@owlmeans/viable-common 0.0.24 → 0.0.26

package/src/skills/catalogue.ts

@@ -82,9 +82,6 @@ export const ALIAS_CONVENTION = `
   \`web:layout:\` alias and no \`app.web.layout\` — writing either addresses nothing.
 - An endpoint alias is \`api:<entity>:<action>\` — \`api:task:list\`, \`api:task:create\`. The
   group alias that carries the shared path and guard is \`api:<entity>\` — \`api:task\`.
-- A queued job alias is \`job:<entity>:<action>\` — \`job:report:build\`, \`job:contract:analyze\`.
-  A job is never given a \`web:\` or \`api:\` alias, and an endpoint is never given a \`job:\` one:
-  the prefix is what says which side serves it.
 - Lowercase kebab-case in every segment. The prefix is NOT optional and NOT decorative: access
   rules are applied per side by it.
 `.trim()
@@ -103,11 +100,12 @@ The generated project is a \`@owlmeans/create-app\` monorepo with five workspace
 - \`sources/web\` — the react application.
 - \`sources/worker\` — the queue consumer. Same context, no HTTP routes, one processor per job.
 
-These files are the CONTRACT between the packages. Every screen, endpoint and job passes through
-them, and each has a sentinel comment marking where a new line goes:
+These files are the CONTRACT between the public packages. Every screen and endpoint passes through
+them; technical worker protocols live in the backend package instead:
 
 - \`sources/common/src/consts.ts\` — the \`app\` alias tree.
 - \`sources/common/src/entrypoints.ts\` — the shared immutable protocol tree (\`appEntrypoints\`).
+- \`sources/backend/src/jobs/index.ts\` — backend-only queue protocols and declarations.
 - \`sources/api/src/entrypoints.ts\` — server bindings: \`bind\` + one \`handlers<Context>()\` wrap
   per handler.
 - \`sources/web/src/entrypoints.ts\` — client bindings (\`bindAll\` + \`bindScreen\`).
@@ -598,39 +596,66 @@ carries. Introducing a second spelling orphans every grant made against the firs
   files, not a copy of their own. They are already there: import them, never delete, rename or
   move one, and never re-add a primitive the directory already carries.
 - Styling is Tailwind utility classes. There are no CSS modules and no styled-components.
+- The GROUND is white in light mode and black in dark mode, and it stays that way: every page,
+  section, band and header sits on \`bg-background\`. Colour comes from ONE product accent —
+  \`bg-primary\` / \`text-primary\` — and only on the primary button, a section's small label, the rule
+  over the first step and a check mark. It never comes from a background, a tint or a band.
+
+      <section className="bg-primary/10 py-20">...</section>                       // WRONG
+      <section className="bg-gradient-to-b from-amber-50 to-white py-20">...</section>  // WRONG
+      <section className="border-t py-20">...</section>                            // right
+
+- Depth comes from exactly three things: a 1px HAIRLINE (\`border\`, the \`--border\` token), the
+  NEUTRAL TILE (\`bg-muted\` — the only tinted surface: feature tiles, testimonial tiles, result
+  rows), and ONE shadow, \`shadow-floating\`, which belongs to the one card that floats (the landing
+  gate). An ordinary card is \`rounded-xl border bg-card\` and carries no shadow. There are no
+  gradients, no glass, no backdrop blur, no glow and no coloured shadows anywhere in the interface.
+
+      <div className="rounded-xl bg-white/60 shadow-2xl backdrop-blur-md p-6" />  // WRONG
+      <div className="rounded-xl border bg-card p-6" />                           // right
+      <li className="rounded-[32px] bg-muted p-10" />                             // right — a tile
+
+- TYPE carries the brand. Headings are the theme's heavy grotesk — \`font-extrabold\` with tight
+  negative tracking (\`tracking-tight\`, or \`tracking-[-0.045em]\` on a section heading) and
+  \`text-balance\`; paragraphs are \`text-muted-foreground\` with \`text-pretty\` and a readable
+  measure (\`max-w-[52ch]\`); whitespace is generous. Never set a different font family.
+- A section opens with a small LABEL — a plain \`<p className="text-[15px] font-bold text-primary">\`
+  — then its \`<h2>\`. A label is text: never a chip, a pill or a badge.
+- Buttons are pills. The primary one is \`cta-btn\` (on an \`<a>\` or a bare \`<button>\`, never on a
+  shadcn \`Button\`, whose own \`bg-\` utility would win); the secondary one is
+  \`rounded-full border-[1.5px] border-foreground text-foreground hover:bg-muted\`. Labels are verbs.
+- Motion is small and belongs to the picture: \`reveal\` fades a block in once as it enters, and
+  \`float-slow\` / \`drift-slow\` lift PARTS OF AN ILLUSTRATION by a few pixels. Nothing spins,
+  pulses, orbits or scales, and nothing moves for someone who asked for reduced motion.
+- The stylesheet still defines the older classes \`gradient-heading\`, \`glass-card\`, \`eyebrow\`,
+  \`glow-orb\`, \`shadow-soft\`, \`shadow-raised\`, \`shadow-glow\`, \`pulse-soft\` and \`spin-slow\`,
+  because screens written earlier use them. They are REPAINTED flat — \`gradient-heading\` is solid
+  ink, \`glass-card\` a neutral tile, \`eyebrow\` a plain accent label, \`glow-orb\` hidden, the three
+  shadows and the two animations nothing at all. Never reach for one of them as decoration: it
+  paints nothing, or it paints the flat thing you could have written directly. Do not invent other
+  classes in the same family.
+- Overrides: change any of the look rules above — the ground, the accent, depth, type, motion —
+  ONLY when the customer's specification explicitly asks: it names a background colour, a
+  dark-only or coloured theme, a brand palette, or gradients. The product's subject matter is not
+  a request — a bakery is not a warm background and a bank is not a blue one.
 - Colour comes in PAIRS. Every surface token in this theme has a foreground partner —
   \`--background\`/\`--foreground\`, \`--card\`/\`--card-foreground\`, \`--primary\`/\`--primary-foreground\`,
   and the same for \`secondary\`, \`muted\`, \`accent\`, \`popover\`, \`destructive\` and \`sidebar\`. Painting a
   surface is therefore never a single decision: give the element its partner in the SAME
   \`className\`, or the text keeps the colour meant for the surface underneath and vanishes wherever
-  the design made that surface dark.
+  that surface is dark.
 
