@mnstry/atelier 0.2.0-alpha.1

package/src/validate-atelier-export-dry-run.mjs

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { validateAtelierExportContract } from './export/atelier-export-contract.mjs'
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const packageRoot = path.resolve(__dirname, '..')
+const schemaPath = path.join(packageRoot, 'contracts/atelier-export.v1.schema.json')
+
+function readJsonFile(filePath) {
+  const text = fs.readFileSync(filePath, 'utf8')
+  return JSON.parse(text)
+}
+
+export function validateAtelierExportDryRun(doc, { schema = readJsonFile(schemaPath), graphNodes = [] } = {}) {
+  return validateAtelierExportContract(doc, {
+    schema,
+    graphNodes,
+    dryRunOnly: true,
+  })
+}
+
+export function validateAtelierExportDryRunFile(filePath) {
+  const absolutePath = path.resolve(filePath)
+  const doc = readJsonFile(absolutePath)
+  return validateAtelierExportDryRun(doc)
+}
+
+function emptyReport(message) {
+  return {
+    accepted: false,
+    importable: false,
+    worstOperationStatus: 'other',
+    graphProvenanceMode: 'absent',
+    operationSummary: {
+      counts: { ready: 0, warning: 0, blocked: 0, other: 0 },
+      worstOperationStatus: 'other',
+      total: 0,
+    },
+    errors: [message],
+    warnings: [],
+    objects: { total: 0, byCollection: {} },
+    sourceNodes: [],
+    runtimeTargets: [],
+    semanticProfileViolations: [],
+  }
+}
+
+function printReport(report) {
+  process.stdout.write(`${JSON.stringify(report, null, 2)}\n`)
+}
+
+export function main(argv) {
+  const [filePath, ...extra] = argv
+  if (!filePath || extra.length > 0) {
+    printReport(emptyReport('usage: node scripts/validation/validate-atelier-export-dry-run.mjs <path-to-export-json>'))
+    return 1
+  }
+
+  try {
+    const report = validateAtelierExportDryRunFile(filePath)
+    printReport(report)
+    return report.accepted ? 0 : 1
+  } catch (error) {
+    printReport(emptyReport(error instanceof Error ? error.message : String(error)))
+    return 1
+  }
+}
+
+const currentFile = fileURLToPath(import.meta.url)
+if (process.argv[1] && path.resolve(process.argv[1]) === currentFile) {
+  process.exitCode = main(process.argv.slice(2))
+}

package/templates/atelier.project.example.json

@@ -0,0 +1,23 @@
+{
+  "schema": "mnstry.atelier-project-config@v1",
+  "name": "sample-workspace",
+  "roots": {
+    "workspace": ".",
+    "repoOps": "."
+  },
+  "graph": {
+    "repoAccessPath": "repo-access.v1.json",
+    "outputPath": "atelier-output/knowledge.graph.json"
+  },
+  "projection": {
+    "outputRoot": "atelier-output",
+    "readinessPath": "atelier-output/atelier-readiness.json"
+  },
+  "repos": [
+    {
+      "name": "content",
+      "path": "content",
+      "readBoundary": "private"
+    }
+  ]
+}

package/templates/distribution-workspace/.claude/launch.json

@@ -0,0 +1,12 @@
+{
+  "version": "0.0.1",
+  "configurations": [
+    {
+      "name": "atelier",
+      "runtimeExecutable": "npx",
+      "runtimeArgs": ["atelier", "server"],
+      "port": 8137,
+      "autoPort": true
+    }
+  ]
+}

