@nakafa/aksara-contracts 0.27.0

package/dist/artifact/spec.js

@@ -0,0 +1,92 @@
+import { Schema } from "effect";
+import { SignedContentArtifactSchema } from "#contracts/content";
+import { ContentKeySchema, Sha256HashSchema } from "#contracts/ids";
+import { RendererComponentNameSchema } from "#contracts/renderer/component";
+import { RendererContractVersionSchema, RendererManifestEnvelopeSchema, } from "#contracts/renderer/contract";
+import { RendererDomainSchema } from "#contracts/renderer/domain";
+/**
+ * Complete server-only input needed to authenticate one compiled artifact.
+ * `rendererContractVersion` comes from the active release because payloads do
+ * not duplicate that release-scoped value.
+ */
+export const ArtifactVerificationRequestSchema = Schema.Struct({
+    artifact: SignedContentArtifactSchema,
+    rendererContractVersion: RendererContractVersionSchema,
+    rendererManifest: RendererManifestEnvelopeSchema,
+});
+/** Unknown artifact input did not exactly satisfy the verification contract. */
+export class ArtifactVerificationDecodeError extends Schema.TaggedError()("ArtifactVerificationDecodeError", {
+    message: Schema.Literal("Artifact verification input does not satisfy its exact wire contract."),
+}) {
+}
+/** A signed artifact exceeded the canonical UTF-8 wire ceiling. */
+export class ArtifactVerificationByteLimitError extends Schema.TaggedError()("ArtifactVerificationByteLimitError", {
+    actualBytes: Schema.Finite.pipe(Schema.check(Schema.isInt()), Schema.check(Schema.isGreaterThanOrEqualTo(0))),
+    maxBytes: Schema.Finite.pipe(Schema.check(Schema.isInt()), Schema.check(Schema.isGreaterThan(0))),
+}) {
+}
+/** Declared compiled bytes differ from the authenticated function body. */
+export class ArtifactCompiledByteLengthMismatchError extends Schema.TaggedError()("ArtifactCompiledByteLengthMismatchError", {
+    actualBytes: Schema.Finite.pipe(Schema.check(Schema.isInt()), Schema.check(Schema.isGreaterThanOrEqualTo(0))),
+    contentKey: ContentKeySchema,
+    declaredBytes: Schema.Finite.pipe(Schema.check(Schema.isInt()), Schema.check(Schema.isGreaterThanOrEqualTo(0))),
+}) {
+}
+/** One authenticated payload field exceeded its shared runtime ceiling. */
+export class ArtifactPayloadFieldByteLimitError extends Schema.TaggedError()("ArtifactPayloadFieldByteLimitError", {
+    actualBytes: Schema.Finite.pipe(Schema.check(Schema.isInt()), Schema.check(Schema.isGreaterThanOrEqualTo(0))),
+    contentKey: ContentKeySchema,
+    field: Schema.Literals([
+        "rawMdx",
+        "compiledCode",
+        "plainText",
+        "canonicalPayload",
+    ]),
+    maxBytes: Schema.Finite.pipe(Schema.check(Schema.isInt()), Schema.check(Schema.isGreaterThan(0))),
+}) {
+}
+/** SHA-256 computation failed before authenticity could be established. */
+export class ArtifactHashComputationError extends Schema.TaggedError()("ArtifactHashComputationError", { contentKey: ContentKeySchema }) {
+}
+/** The signed artifact hash does not identify its canonical payload. */
+export class ArtifactHashMismatchError extends Schema.TaggedError()("ArtifactHashMismatchError", {
+    actualHash: Sha256HashSchema,
+    contentKey: ContentKeySchema,
+    expectedHash: Sha256HashSchema,
+}) {
+}
+/** SHA-256 could not be calculated for the authenticated authored source. */
+export class ArtifactSourceHashComputationError extends Schema.TaggedError()("ArtifactSourceHashComputationError", { contentKey: ContentKeySchema }) {
+}
+/** The authenticated source hash does not identify the complete raw MDX. */
+export class ArtifactSourceHashMismatchError extends Schema.TaggedError()("ArtifactSourceHashMismatchError", {
+    actualHash: Sha256HashSchema,
+    contentKey: ContentKeySchema,
+    expectedHash: Sha256HashSchema,
+}) {
+}
+/** The runtime and hash-validated renderer envelope disagree globally. */
+export class RendererContractVersionMismatchError extends Schema.TaggedError()("RendererContractVersionMismatchError", {
+    actualVersion: RendererContractVersionSchema,
+    expectedVersion: RendererContractVersionSchema,
+}) {
+}
+/** A custom component required by the artifact is absent from the renderer. */
+export class ArtifactRendererComponentMissingError extends Schema.TaggedError()("ArtifactRendererComponentMissingError", {
+    componentName: RendererComponentNameSchema,
+    contentKey: ContentKeySchema,
+}) {
+}
+/** The renderer does not implement the exact required component version. */
+export class ArtifactRendererVersionUnsupportedError extends Schema.TaggedError()("ArtifactRendererVersionUnsupportedError", {
+    componentName: RendererComponentNameSchema,
+    contentKey: ContentKeySchema,
+    requiredVersion: Schema.Finite.pipe(Schema.check(Schema.isInt()), Schema.check(Schema.isGreaterThan(0))),
+}) {
+}
+/** The deployed Nakafa app cannot route this artifact's renderer domain. */
+export class ArtifactRendererDomainUnpublishedError extends Schema.TaggedError()("ArtifactRendererDomainUnpublishedError", {
+    contentKey: ContentKeySchema,
+    rendererDomain: RendererDomainSchema,
+}) {
+}