-      <section className="bg-primary p-6">Join us</section>                         // WRONG
-      <section className="bg-primary text-primary-foreground p-6">Join us</section>  // right
+      <a className="rounded-full bg-primary px-7 py-3">Get started</a>                          // WRONG
+      <a className="rounded-full bg-primary text-primary-foreground px-7 py-3">Get started</a>  // right
 
-  Nothing catches the wrong form — it compiles and it renders. It is unreadable only on the
-  surfaces the design happened to make dark, which is why it survives to the finished screen.
+  Nothing catches the wrong form — it compiles and it renders. It is unreadable only where the
+  accent happens to be dark, which is why it survives to the finished screen.
 - Never paint a surface with a raw or palette colour — \`bg-slate-900\`, \`bg-[#101820]\`,
   \`style={{ background: '#101820' }}\`. Those have no foreground partner, so nothing keeps the text
-  on them legible, and they ignore the theme. Every surface is one of the tokens above.
-- Depth and emphasis come from the theme's DECORATION VOCABULARY, and using it is expected rather
-  than exceptional — a screen built only from flat cards is an unfinished screen. That vocabulary
-  is: the component classes \`gradient-heading\` (a page or section headline), \`glass-card\` (a
-  panel with depth), \`eyebrow\` (the small chip above a headline), \`cta-btn\` (the primary call to
-  action, on an \`<a>\` or a bare \`<button>\`, never on a shadcn \`Button\` whose own \`bg-\`
-  utility would win), \`glow-orb\` (a soft colour field behind a section, always
-  \`pointer-events-none\` and behind the content); the elevation utilities \`shadow-soft\`,
-  \`shadow-raised\`, \`shadow-floating\`, \`shadow-glow\`; the idle-motion classes \`reveal\`,
-  \`float-slow\`, \`drift-slow\`, \`pulse-soft\`, \`spin-slow\`; and gradients whose stops are THEME
-  tokens with opacity. None of these is a raw colour.
-
-      <div className="bg-[radial-gradient(#818cf8,transparent)] blur-[120px]" />   // WRONG
-      <span className="glow-orb h-80 w-96 -z-10" aria-hidden />                    // right
-      <div className="bg-gradient-to-br from-primary/20 to-transparent p-6" />     // right
-
-  Keep a gradient under a text element light — \`/20\` or less — unless the element also carries a
-  \`-foreground\` partner class. These class names are defined in the project's stylesheet; do not
-  invent others in the same family.
+  on them legible, and they ignore the theme and its dark mode. Every surface is one of the tokens
+  above.
+- Every interactive element keeps its visible \`focus-visible\` ring, is at least 44px tall to touch,
+  and never signals anything by hover alone.
 - Text that is NOT on a coloured surface takes NO colour class: it already inherits the readable
   one. Never add \`text-white\`, \`text-black\` or a \`-foreground\` class "to be safe" — on an ordinary
   panel that is the same fault inverted. \`text-muted-foreground\` for secondary text is the
@@ -795,6 +820,84 @@ symbols from the component name (PascalCase of the component definition — for
 Both sides must use these exact names. This is a DEFAULT: when a "View-model contract"
 block is present in the task, it lists the symbols that actually exist and overrides this
 convention entirely.
+`),
+
+  skill(ViableSkill.LandingGate, 'The landing gate — from the landing page into the app', `
+A product can let a guest START its key end-user workflow on the landing page, before any account
+exists, and finish it in the app after signing in with the choices they made carried over. The
+card that does this is the LANDING GATE. It sits in the hero where the call-to-action buttons