package/templates/distribution-workspace/README.md

@@ -0,0 +1,86 @@
+# Distribution workspace
+
+Starter for a MNSTRY Atelier distribution: a rebranded package that wraps the
+Atelier CLI and ships its own name, projection branding, and optional extension
+packs on top of the unmodified Atelier core.
+
+The distribution invariant: add and rebrand, never alter root semantics. A
+distribution may add protocols, skills, and branding, but the bundled commands,
+contracts, and boundary rules keep their upstream meaning.
+
+## Required attribution
+
+Every distribution package must carry the exact line below in its README:
+
+powered by MNSTRY Atelier
+
+`atelier distribution check` blocks on this line. See `TRADEMARKS.md`
+("Required attribution") and `docs/attestation.md` in the Atelier package for
+the policy and signing details.
+
+## Projection branding
+
+`atelier.project.json` in this workspace carries the extension block that
+brands the local projection:
+
+```json
+"ext": {
+  "mnstry.atelier": {
+    "distribution": {
+      "name": "Example Distribution",
+      "eyebrow": "distribution projection"
+    }
+  }
+}
+```
+
+An optional `theme` object may override the projection color tokens
+`bg`, `surface`, `text`, `accent`, and `eyebrow` with hex values, for example
+`"theme": { "accent": "#7a9e7e" }`. Values that are not hex colors are
+rejected at build time.
+
+## Boundary
+
+Shared distribution repos are readable by the project group. Do not place
+private or sensitive personal domain source here. Use a private domain repo per
+user for that material. `USER_GITHUB_LOGIN_PLACEHOLDER` in
+`boundary-policy.v1.json` is a placeholder, not a real account; `atelier init`
+personalizes it in the copied workspace.
+
+## Tracked config and local overlay
+
+Track `atelier.project.json`, `repo-access.v1.json`, `boundary-policy.v1.json`,
+`atelier.lock.json`, governance files, and source documents. Ignore local
+operator state such as `atelier.local.json`, `atelier.workspace.local.json`,
+`atelier-attestation-key.local.json` (the local attestation signing key —
+never commit it), `.atelier-local/`, proposals/current/presence/nonce/grants/
+audit/session/support state, support bundles, transcripts, prompts, generated
+projections, `node_modules/`, and `.DS_Store`.
+
+## Local commands
+
+```bash
+atelier graph --project ./atelier.project.json
+atelier project --project ./atelier.project.json
+atelier readiness --project ./atelier.project.json
+atelier lock check --project ./atelier.project.json
+atelier distribution check
+```
+
+Atelier performs no telemetry, cloud sync, runtime mutation, or direct browser
+writes for this preview.
+
+## Atelier lockfile
+
+`atelier init --template distribution` writes `atelier.lock.json`.
+If this template was copied manually, create the lock before the first commit:
+
+```bash
+atelier lock write --project ./atelier.project.json
+```
+
+## Learn more
+
+- `docs/distributions.md` in the Atelier package — the full distribution guide.
+- `examples/loomworks-studio/` in the Atelier repository — a complete
+  reference distribution with a branded wrapper binary and extension pack.

package/templates/distribution-workspace/atelier.project.json

@@ -0,0 +1,36 @@
+{
+  "schema": "mnstry.atelier-project-config@v1",
+  "name": "project-alpha",
+  "roots": {
+    "workspace": ".",
+    "repoOps": "."
+  },
+  "graph": {
+    "repoAccessPath": "repo-access.v1.json",
+    "outputPath": "atelier-output/knowledge.graph.json"
+  },
+  "projection": {
+    "outputRoot": "atelier-output",
+    "readinessPath": "atelier-output/atelier-readiness.json"
+  },
+  "boundaries": {
+    "policyPath": "boundary-policy.v1.json",
+    "governanceLedgerPath": "governance/repo-boundary-ledger.md",
+    "strictNewRepos": true
+  },
+  "repos": [
+    {
+      "name": "project-alpha",
+      "path": "project",
+      "readBoundary": "team"
+    }
+  ],
+  "ext": {
+    "mnstry.atelier": {
+      "distribution": {
+        "name": "Example Distribution",
+        "eyebrow": "distribution projection"
+      }
+    }
+  }
+}