package/dist/artifact/verify.d.ts

@@ -0,0 +1,26 @@
+import { Effect } from "effect";
+import { ArtifactVerificationDecodeError } from "#contracts/artifact/spec";
+/** Authenticates one artifact and its exact renderer compatibility contract. */
+export declare const verifySignedContentArtifact: (input: unknown) => Effect.Effect<{
+    readonly artifactHash: string & import("effect/Brand").Brand<"@NakafaAI/AksaraSha256Hash">;
+    readonly keyId: string & import("effect/Brand").Brand<"@NakafaAI/AksaraSigningKeyId">;
+    readonly payload: {
+        readonly artifactLocale: ("de" | "en" | "id") & import("effect/Brand").Brand<"@NakafaAI/AksaraArtifactLocale">;
+        readonly byteLength: number;
+        readonly compiledCode: string;
+        readonly compilerConfigHash: string & import("effect/Brand").Brand<"@NakafaAI/AksaraSha256Hash">;
+        readonly compilerVersion: "0.1.0";
+        readonly contentKey: string & import("effect/Brand").Brand<"@NakafaAI/AksaraContentKey">;
+        readonly format: "mdx-function-body";
+        readonly mdxCompilerVersion: "3.1.1";
+        readonly plainText: string;
+        readonly rawMdx: string;
+        readonly rendererDomain: "ai-ds" | "biology" | "chemistry" | "mathematics" | "physics" | "politics" | "site" | "snbt-general" | "snbt-math" | "snbt-plain" | "snbt-quant" | "tka-math";
+        readonly requiredComponents: readonly {
+            readonly name: string;
+            readonly version: number;
+        }[];
+        readonly sourceHash: string & import("effect/Brand").Brand<"@NakafaAI/AksaraSha256Hash">;
+    };
+    readonly signature: string & import("effect/Brand").Brand<"@NakafaAI/AksaraEd25519Signature">;
+}, import("#contracts/artifact/spec").ArtifactCompiledByteLengthMismatchError | import("#contracts/artifact/spec").ArtifactHashComputationError | import("#contracts/artifact/spec").ArtifactHashMismatchError | import("#contracts/artifact/spec").ArtifactPayloadFieldByteLimitError | import("#contracts/artifact/spec").ArtifactRendererComponentMissingError | import("#contracts/artifact/spec").ArtifactRendererDomainUnpublishedError | import("#contracts/artifact/spec").ArtifactRendererVersionUnsupportedError | import("#contracts/artifact/spec").ArtifactSourceHashComputationError | import("#contracts/artifact/spec").ArtifactSourceHashMismatchError | import("#contracts/artifact/spec").ArtifactVerificationByteLimitError | ArtifactVerificationDecodeError | import("../errors.js").ContractDecodeError | import("../signature/spec.js").PublicKeyParseError | import("../signature/spec.js").PublicKeyTypeError | import("../renderer/component.js").RendererAuthoringComponentDuplicateError | import("../renderer/component.js").RendererAuthoringComponentExtraError | import("../renderer/component.js").RendererAuthoringComponentMissingError | import("../renderer/component.js").RendererAuthoringComponentUnsupportedError | import("../renderer/component.js").RendererAuthoringSelectionNonCanonicalError | import("#contracts/artifact/spec").RendererContractVersionMismatchError | import("../renderer/contract.js").RendererDomainCapabilityMissingError | import("../renderer/contract.js").RendererManifestHashComputeError | import("../renderer/contract.js").RendererManifestHashMismatchError | import("../signature/spec.js").SignatureCheckError | import("../signature/spec.js").SignatureInvalidError | import("../signature/spec.js").SigningKeyNotFoundError | import("../signature/spec.js").SigningKeyResolutionError, import("../signature/spec.js").ContentVerificationKeyResolver>;

package/dist/artifact/verify.js

@@ -0,0 +1,18 @@
+import { Effect, Schema } from "effect";
+import { verifySignedContentArtifactIntegrity } from "#contracts/artifact/integrity";
+import { ArtifactVerificationDecodeError, ArtifactVerificationRequestSchema, } from "#contracts/artifact/spec";
+import { verifyContentRendererCompatibility } from "#contracts/renderer/compatibility";
+/** Authenticates one artifact and its exact renderer compatibility contract. */
+export const verifySignedContentArtifact = Effect.fn("AksaraContracts.verifySignedContentArtifact")((input) => Schema.decodeUnknownEffect(ArtifactVerificationRequestSchema)(input, {
+    onExcessProperty: "error",
+}).pipe(Effect.mapError(() => new ArtifactVerificationDecodeError({
+    message: "Artifact verification input does not satisfy its exact wire contract.",
+})), Effect.flatMap((request) => Effect.gen(function* () {
+    const artifact = yield* verifySignedContentArtifactIntegrity(request.artifact);
+    yield* verifyContentRendererCompatibility({
+        payload: artifact.payload,
+        rendererContractVersion: request.rendererContractVersion,
+        rendererManifest: request.rendererManifest,
+    });
+    return artifact;
+}))));

