. */
+            categories: z.ZodArray<z.ZodObject<{
+                id: z.ZodUUID;
+                name: z.ZodString;
+                description: z.ZodOptional<z.ZodString>;
+                sortOrder: z.ZodNumber;
+                items: z.ZodArray<z.ZodObject<{
+                    /** Stable DB UUID — identical across publishes (phase-2.md T1.3). */
+                    id: z.ZodUUID;
+                    name: z.ZodString;
+                    description: z.ZodOptional<z.ZodString>;
+                    price: z.ZodObject<{
+                        /** Integer minor units (e.g. cents). */
+                        amount: z.ZodNumber;
+                        currency: z.ZodString;
+                    }, z.core.$strip>;
+                    imageUrl: z.ZodOptional<z.ZodURL>;
+                    tags: z.ZodArray<z.ZodString>;
+                    sortOrder: z.ZodNumber;
+                    isAvailable: z.ZodBoolean;
+                }, z.core.$strip>>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+/** Public consumer schema: tolerant of additive v1 changes. */
+declare const contentFileSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    site: z.ZodObject<{
+        id: z.ZodUUID;
+        slug: z.ZodString;
+    }, z.core.$strip>;
+    publishedAt: z.ZodISODateTime;
+    modules: z.ZodObject<{
+        siteSettings: z.ZodObject<{
+            siteName: z.ZodString;
+            tagline: z.ZodOptional<z.ZodString>;
+            contact: z.ZodObject<{
+                email: z.ZodOptional<z.ZodEmail>;
+                phone: z.ZodOptional<z.ZodString>;
+                address: z.ZodOptional<z.ZodObject<{
+                    line1: z.ZodString;
+                    line2: z.ZodOptional<z.ZodString>;
+                    city: z.ZodString;
+                    region: z.ZodString;
+                    postalCode: z.ZodString;
+                    country: z.ZodString;
+                }, z.core.$strip>>;
+            }, z.core.$strip>;
+            socialLinks: z.ZodOptional<z.ZodObject<{
+                facebook: z.ZodOptional<z.ZodURL>;
+                instagram: z.ZodOptional<z.ZodURL>;
+                tiktok: z.ZodOptional<z.ZodURL>;
+                x: z.ZodOptional<z.ZodURL>;
+                youtube: z.ZodOptional<z.ZodURL>;
+                yelp: z.ZodOptional<z.ZodURL>;
+                google: z.ZodOptional<z.ZodURL>;
+            }, z.core.$strip>>;
+            locale: z.ZodDefault<z.ZodString>;
+            timezone: z.ZodDefault<z.ZodString>;
+        }, z.core.$strip>;
+        branding: z.ZodObject<{
+            logoUrl: z.ZodOptional<z.ZodURL>;
+            faviconUrl: z.ZodOptional<z.ZodURL>;
+            colors: z.ZodObject<{
+                primary: z.ZodString;
+                secondary: z.ZodOptional<z.ZodString>;
+                accent: z.ZodOptional<z.ZodString>;
+                background: z.ZodOptional<z.ZodString>;
+                text: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+            fonts: z.ZodOptional<z.ZodObject<{
+                heading: z.ZodOptional<z.ZodString>;
+                body: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+        menu: z.ZodObject<{
+            /** Archived/deleted entities are simply ABSENT; empty menu = `[]`, never a missing key. */
+            categories: z.ZodArray<z.ZodObject<{
+                id: z.ZodUUID;
+                name: z.ZodString;
+                description: z.ZodOptional<z.ZodString>;
+                sortOrder: z.ZodNumber;
+                items: z.ZodArray<z.ZodObject<{
+                    /** Stable DB UUID — identical across publishes (phase-2.md T1.3). */
+                    id: z.ZodUUID;
+                    name: z.ZodString;
+                    description: z.ZodOptional<z.ZodString>;
+                    price: z.ZodObject<{
+                        /** Integer minor units (e.g. cents). */
+                        amount: z.ZodNumber;
+                        currency: z.ZodString;
+                    }, z.core.$strip>;
+                    imageUrl: z.ZodOptional<z.ZodURL>;
+                    tags: z.ZodArray<z.ZodString>;
+                    sortOrder: z.ZodNumber;
+                    isAvailable: z.ZodBoolean;
+                }, z.core.$strip>>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+type SiteSettings = z.infer<typeof siteSettingsSchemaStrict>;
+type Branding = z.infer<typeof brandingSchemaStrict>;
+type Menu = z.infer<typeof menuSchemaStrict>;
+type MenuCategory = Menu['categories'][number];
+type MenuItem = MenuCategory['items'][number];
+type ContentFile = z.infer<typeof contentFileSchemaStrict>;
+declare function canonicalize(payload: unknown): string;
+
+export { type Branding, COUNTRY_PATTERN, COUNTRY_PATTERN_SOURCE, CURRENCY_PATTERN, CURRENCY_PATTERN_SOURCE, type ContentFile, HEX_COLOR_PATTERN, HEX_COLOR_PATTERN_SOURCE, LOCALE_PATTERN, LOCALE_PATTERN_SOURCE, MAX_CONTENT_BYTES, type Menu, type MenuCategory, type MenuItem, SCHEMA_VERSION, type SiteSettings, brandingSchema, brandingSchemaStrict, canonicalize, contentFileSchema, contentFileSchemaStrict, isIanaTimeZone, menuSchema, menuSchemaStrict, siteSettingsSchema, siteSettingsSchemaStrict };