package/templates/distribution-workspace/boundary-policy.v1.json

@@ -0,0 +1,61 @@
+{
+  "schema": "mnstry.atelier-boundary-policy@v1",
+  "mode": "strict",
+  "actors": {
+    "owner": {
+      "githubLogin": "USER_GITHUB_LOGIN_PLACEHOLDER",
+      "gitEmails": ["owner@example.invalid"],
+      "privateDomainRepo": "tenant-private-domain"
+    }
+  },
+  "repos": {
+    "tenant-private-domain": {
+      "kind": "private_domain",
+      "ownerActor": "owner",
+      "readBoundary": "private",
+      "allowedAudiences": ["private", "sensitive", "team", "operator", "staff", "public"],
+      "forbiddenAudiences": [],
+      "autoCommit": "guarded"
+    },
+    "project-alpha": {
+      "kind": "shared",
+      "readBoundary": "team",
+      "allowedAudiences": ["team", "operator", "staff", "public"],
+      "forbiddenAudiences": ["private", "sensitive"],
+      "autoCommit": "guarded"
+    }
+  },
+  "promotion": {
+    "requiresGitPromote": true,
+    "recordsPath": "governance/git-promote-events.jsonl"
+  },
+  "forbiddenPaths": [
+    ".atelier-local/**",
+    "atelier.local.json",
+    "atelier.workspace.local.json",
+    ".mnstry-local/**",
+    ".atelier-proposals/**",
+    ".atelier-current",
+    ".atelier-current.json",
+    ".atelier-presence.json",
+    ".atelier-nonce",
+    ".atelier-capability-grants.json",
+    ".atelier-grants/**",
+    ".atelier-events.jsonl",
+    ".atelier-audit.jsonl",
+    ".atelier-audit/**",
+    ".atelier-session.json",
+    ".atelier-session.jsonl",
+    ".atelier-session/**",
+    ".atelier-sessions/**",
+    ".atelier-support/**",
+    ".atelier-support.json",
+    "support-bundle*",
+    "support-bundles/**",
+    "prompts/**",
+    "transcripts/**",
+    "node_modules/**",
+    ".DS_Store"
+  ],
+  "governanceLedgerPath": "governance/repo-boundary-ledger.md"
+}

package/templates/distribution-workspace/gitignore

@@ -0,0 +1,29 @@
+.atelier-local/
+atelier.local.json
+atelier.workspace.local.json
+atelier-attestation-key.local.json
+.mnstry-local/
+.atelier-proposals/
+.atelier-current
+.atelier-current.json
+.atelier-presence.json
+.atelier-nonce
+.atelier-capability-grants.json
+.atelier-grants/
+.atelier-events.jsonl
+.atelier-audit.jsonl
+.atelier-audit/
+.atelier-session.json
+.atelier-session.jsonl
+.atelier-session/
+.atelier-sessions/
+.atelier-support/
+.atelier-support.json
+atelier-output/
+support-bundle*
+support-bundles/
+transcripts/
+prompts/
+node_modules/
+npm-debug.log*
+.DS_Store

package/templates/distribution-workspace/governance/repo-boundary-ledger.md

@@ -0,0 +1,5 @@
+# Repo Boundary Governance Ledger
+
+This shared project workspace is strict. Private and sensitive material must
+stay in each user's private domain repo unless intentionally promoted into this
+repo through `git.promote`.

package/templates/distribution-workspace/project/README.md

@@ -0,0 +1,19 @@
+---
+title: "Shared Project Seed"
+kg:
+  id: "project-alpha:seed"
+  type: "project-note"
+  domain: "project"
+  lifecycle: "draft"
+  status: "seed"
+  audience: "team"
+  relations: []
+---
+
+# Shared Project Seed
+
+Shared project source starts here.
+
+This repo is for team-readable project material. Keep private-domain source in
+the relevant user's private domain repo and bring only reviewed summaries here
+through Git review.

package/templates/distribution-workspace/repo-access.v1.json

@@ -0,0 +1,9 @@
+{
+  "schema": "mnstry.repo-access@v1",
+  "defaultReadBoundary": "team",
+  "repos": {
+    "project-alpha": {
+      "readBoundary": "team"
+    }
+  }
+}

package/templates/launch.json

@@ -0,0 +1,12 @@
+{
+  "version": "0.0.1",
+  "configurations": [
+    {
+      "name": "atelier",
+      "runtimeExecutable": "npx",
+      "runtimeArgs": ["atelier", "server"],
+      "port": 8137,
+      "autoPort": true
+    }
+  ]
+}

package/templates/private-domain-workspace/.claude/launch.json

@@ -0,0 +1,12 @@
+{
+  "version": "0.0.1",
+  "configurations": [
+    {
+      "name": "atelier",
+      "runtimeExecutable": "npx",
+      "runtimeArgs": ["atelier", "server"],
+      "port": 8137,
+      "autoPort": true
+    }
+  ]
+}