package/dist/cache/content.d.ts

@@ -0,0 +1,52 @@
+import { Schema } from "effect";
+import { type ContentFamily } from "#contracts/content";
+import { type ReleaseId, type Sha256Hash } from "#contracts/ids";
+/** Global content-runtime tag always invalidated before narrower tags. */
+export declare const CONTENT_CACHE_GLOBAL_TAG = "content-runtime";
+/** Maximum exact artifact tags carried with global and family cache tags. */
+export declare const MAX_CONTENT_CACHE_ARTIFACTS = 98;
+/** One immutable published-artifact cache tag derived only from its hash. */
+export declare const ArtifactCacheTagSchema: Schema.brand<Schema.String, "@NakafaAI/AksaraArtifactCacheTag">;
+export type ArtifactCacheTag = typeof ArtifactCacheTagSchema.Type;
+/** One exact content-family cache tag derived from the family contract. */
+export declare const ContentFamilyCacheTagSchema: Schema.brand<Schema.String, "@NakafaAI/AksaraContentFamilyCacheTag">;
+export type ContentFamilyCacheTag = typeof ContentFamilyCacheTagSchema.Type;
+/**
+ * Ordered cache tags shared by Aksara and Nakafa.
+ *
+ * Global and exact family tags come first; remaining tags name exact changed
+ * artifacts while keeping one invalidation request at or below 100 tags.
+ */
+export declare const ContentCacheTagsSchema: Schema.TupleWithRest<Schema.Tuple<readonly [Schema.Literal<"content-runtime">, Schema.brand<Schema.String, "@NakafaAI/AksaraContentFamilyCacheTag">]>, readonly [Schema.brand<Schema.String, "@NakafaAI/AksaraArtifactCacheTag">]>;
+export type ContentCacheTags = typeof ContentCacheTagsSchema.Type;
+/** One changed family plus its optional newly published immutable artifact. */
+export declare const ContentCacheChangeSchema: Schema.Struct<{
+    readonly artifactHash: Schema.optional<Schema.brand<Schema.String, "@NakafaAI/AksaraSha256Hash">>;
+    readonly family: Schema.Literals<readonly ["article", "material", "page", "question"]>;
+}>;
+export type ContentCacheChange = typeof ContentCacheChangeSchema.Type;
+/** Derives the canonical cache tag for one already-canonical artifact hash. */
+export declare function makeArtifactCacheTag(hash: Sha256Hash): ArtifactCacheTag;
+/** Derives the canonical cache tag for one implemented content family. */
+export declare function makeContentFamilyCacheTag(family: ContentFamily): ContentFamilyCacheTag;
+/** One release-bound, family-exact cache invalidation request. */
+export declare const ContentCacheRequestSchema: Schema.Struct<{
+    readonly family: Schema.Literals<readonly ["article", "material", "page", "question"]>;
+    readonly releaseId: Schema.brand<Schema.String, "@NakafaAI/AksaraReleaseId">;
+    readonly tags: Schema.TupleWithRest<Schema.Tuple<readonly [Schema.Literal<"content-runtime">, Schema.brand<Schema.String, "@NakafaAI/AksaraContentFamilyCacheTag">]>, readonly [Schema.brand<Schema.String, "@NakafaAI/AksaraArtifactCacheTag">]>;
+}>;
+export type ContentCacheRequest = typeof ContentCacheRequestSchema.Type;
+/** Nakafa proof that one exact release-bound invalidation completed. */
+export declare const ContentCacheReceiptSchema: Schema.Struct<{
+    readonly family: Schema.Literals<readonly ["article", "material", "page", "question"]>;
+    readonly releaseId: Schema.brand<Schema.String, "@NakafaAI/AksaraReleaseId">;
+    readonly revalidated: Schema.Literal<true>;
+    readonly tags: Schema.TupleWithRest<Schema.Tuple<readonly [Schema.Literal<"content-runtime">, Schema.brand<Schema.String, "@NakafaAI/AksaraContentFamilyCacheTag">]>, readonly [Schema.brand<Schema.String, "@NakafaAI/AksaraArtifactCacheTag">]>;
+}>;
+export type ContentCacheReceipt = typeof ContentCacheReceiptSchema.Type;
+/** Builds one ordered invalidation request for one exact content family. */
+export declare function makeContentCacheRequest(input: {
+    readonly artifactHashes: readonly Sha256Hash[];
+    readonly family: ContentFamily;
+    readonly releaseId: ReleaseId;
+}): ContentCacheRequest;