package/dist/index.js

@@ -0,0 +1,45 @@
+import {
+  COUNTRY_PATTERN,
+  COUNTRY_PATTERN_SOURCE,
+  CURRENCY_PATTERN,
+  CURRENCY_PATTERN_SOURCE,
+  HEX_COLOR_PATTERN,
+  HEX_COLOR_PATTERN_SOURCE,
+  LOCALE_PATTERN,
+  LOCALE_PATTERN_SOURCE,
+  MAX_CONTENT_BYTES,
+  SCHEMA_VERSION,
+  brandingSchema,
+  brandingSchemaStrict,
+  canonicalize,
+  contentFileSchema,
+  contentFileSchemaStrict,
+  isIanaTimeZone,
+  menuSchema,
+  menuSchemaStrict,
+  siteSettingsSchema,
+  siteSettingsSchemaStrict
+} from "./chunk-KBPOR3WL.js";
+export {
+  COUNTRY_PATTERN,
+  COUNTRY_PATTERN_SOURCE,
+  CURRENCY_PATTERN,
+  CURRENCY_PATTERN_SOURCE,
+  HEX_COLOR_PATTERN,
+  HEX_COLOR_PATTERN_SOURCE,
+  LOCALE_PATTERN,
+  LOCALE_PATTERN_SOURCE,
+  MAX_CONTENT_BYTES,
+  SCHEMA_VERSION,
+  brandingSchema,
+  brandingSchemaStrict,
+  canonicalize,
+  contentFileSchema,
+  contentFileSchemaStrict,
+  isIanaTimeZone,
+  menuSchema,
+  menuSchemaStrict,
+  siteSettingsSchema,
+  siteSettingsSchemaStrict
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/fixtures/v1/full.json

@@ -0,0 +1,131 @@
+{
+  "schemaVersion": 1,
+  "site": {
+    "id": "b7e6a1d2-3c4f-4a5b-9e8d-1f2a3b4c5d6e",
+    "slug": "main"
+  },
+  "publishedAt": "2026-07-22T12:00:00.000Z",
+  "modules": {
+    "siteSettings": {
+      "siteName": "Pho Palace",
+      "tagline": "Northern Vietnamese noodle soups, made daily",
+      "contact": {
+        "email": "hello@phopalace.example",
+        "phone": "+1 704-555-0132",
+        "address": {
+          "line1": "214 Tryon St",
+          "line2": "Suite 120",
+          "city": "Charlotte",
+          "region": "NC",
+          "postalCode": "28202",
+          "country": "US"
+        }
+      },
+      "socialLinks": {
+        "facebook": "https://facebook.com/phopalace",
+        "instagram": "https://instagram.com/phopalace",
+        "tiktok": "https://www.tiktok.com/@phopalace",
+        "x": "https://x.com/phopalace",
+        "youtube": "https://youtube.com/@phopalace",
+        "yelp": "https://www.yelp.com/biz/pho-palace-charlotte",
+        "google": "https://maps.google.com/?cid=5069577489237150720"
+      },
+      "locale": "en-US",
+      "timezone": "America/New_York"
+    },
+    "branding": {
+      "logoUrl": "https://example.supabase.co/storage/v1/object/public/assets/org_01example7fixture0000000000/b7e6a1d2-3c4f-4a5b-9e8d-1f2a3b4c5d6e/9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08.png",
+      "faviconUrl": "https://example.supabase.co/storage/v1/object/public/assets/org_01example7fixture0000000000/b7e6a1d2-3c4f-4a5b-9e8d-1f2a3b4c5d6e/60303ae22b998861bce3b28f33eec1be758a213c86c93c076dbe9f558c11c752.png",
+      "colors": {
+        "primary": "#7A1F1F",
+        "secondary": "#F4E9DC",
+        "accent": "#C8A24B",
+        "background": "#FFFFFF",
+        "text": "#1A1A1A"
+      },
+      "fonts": {
+        "heading": "Plus Jakarta Sans",
+        "body": "Inter"
+      }
+    },
+    "menu": {
+      "categories": [
+        {
+          "id": "0d9a2c66-5b1e-4c9a-8f3d-7e6b5a4c3d2e",
+          "name": "Pho",
+          "description": "Slow-simmered broth, rice noodles, fresh herbs.",
+          "sortOrder": 0,
+          "items": [
+            {
+              "id": "5e4d3c2b-1a09-4f8e-b7c6-d5e4f3a2b1c0",
+              "name": "Pho Bo",
+              "description": "Beef pho with brisket and rare steak.",
+              "price": {
+                "amount": 1450,
+                "currency": "USD"
+              },
+              "imageUrl": "https://example.supabase.co/storage/v1/object/public/assets/org_01example7fixture0000000000/b7e6a1d2-3c4f-4a5b-9e8d-1f2a3b4c5d6e/fd61a03af4f77d870fc21e05e7e80678095c92d808cfb3b5c279ee04c74aca13.webp",
+              "tags": ["signature", "gluten-free"],
+              "sortOrder": 0,
+              "isAvailable": true
+            },
+            {
+              "id": "6f5e4d3c-2b1a-4098-a7b6-c5d4e3f2a1b0",
+              "name": "Pho Ga",
+              "description": "Chicken pho with poached free-range chicken.",
+              "price": {
+                "amount": 1350,
+                "currency": "USD"
+              },
+              "tags": ["gluten-free"],
+              "sortOrder": 1,
+              "isAvailable": true
+            },
+            {
+              "id": "7a6b5c4d-3e2f-4109-b8a7-d6c5b4a3f2e1",
+              "name": "Pho Chay",
+              "description": "Vegetarian pho with shiitake broth and tofu.",
+              "price": {
+                "amount": 1250,
+                "currency": "USD"
+              },
+              "tags": ["vegetarian", "vegan-option"],
+              "sortOrder": 2,
+              "isAvailable": false
+            }
+          ]
+        },
+        {
+          "id": "1e8b3d77-6c2f-4d0b-9a4e-8f7c6b5d4e3f",
+          "name": "Drinks",
+          "sortOrder": 1,
+          "items": [
+            {
+              "id": "8b7a6c5d-4f3e-4210-a9b8-e7d6c5b4a3f2",
+              "name": "Vietnamese Iced Coffee",
+              "description": "Ca phe sua da — robusta over condensed milk.",
+              "price": {
+                "amount": 550,
+                "currency": "USD"
+              },
+              "tags": ["cold"],
+              "sortOrder": 0,
+              "isAvailable": true
+            },
+            {
+              "id": "9c8b7a6d-5e4f-4321-90c9-f8e7d6c5b4a3",
+              "name": "Jasmine Tea",
+              "price": {
+                "amount": 300,
+                "currency": "USD"
+              },
+              "tags": [],
+              "sortOrder": 1,
+              "isAvailable": true
+            }
+          ]
+        }
+      ]
+    }
+  }
+}