package/templates/private-domain-workspace/README.md

@@ -0,0 +1,50 @@
+# Private Domain Workspace
+
+Starter for one user's private domain repository.
+
+Default example user:
+
+- Name: `Owner`
+- GitHub login placeholder: `USER_GITHUB_LOGIN_PLACEHOLDER`
+- Repo: `github.com/<org>/tenant-private-domain`
+
+`USER_GITHUB_LOGIN_PLACEHOLDER` is a placeholder, not a real account. Keep
+committed starter files placeholder-only; set a real login or email only in the
+copied private workspace.
+
+## Boundary
+
+This repo is the Git read boundary for the user's private source. Do not place
+private domain source in a shared project repository and rely on projection
+filters to hide it.
+
+## Tracked Config And Local Overlay
+
+Track `atelier.project.json`, `repo-access.v1.json`, `boundary-policy.v1.json`,
+`atelier.lock.json`, governance files, and source documents. Ignore local
+operator state such as `atelier.local.json`, `atelier.workspace.local.json`,
+`.atelier-local/`, proposals/current/presence/nonce/grants/audit/session/support
+state, support bundles, transcripts, prompts, generated projections,
+`node_modules/`, and `.DS_Store`.
+
+## Local Commands
+
+```bash
+atelier graph --project ./atelier.project.json
+atelier project --project ./atelier.project.json
+atelier readiness --project ./atelier.project.json
+atelier lock check --project ./atelier.project.json
+atelier upgrade --dry-run --project ./atelier.project.json
+```
+
+Atelier performs no telemetry, cloud sync, runtime mutation, or direct browser
+writes for this preview.
+
+## Atelier Lockfile
+
+`atelier init --template private-domain` writes `atelier.lock.json`.
+If this template was copied manually, create the lock before the first commit:
+
+```bash
+atelier lock write --project ./atelier.project.json
+```

package/templates/private-domain-workspace/atelier.project.json

@@ -0,0 +1,28 @@
+{
+  "schema": "mnstry.atelier-project-config@v1",
+  "name": "tenant-private-domain",
+  "roots": {
+    "workspace": ".",
+    "repoOps": "."
+  },
+  "graph": {
+    "repoAccessPath": "repo-access.v1.json",
+    "outputPath": "atelier-output/knowledge.graph.json"
+  },
+  "projection": {
+    "outputRoot": "atelier-output",
+    "readinessPath": "atelier-output/atelier-readiness.json"
+  },
+  "boundaries": {
+    "policyPath": "boundary-policy.v1.json",
+    "governanceLedgerPath": "governance/repo-boundary-ledger.md",
+    "strictNewRepos": true
+  },
+  "repos": [
+    {
+      "name": "tenant-private-domain",
+      "path": "domain",
+      "readBoundary": "private"
+    }
+  ]
+}

package/templates/private-domain-workspace/boundary-policy.v1.json

@@ -0,0 +1,54 @@
+{
+  "schema": "mnstry.atelier-boundary-policy@v1",
+  "mode": "strict",
+  "actors": {
+    "owner": {
+      "githubLogin": "USER_GITHUB_LOGIN_PLACEHOLDER",
+      "gitEmails": ["owner@example.invalid"],
+      "privateDomainRepo": "tenant-private-domain"
+    }
+  },
+  "repos": {
+    "tenant-private-domain": {
+      "kind": "private_domain",
+      "ownerActor": "owner",
+      "readBoundary": "private",
+      "allowedAudiences": ["private", "sensitive", "team", "operator", "staff", "public"],
+      "forbiddenAudiences": [],
+      "autoCommit": "guarded"
+    }
+  },
+  "promotion": {
+    "requiresGitPromote": true,
+    "recordsPath": "governance/git-promote-events.jsonl"
+  },
+  "forbiddenPaths": [
+    ".atelier-local/**",
+    "atelier.local.json",
+    "atelier.workspace.local.json",
+    ".mnstry-local/**",
+    ".atelier-proposals/**",
+    ".atelier-current",
+    ".atelier-current.json",
+    ".atelier-presence.json",
+    ".atelier-nonce",
+    ".atelier-capability-grants.json",
+    ".atelier-grants/**",
+    ".atelier-events.jsonl",
+    ".atelier-audit.jsonl",
+    ".atelier-audit/**",
+    ".atelier-session.json",
+    ".atelier-session.jsonl",
+    ".atelier-session/**",
+    ".atelier-sessions/**",
+    ".atelier-support/**",
+    ".atelier-support.json",
+    "support-bundle*",
+    "support-bundles/**",
+    "prompts/**",
+    "transcripts/**",
+    "node_modules/**",
+    ".DS_Store"
+  ],
+  "governanceLedgerPath": "governance/repo-boundary-ledger.md"
+}

package/templates/private-domain-workspace/domain/README.md

@@ -0,0 +1,19 @@
+---
+title: "Private Domain Seed"
+kg:
+  id: "tenant-private-domain:seed"
+  type: "domain-note"
+  domain: "example-domain"
+  lifecycle: "draft"
+  status: "seed"
+  audience: "private"
+  relations: []
+---
+
+# Private Domain Seed
+
+Private domain source starts here.
+
+Keep only owner-controlled private material in this repository. Promote reviewed
+summaries into shared project repos through ordinary Git review, not through
+browser writes or runtime mutation.