package/dist/cache/content.js

@@ -0,0 +1,80 @@
+import { Schema } from "effect";
+import { ContentFamilySchema } from "#contracts/content";
+import { ReleaseIdSchema, Sha256HashSchema, } from "#contracts/ids";
+/** Global content-runtime tag always invalidated before narrower tags. */
+export const CONTENT_CACHE_GLOBAL_TAG = "content-runtime";
+const ARTIFACT_CACHE_PREFIX = "content-artifact:";
+const FAMILY_CACHE_PREFIX = "content-family:";
+/** Maximum exact artifact tags carried with global and family cache tags. */
+export const MAX_CONTENT_CACHE_ARTIFACTS = 98;
+/** One immutable published-artifact cache tag derived only from its hash. */
+export const ArtifactCacheTagSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((tag) => tag.startsWith(ARTIFACT_CACHE_PREFIX) &&
+    Schema.is(Sha256HashSchema)(tag.slice(ARTIFACT_CACHE_PREFIX.length)), {
+    message: "Expected content-artifact followed by one canonical SHA-256 hash.",
+})), Schema.brand("@NakafaAI/AksaraArtifactCacheTag"));
+/** One exact content-family cache tag derived from the family contract. */
+export const ContentFamilyCacheTagSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((tag) => tag.startsWith(FAMILY_CACHE_PREFIX) &&
+    Schema.is(ContentFamilySchema)(tag.slice(FAMILY_CACHE_PREFIX.length)), { message: "Expected one canonical content-family cache tag." })), Schema.brand("@NakafaAI/AksaraContentFamilyCacheTag"));
+/** Checks one cache request carries no redundant exact artifact tags. */
+function hasUniqueArtifactTags(tags) {
+    const artifacts = tags.slice(2);
+    return new Set(artifacts).size === artifacts.length;
+}
+/**
+ * Ordered cache tags shared by Aksara and Nakafa.
+ *
+ * Global and exact family tags come first; remaining tags name exact changed
+ * artifacts while keeping one invalidation request at or below 100 tags.
+ */
+export const ContentCacheTagsSchema = Schema.TupleWithRest(Schema.Tuple([
+    Schema.Literal(CONTENT_CACHE_GLOBAL_TAG),
+    ContentFamilyCacheTagSchema,
+]), [ArtifactCacheTagSchema]).pipe(Schema.check(Schema.isMaxLength(MAX_CONTENT_CACHE_ARTIFACTS + 2)), Schema.check(Schema.makeFilter(hasUniqueArtifactTags, {
+    message: "Expected unique exact artifact cache tags.",
+})));
+/** One changed family plus its optional newly published immutable artifact. */
+export const ContentCacheChangeSchema = Schema.Struct({
+    artifactHash: Schema.optional(Sha256HashSchema),
+    family: ContentFamilySchema,
+});
+/** Derives the canonical cache tag for one already-canonical artifact hash. */
+export function makeArtifactCacheTag(hash) {
+    return ArtifactCacheTagSchema.make(`${ARTIFACT_CACHE_PREFIX}${hash}`);
+}
+/** Derives the canonical cache tag for one implemented content family. */
+export function makeContentFamilyCacheTag(family) {
+    return ContentFamilyCacheTagSchema.make(`${FAMILY_CACHE_PREFIX}${family}`);
+}
+/** Checks the explicit family and ordered family cache tag cannot disagree. */
+function hasCoherentFamily(input) {
+    return input.tags[1] === makeContentFamilyCacheTag(input.family);
+}
+/** One release-bound, family-exact cache invalidation request. */
+export const ContentCacheRequestSchema = Schema.Struct({
+    family: ContentFamilySchema,
+    releaseId: ReleaseIdSchema,
+    tags: ContentCacheTagsSchema,
+}).pipe(Schema.check(Schema.makeFilter(hasCoherentFamily, {
+    message: "Expected the cache family to match its ordered family tag.",
+})));
+/** Nakafa proof that one exact release-bound invalidation completed. */
+export const ContentCacheReceiptSchema = Schema.Struct({
+    family: ContentFamilySchema,
+    releaseId: ReleaseIdSchema,
+    revalidated: Schema.Literal(true),
+    tags: ContentCacheTagsSchema,
+}).pipe(Schema.check(Schema.makeFilter(hasCoherentFamily, {
+    message: "Expected the cache family to match its ordered family tag.",
+})));
+/** Builds one ordered invalidation request for one exact content family. */
+export function makeContentCacheRequest(input) {
+    return ContentCacheRequestSchema.make({
+        family: input.family,
+        releaseId: input.releaseId,
+        tags: [
+            CONTENT_CACHE_GLOBAL_TAG,
+            makeContentFamilyCacheTag(input.family),
+            ...input.artifactHashes.map(makeArtifactCacheTag),
+        ],
+    });
+}