package/fixtures/v1/hashes.json

@@ -0,0 +1,5 @@
+{
+  "_comment": "Checked-in hashContent() snapshots of the v1 fixtures — the serialization-determinism contract. If a test fails against these, the canonical serialization or a fixture changed; BOTH are locked decisions (phase-2.md T1.6/T1.8). Regenerate only with founder sign-off.",
+  "full.json": "sha256:34c778b74dc2ae260830ee072bdc3c197229f76f28b58775a61c57ab55abf3ef",
+  "minimal.json": "sha256:7b4ebc88bf2c17e1182a7e89fe994c3a38f70e0e638b37a0caa662f0c7e8db22"
+}

package/fixtures/v1/minimal.json

@@ -0,0 +1,24 @@
+{
+  "schemaVersion": 1,
+  "site": {
+    "id": "b7e6a1d2-3c4f-4a5b-9e8d-1f2a3b4c5d6e",
+    "slug": "main"
+  },
+  "publishedAt": "2026-07-22T12:00:00.000Z",
+  "modules": {
+    "siteSettings": {
+      "siteName": "Pho Palace",
+      "contact": {},
+      "locale": "en-US",
+      "timezone": "America/Los_Angeles"
+    },
+    "branding": {
+      "colors": {
+        "primary": "#1A1A1A"
+      }
+    },
+    "menu": {
+      "categories": []
+    }
+  }
+}

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@lamgig/content-schemas",
+  "version": "1.0.0",
+  "description": "The LamGig published-JSON contract: Zod schemas, canonical serialization, and fixtures for consuming content published by the LamGig platform.",
+  "keywords": [
+    "lamgig",
+    "cms",
+    "content",
+    "zod",
+    "schema",
+    "canonical-json"
+  ],
+  "license": "MIT",
+  "author": "LamGig",
+  "homepage": "https://github.com/LamGig/lamgig-platform/tree/main/packages/content-schemas#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/LamGig/lamgig-platform.git",
+    "directory": "packages/content-schemas"
+  },
+  "bugs": {
+    "url": "https://github.com/LamGig/lamgig-platform/issues"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./hash": {
+      "types": "./dist/hash.d.ts",
+      "import": "./dist/hash.js"
+    },
+    "./fixtures/*": "./fixtures/*"
+  },
+  "files": [
+    "dist",
+    "fixtures",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "prepublishOnly": "npm run build && npm run typecheck && npm run test"
+  },
+  "dependencies": {
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "tsup": "^8.5.1",
+    "typescript": "^5",
+    "vitest": "^4.1.10"
+  }
+}