package/templates/private-domain-workspace/gitignore

@@ -0,0 +1,29 @@
+.atelier-local/
+atelier.local.json
+atelier.workspace.local.json
+atelier-attestation-key.local.json
+.mnstry-local/
+.atelier-proposals/
+.atelier-current
+.atelier-current.json
+.atelier-presence.json
+.atelier-nonce
+.atelier-capability-grants.json
+.atelier-grants/
+.atelier-events.jsonl
+.atelier-audit.jsonl
+.atelier-audit/
+.atelier-session.json
+.atelier-session.jsonl
+.atelier-session/
+.atelier-sessions/
+.atelier-support/
+.atelier-support.json
+atelier-output/
+support-bundle*
+support-bundles/
+transcripts/
+prompts/
+node_modules/
+npm-debug.log*
+.DS_Store

package/templates/private-domain-workspace/governance/repo-boundary-ledger.md

@@ -0,0 +1,4 @@
+# Repo Boundary Governance Ledger
+
+This private domain workspace is strict. Private and sensitive material belongs
+here unless intentionally promoted into a shared repo through `git.promote`.

package/templates/private-domain-workspace/repo-access.v1.json

@@ -0,0 +1,9 @@
+{
+  "schema": "mnstry.repo-access@v1",
+  "defaultReadBoundary": "private",
+  "repos": {
+    "tenant-private-domain": {
+      "readBoundary": "private"
+    }
+  }
+}

package/templates/shared-project-workspace/.claude/launch.json

@@ -0,0 +1,12 @@
+{
+  "version": "0.0.1",
+  "configurations": [
+    {
+      "name": "atelier",
+      "runtimeExecutable": "npx",
+      "runtimeArgs": ["atelier", "server"],
+      "port": 8137,
+      "autoPort": true
+    }
+  ]
+}

package/templates/shared-project-workspace/README.md

@@ -0,0 +1,51 @@
+# Shared Project Workspace
+
+Starter for shared project repositories.
+
+Default example:
+
+- Project: `project-alpha`
+- Shared repo: `github.com/<org>/project-alpha`
+- Example collaborator: `Owner`
+- Example collaborator login placeholder: `USER_GITHUB_LOGIN_PLACEHOLDER`
+
+`USER_GITHUB_LOGIN_PLACEHOLDER` is a placeholder, not a real account. Keep
+committed starter files placeholder-only; set a real login or email only in the
+copied private workspace.
+
+## Boundary
+
+Shared project repos are readable by the project group. Do not place
+private or sensitive personal domain source here. Use a private domain repo per
+user for that material.
+
+## Tracked Config And Local Overlay
+
+Track `atelier.project.json`, `repo-access.v1.json`, `boundary-policy.v1.json`,
+`atelier.lock.json`, governance files, and source documents. Ignore local
+operator state such as `atelier.local.json`, `atelier.workspace.local.json`,
+`.atelier-local/`, proposals/current/presence/nonce/grants/audit/session/support
+state, support bundles, transcripts, prompts, generated projections,
+`node_modules/`, and `.DS_Store`.
+
+## Local Commands
+
+```bash
+atelier graph --project ./atelier.project.json
+atelier project --project ./atelier.project.json
+atelier readiness --project ./atelier.project.json
+atelier lock check --project ./atelier.project.json
+atelier upgrade --dry-run --project ./atelier.project.json
+```
+
+Atelier performs no telemetry, cloud sync, runtime mutation, or direct browser
+writes for this preview.
+
+## Atelier Lockfile
+
+`atelier init --template shared-project` writes `atelier.lock.json`.
+If this template was copied manually, create the lock before the first commit:
+
+```bash
+atelier lock write --project ./atelier.project.json
+```