package/dist/content.d.ts

@@ -0,0 +1,168 @@
+import { Effect, Schema } from "effect";
+import { type ContentKey, type PublicPath, Sha256HashSchema } from "#contracts/ids";
+import { type AppLocale, type ArtifactLocale } from "#contracts/locale";
+/** Published content families backed by real Aksara source registries. */
+export declare const ContentFamilySchema: Schema.Literals<readonly ["article", "material", "page", "question"]>;
+export type ContentFamily = typeof ContentFamilySchema.Type;
+/** Exact authored person identity exposed by Nakafa content metadata. */
+export declare const ContentAuthorSchema: Schema.Struct<{
+    readonly name: Schema.String;
+}>;
+export type ContentAuthor = typeof ContentAuthorSchema.Type;
+/** Stable language-specific identity shared by artifacts and content heads. */
+export interface ContentHeadIdentity {
+    readonly artifactLocale: ArtifactLocale;
+    readonly contentKey: ContentKey;
+}
+/** Builds the unambiguous key used for one language-specific content head. */
+export declare function headIdentity(input: ContentHeadIdentity): string;
+/** Builds the unambiguous key used for one application-localized route. */
+export declare function routeIdentity(input: {
+    readonly appLocale: AppLocale;
+    readonly publicPath: PublicPath;
+}): string;
+/** Compares content heads using deterministic Unicode code-unit order. */
+export declare function compareContentHeads(left: ContentHeadIdentity, right: ContentHeadIdentity): -1 | 0 | 1;
+/** Compiler protocol implemented by this Aksara compiler release. */
+export declare const AKSARA_COMPILER_VERSION = "0.1.0";
+/** Official MDX compiler version used to produce function-body artifacts. */
+export declare const MDX_COMPILER_VERSION = "3.1.1";
+/** Authored source identity accepted before deterministic compilation. */
+export declare const CompileDocumentSourceSchema: Schema.Struct<{
+    readonly artifactLocale: Schema.brand<Schema.Literals<readonly ["en", "id", "de"]>, "@NakafaAI/AksaraArtifactLocale">;
+    readonly contentKey: Schema.brand<Schema.String, "@NakafaAI/AksaraContentKey">;
+    readonly rawMdx: Schema.String;
+    readonly rendererDomain: Schema.Literals<readonly ["ai-ds", "biology", "chemistry", "mathematics", "physics", "politics", "site", "snbt-general", "snbt-math", "snbt-plain", "snbt-quant", "tka-math"]>;
+    readonly sourcePath: Schema.brand<Schema.String, "@NakafaAI/AksaraCorpusSourcePath">;
+}>;
+export type CompileDocumentSource = typeof CompileDocumentSourceSchema.Type;
+/** Validated request accepted by the trusted MDX compiler. */
+export declare const CompileDocumentRequestSchema: Schema.Struct<{
+    readonly artifactLocale: Schema.brand<Schema.Literals<readonly ["en", "id", "de"]>, "@NakafaAI/AksaraArtifactLocale">;
+    readonly contentKey: Schema.brand<Schema.String, "@NakafaAI/AksaraContentKey">;
+    readonly rawMdx: Schema.String;
+    readonly rendererDomain: Schema.Literals<readonly ["ai-ds", "biology", "chemistry", "mathematics", "physics", "politics", "site", "snbt-general", "snbt-math", "snbt-plain", "snbt-quant", "tka-math"]>;
+    readonly sourcePath: Schema.brand<Schema.String, "@NakafaAI/AksaraCorpusSourcePath">;
+    readonly rendererManifest: Schema.Struct<{
+        readonly base: Schema.Struct<{
+            authoringComponents: Schema.$Array<Schema.Struct<{
+                readonly name: Schema.String;
+                readonly version: Schema.Finite;
+            }>>;
+            supportedComponents: Schema.$Array<Schema.Struct<{
+                readonly name: Schema.String;
+                readonly version: Schema.Finite;
+            }>>;
+        }>;
+        readonly domains: Schema.$Array<Schema.Struct<{
+            readonly authoringComponents: Schema.$Array<Schema.Struct<{
+                readonly name: Schema.String;
+                readonly version: Schema.Finite;
+            }>>;
+            readonly name: Schema.Literals<readonly ["ai-ds", "biology", "chemistry", "mathematics", "physics", "politics", "site", "snbt-general", "snbt-math", "snbt-plain", "snbt-quant", "tka-math"]>;
+            readonly supportedComponents: Schema.$Array<Schema.Struct<{
+                readonly name: Schema.String;
+                readonly version: Schema.Finite;
+            }>>;
+        }>>;
+        readonly format: Schema.Literal<"nakafa-mdx-renderer-v1">;
+        readonly hash: Schema.brand<Schema.String, "@NakafaAI/AksaraSha256Hash">;
+        readonly publishedDomains: Schema.$Array<Schema.Literals<readonly ["ai-ds", "biology", "chemistry", "mathematics", "physics", "politics", "site", "snbt-general", "snbt-math", "snbt-plain", "snbt-quant", "tka-math"]>>;
+        readonly rendererContractVersion: Schema.Literal<"1.0.0">;
+    }>;
+}>;
+export type CompileDocumentRequest = typeof CompileDocumentRequestSchema.Type;
+/** Precompiled trusted payload stored and signed before server-only execution. */
+export declare const CompiledContentPayloadSchema: Schema.Struct<{
+    readonly artifactLocale: Schema.brand<Schema.Literals<readonly ["en", "id", "de"]>, "@NakafaAI/AksaraArtifactLocale">;
+    readonly byteLength: Schema.Finite;
+    readonly compiledCode: Schema.String;
+    readonly compilerConfigHash: Schema.brand<Schema.String, "@NakafaAI/AksaraSha256Hash">;
+    readonly compilerVersion: Schema.Literal<"0.1.0">;
+    readonly contentKey: Schema.brand<Schema.String, "@NakafaAI/AksaraContentKey">;
+    readonly format: Schema.Literal<"mdx-function-body">;
+    readonly mdxCompilerVersion: Schema.Literal<"3.1.1">;
+    readonly plainText: Schema.String;
+    readonly rawMdx: Schema.String;
+    readonly rendererDomain: Schema.Literals<readonly ["ai-ds", "biology", "chemistry", "mathematics", "physics", "politics", "site", "snbt-general", "snbt-math", "snbt-plain", "snbt-quant", "tka-math"]>;
+    readonly requiredComponents: Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        readonly version: Schema.Finite;
+    }>>;
+    readonly sourceHash: Schema.brand<Schema.String, "@NakafaAI/AksaraSha256Hash">;
+}>;
+export type CompiledContentPayload = typeof CompiledContentPayloadSchema.Type;
+/** Immutable compiled payload plus its asymmetric authenticity proof. */
+export declare const SignedContentArtifactSchema: Schema.Struct<{
+    readonly artifactHash: Schema.brand<Schema.String, "@NakafaAI/AksaraSha256Hash">;
+    readonly keyId: Schema.brand<Schema.String, "@NakafaAI/AksaraSigningKeyId">;
+    readonly payload: Schema.Struct<{
+        readonly artifactLocale: Schema.brand<Schema.Literals<readonly ["en", "id", "de"]>, "@NakafaAI/AksaraArtifactLocale">;
+        readonly byteLength: Schema.Finite;
+        readonly compiledCode: Schema.String;
+        readonly compilerConfigHash: Schema.brand<Schema.String, "@NakafaAI/AksaraSha256Hash">;
+        readonly compilerVersion: Schema.Literal<"0.1.0">;
+        readonly contentKey: Schema.brand<Schema.String, "@NakafaAI/AksaraContentKey">;
+        readonly format: Schema.Literal<"mdx-function-body">;
+        readonly mdxCompilerVersion: Schema.Literal<"3.1.1">;
+        readonly plainText: Schema.String;
+        readonly rawMdx: Schema.String;
+        readonly rendererDomain: Schema.Literals<readonly ["ai-ds", "biology", "chemistry", "mathematics", "physics", "politics", "site", "snbt-general", "snbt-math", "snbt-plain", "snbt-quant", "tka-math"]>;
+        readonly requiredComponents: Schema.$Array<Schema.Struct<{
+            readonly name: Schema.String;
+            readonly version: Schema.Finite;
+        }>>;
+        readonly sourceHash: Schema.brand<Schema.String, "@NakafaAI/AksaraSha256Hash">;
+    }>;
+    readonly signature: Schema.brand<Schema.String, "@NakafaAI/AksaraEd25519Signature">;
+}>;
+export type SignedContentArtifact = typeof SignedContentArtifactSchema.Type;
+/** Serializes a compiled payload with stable field and component order. */
+export declare function canonicalizeCompiledContentPayload(payload: CompiledContentPayload): string;
+/** Returns the domain-separated canonical bytes covered by Ed25519. */
+export declare function canonicalizeContentArtifactSigningInput(artifactHash: typeof Sha256HashSchema.Type, payload: CompiledContentPayload): string;
+/** Serializes a complete signed artifact with deterministic wire field order. */
+export declare function canonicalizeSignedContentArtifact(artifact: SignedContentArtifact): string;
+/** Decodes unknown compiler input without throwing parser exceptions. */
+export declare const decodeCompileDocumentRequest: (input: unknown) => Effect.Effect<{
+    readonly artifactLocale: ("de" | "en" | "id") & import("effect/Brand").Brand<"@NakafaAI/AksaraArtifactLocale">;
+    readonly contentKey: string & import("effect/Brand").Brand<"@NakafaAI/AksaraContentKey">;
+    readonly rawMdx: string;
+    readonly rendererDomain: "ai-ds" | "biology" | "chemistry" | "mathematics" | "physics" | "politics" | "site" | "snbt-general" | "snbt-math" | "snbt-plain" | "snbt-quant" | "tka-math";
+    readonly sourcePath: string & import("effect/Brand").Brand<"@NakafaAI/AksaraCorpusSourcePath">;
+    readonly rendererManifest: {
+        readonly base: {
+            readonly authoringComponents: readonly {
+                readonly name: string;
+                readonly version: number;
+            }[];
+            readonly supportedComponents: readonly {
+                readonly name: string;
+                readonly version: number;
+            }[];
+        };
+        readonly domains: readonly {
+            readonly authoringComponents: readonly {
+                readonly name: string;
+                readonly version: number;
+            }[];
+            readonly name: "ai-ds" | "biology" | "chemistry" | "mathematics" | "physics" | "politics" | "site" | "snbt-general" | "snbt-math" | "snbt-plain" | "snbt-quant" | "tka-math";
+            readonly supportedComponents: readonly {
+                readonly name: string;
+                readonly version: number;
+            }[];
+        }[];
+        readonly format: "nakafa-mdx-renderer-v1";
+        readonly hash: string & import("effect/Brand").Brand<"@NakafaAI/AksaraSha256Hash">;
+        readonly publishedDomains: readonly ("ai-ds" | "biology" | "chemistry" | "mathematics" | "physics" | "politics" | "site" | "snbt-general" | "snbt-math" | "snbt-plain" | "snbt-quant" | "tka-math")[];
+        readonly rendererContractVersion: "1.0.0";
+    };
+}, import("./errors.js").ContractDecodeError, never>;
+/** Strictly decodes one authored source before a publication recompile. */
+export declare const decodeCompileDocumentSource: (input: unknown) => Effect.Effect<{
+    readonly artifactLocale: ("de" | "en" | "id") & import("effect/Brand").Brand<"@NakafaAI/AksaraArtifactLocale">;
+    readonly contentKey: string & import("effect/Brand").Brand<"@NakafaAI/AksaraContentKey">;
+    readonly rawMdx: string;
+    readonly rendererDomain: "ai-ds" | "biology" | "chemistry" | "mathematics" | "physics" | "politics" | "site" | "snbt-general" | "snbt-math" | "snbt-plain" | "snbt-quant" | "tka-math";
+    readonly sourcePath: string & import("effect/Brand").Brand<"@NakafaAI/AksaraCorpusSourcePath">;
+}, import("./errors.js").ContractDecodeError, never>;

package/dist/content.js

@@ -0,0 +1,107 @@
+import { Effect, Schema } from "effect";
+import { decodeContract } from "#contracts/decode";
+import { ContentKeySchema, CorpusSourcePathSchema, Ed25519SignatureSchema, Sha256HashSchema, SigningKeyIdSchema, } from "#contracts/ids";
+import { ArtifactLocaleSchema, } from "#contracts/locale";
+import { CompiledContentRequirementsSchema } from "#contracts/renderer/component";
+import { RendererManifestEnvelopeSchema } from "#contracts/renderer/contract";
+import { RendererDomainSchema } from "#contracts/renderer/domain";
+import { compareCodeUnits } from "#contracts/text/order";
+/** Published content families backed by real Aksara source registries. */
+export const ContentFamilySchema = Schema.Literals([
+    "article",
+    "material",
+    "page",
+    "question",
+]);
+/** Exact authored person identity exposed by Nakafa content metadata. */
+export const ContentAuthorSchema = Schema.Struct({ name: Schema.String });
+/** Builds the unambiguous key used for one language-specific content head. */
+export function headIdentity(input) {
+    return `${input.contentKey}\0${input.artifactLocale}`;
+}
+/** Builds the unambiguous key used for one application-localized route. */
+export function routeIdentity(input) {
+    return `${input.appLocale}\0${input.publicPath}`;
+}
+/** Compares content heads using deterministic Unicode code-unit order. */
+export function compareContentHeads(left, right) {
+    const contentKeyOrder = compareCodeUnits(left.contentKey, right.contentKey);
+    return (contentKeyOrder ||
+        compareCodeUnits(left.artifactLocale, right.artifactLocale));
+}
+/** Compiler protocol implemented by this Aksara compiler release. */
+export const AKSARA_COMPILER_VERSION = "0.1.0";
+/** Official MDX compiler version used to produce function-body artifacts. */
+export const MDX_COMPILER_VERSION = "3.1.1";
+/** Authored source identity accepted before deterministic compilation. */
+export const CompileDocumentSourceSchema = Schema.Struct({
+    artifactLocale: ArtifactLocaleSchema,
+    contentKey: ContentKeySchema,
+    rawMdx: Schema.String,
+    rendererDomain: RendererDomainSchema,
+    sourcePath: CorpusSourcePathSchema,
+});
+/** Validated request accepted by the trusted MDX compiler. */
+export const CompileDocumentRequestSchema = Schema.Struct({
+    ...CompileDocumentSourceSchema.fields,
+    rendererManifest: RendererManifestEnvelopeSchema,
+}).pipe(Schema.check(Schema.makeFilter((request) => request.rendererManifest.domains.some(({ name }) => name === request.rendererDomain), {
+    message: "Expected the selected renderer domain to have a capability.",
+})));
+/** Precompiled trusted payload stored and signed before server-only execution. */
+export const CompiledContentPayloadSchema = Schema.Struct({
+    artifactLocale: ArtifactLocaleSchema,
+    byteLength: Schema.Finite.pipe(Schema.check(Schema.isInt()), Schema.check(Schema.isGreaterThanOrEqualTo(0))),
+    compiledCode: Schema.String,
+    compilerConfigHash: Sha256HashSchema,
+    compilerVersion: Schema.Literal(AKSARA_COMPILER_VERSION),
+    contentKey: ContentKeySchema,
+    format: Schema.Literal("mdx-function-body"),
+    mdxCompilerVersion: Schema.Literal(MDX_COMPILER_VERSION),
+    plainText: Schema.String,
+    rawMdx: Schema.String,
+    rendererDomain: RendererDomainSchema,
+    requiredComponents: CompiledContentRequirementsSchema,
+    sourceHash: Sha256HashSchema,
+});
+/** Immutable compiled payload plus its asymmetric authenticity proof. */
+export const SignedContentArtifactSchema = Schema.Struct({
+    artifactHash: Sha256HashSchema,
+    keyId: SigningKeyIdSchema,
+    payload: CompiledContentPayloadSchema,
+    signature: Ed25519SignatureSchema,
+});
+const CONTENT_ARTIFACT_SIGNATURE_DOMAIN = "nakafa.aksara.content-artifact";
+/** Serializes a compiled payload with stable field and component order. */
+export function canonicalizeCompiledContentPayload(payload) {
+    return JSON.stringify({
+        artifactLocale: payload.artifactLocale,
+        byteLength: payload.byteLength,
+        compiledCode: payload.compiledCode,
+        compilerConfigHash: payload.compilerConfigHash,
+        compilerVersion: payload.compilerVersion,
+        contentKey: payload.contentKey,
+        format: payload.format,
+        mdxCompilerVersion: payload.mdxCompilerVersion,
+        plainText: payload.plainText,
+        rawMdx: payload.rawMdx,
+        rendererDomain: payload.rendererDomain,
+        requiredComponents: payload.requiredComponents.map(({ name, version }) => ({
+            name,
+            version,
+        })),
+        sourceHash: payload.sourceHash,
+    });
+}
+/** Returns the domain-separated canonical bytes covered by Ed25519. */
+export function canonicalizeContentArtifactSigningInput(artifactHash, payload) {
+    return `${CONTENT_ARTIFACT_SIGNATURE_DOMAIN}\n${artifactHash}\n${canonicalizeCompiledContentPayload(payload)}`;
+}
+/** Serializes a complete signed artifact with deterministic wire field order. */
+export function canonicalizeSignedContentArtifact(artifact) {
+    return `{"artifactHash":${JSON.stringify(artifact.artifactHash)},"keyId":${JSON.stringify(artifact.keyId)},"payload":${canonicalizeCompiledContentPayload(artifact.payload)},"signature":${JSON.stringify(artifact.signature)}}`;
+}
+/** Decodes unknown compiler input without throwing parser exceptions. */
+export const decodeCompileDocumentRequest = Effect.fn("AksaraContracts.decodeCompileDocumentRequest")((input) => decodeContract(CompileDocumentRequestSchema, "CompileDocumentRequest", input));
+/** Strictly decodes one authored source before a publication recompile. */
+export const decodeCompileDocumentSource = Effect.fn("AksaraContracts.decodeCompileDocumentSource")((input) => decodeContract(CompileDocumentSourceSchema, "CompileDocumentSource", input));

package/dist/country.d.ts

@@ -0,0 +1,4 @@
+import { Schema } from "effect";
+/** ISO 3166-1 alpha-2 code shared by country-owned content domains. */
+export declare const CountryCodeSchema: Schema.String;
+export type CountryCode = typeof CountryCodeSchema.Type;

package/dist/country.js

@@ -0,0 +1,8 @@
+import { Schema } from "effect";
+const COUNTRY_CODE_PATTERN = /^[A-Z]{2}$/u;
+/** ISO 3166-1 alpha-2 code shared by country-owned content domains. */
+export const CountryCodeSchema = Schema.String.pipe(Schema.check(Schema.isPattern(COUNTRY_CODE_PATTERN, {
+    description: "Uppercase ISO 3166-1 alpha-2 country code.",
+    identifier: "CountryCode",
+    message: "Invalid country code.",
+})));

package/dist/date.d.ts

@@ -0,0 +1,24 @@
+import { Schema } from "effect";
+/** Exact source-authored calendar date shared by content projections. */
+export declare const DateOnlySchema: Schema.String;
+export type DateOnly = typeof DateOnlySchema.Type;
+/**
+ * Public authored dates backed by signed activation history.
+ * Publication is locale-specific; modification records only a later meaningful
+ * content activation and is never synthesized from a runtime clock.
+ */
+export declare const PublicationDatesSchema: Schema.Struct<{
+    dateModified: Schema.optionalKey<Schema.String>;
+    datePublished: Schema.String;
+}>;
+export type PublicationDates = typeof PublicationDatesSchema.Type;
+/**
+ * Adds exact publication dates and their chronological invariant to metadata.
+ *
+ * The date fields and their check remain one contract so callers cannot copy
+ * the shape without also enforcing the public ordering rule.
+ */
+export declare function withPublicationDates<const Fields extends Schema.Struct.Fields>(fields: Fields): Schema.Struct<Readonly<Fields & {
+    dateModified: Schema.optionalKey<Schema.String>;
+    datePublished: Schema.String;
+}> extends infer T ? { [K in keyof T]: T[K]; } : never>;

package/dist/date.js

@@ -0,0 +1,44 @@
+import { Schema } from "effect";
+const DATE_ONLY_PATTERN = /^(\d{4})-(\d{2})-(\d{2})$/u;
+/** Checks a source-authored date against the real ISO calendar. */
+function isDateOnly(value) {
+    if (!DATE_ONLY_PATTERN.test(value)) {
+        return false;
+    }
+    const year = Number.parseInt(value.slice(0, 4), 10);
+    const month = Number.parseInt(value.slice(5, 7), 10);
+    const day = Number.parseInt(value.slice(8, 10), 10);
+    const date = new Date(Date.UTC(year, month - 1, day));
+    return (date.getUTCFullYear() === year &&
+        date.getUTCMonth() === month - 1 &&
+        date.getUTCDate() === day);
+}
+/** Exact source-authored calendar date shared by content projections. */
+export const DateOnlySchema = Schema.String.pipe(Schema.check(Schema.makeFilter(isDateOnly)));
+const PUBLICATION_DATE_ORDER_MESSAGE = "Expected dateModified to be later than datePublished.";
+const PublicationDateFields = {
+    dateModified: Schema.optionalKey(DateOnlySchema),
+    datePublished: DateOnlySchema,
+};
+const PublicationDatesStruct = Schema.Struct(PublicationDateFields).annotate({
+    parseOptions: { onExcessProperty: "error" },
+});
+/**
+ * Public authored dates backed by signed activation history.
+ * Publication is locale-specific; modification records only a later meaningful
+ * content activation and is never synthesized from a runtime clock.
+ */
+export const PublicationDatesSchema = PublicationDatesStruct.pipe(Schema.check(Schema.makeFilter((input) => input.dateModified === undefined ||
+    input.dateModified > input.datePublished, { message: PUBLICATION_DATE_ORDER_MESSAGE })), Schema.annotate({ parseOptions: { onExcessProperty: "error" } }));
+/**
+ * Adds exact publication dates and their chronological invariant to metadata.
+ *
+ * The date fields and their check remain one contract so callers cannot copy
+ * the shape without also enforcing the public ordering rule.
+ */
+export function withPublicationDates(fields) {
+    return PublicationDatesSchema.mapFields((dateFields) => ({ ...fields, ...dateFields }), 
+    // Adding fields cannot invalidate the date check because the owning date
+    // fields are preserved unchanged and always win key collisions.
+    { unsafePreserveChecks: true }).annotate({ parseOptions: { onExcessProperty: "error" } });
+}