+would be, and it REPLACES them.
+
+**Which story is gate-worthy.** At most ONE per project, and only a story that is all of:
+- in the \`user\` area — the signed-in END user's own workflow, never an operator's, an owner's or
+  one a guest already completes without signing in;
+- a FIRST-VALUE step — something useful comes out of it the moment the guest acts;
+- begun with NON-SENSITIVE input — a few picks, a filter, a short text. Never a payment, an
+  address, an upload, contact details or anything else about the person.
+A pantry-to-recipe finder is gate-worthy: pick ingredients, see what you can bake. Checking out a
+basket, setting up a profile or reviewing a queue of requests is not. When no story qualifies
+there is no gate and the hero keeps its buttons — a correct answer, not a failure.
+
+**The card.** The sketch is \`@/components/home/gate\`; the implemented one is
+\`@/components/home/landing-gate\` and exports the same \`LandingGate\` with the same props.
+- Its root is \`<div id="gate" data-home-gate>\` — never a \`<section>\`, \`<aside>\`, \`<header>\`
+  or \`<footer>\`; the page already has exactly one of each landmark it needs.
+- A question in the end user's words as its heading, and a "No account needed" hint beside it.
+- 5 to 8 choice chips, each a \`<button type="button" aria-pressed={selected}>\` inside a
+  \`role="group"\` with an \`aria-label\`, 4 or 5 pre-selected so the first view already shows
+  results. When choices do not fit, 1 to 3 labelled fields instead.
+- A count with \`aria-live="polite"\`, at most 2 result rows re-ranked on every change, and one
+  line for when nothing matches. A row's lock icon is named "Full details after sign-in".
+- A one-line note ("Sign in with your email. Your picks come with you.") and ONE primary button,
+  straight after the choices in tab order. No second button beside it.
+- The sketch works signed out and offline from its sample records. The implemented card may call
+  a PUBLIC endpoint; never one that needs a signed-in user.
+
+**The handoff.** The button carries the guest's choices across sign-in in \`sessionStorage\`,
+through \`@/lib/handoff\` — never in the URL, never in a cookie, never through the server:
+
+    import { useLogin } from '@owlmeans/client-iam'
+    import { writeLandingHandoff } from '@/lib/handoff'
+
+    const [, login] = useLogin(target)
+    const start = () => {
+      writeLandingHandoff(target, { picks })
+      login()
+    }
+    <button type="button" className="cta-btn" onClick={start}>{cta}</button>
+
+- \`target\` is the ALIAS of the story's own full-scale screen in the user area — the prop the guest
+  home passes — never a URL. \`useLogin(target)\` returns \`[path, handler]\`, and the handler
+  brings the person to \`target\` once they are signed in.
+- The click handler is SYNCHRONOUS: write, then call the handler, in the same gesture. A sign-in
+  that has to open a window is eaten by the popup blocker once anything has been awaited first.
+
+      onClick={async () => { await saveDraft(picks); login() }}     // WRONG — the gesture is gone
+      href={'/frontoffice/recipes?picks=' + picks.join(',')}         // WRONG — a URL, the picks in it, no sign-in
+
+**The full-scale screen** — the story's own screen in the user area — reads the handoff once in its
+view model, pre-fills from it, says so in one line, and clears it:
+
+    import { clearLandingHandoff, readLandingHandoff } from '@/lib/handoff'
+
+    useEffect(() => {
+      const carried = readLandingHandoff<{ picks: string[] }>(alias)
+      if (carried == null) return
+      setPicks(carried.picks)
+      setCarriedOver(true)          // "We kept your 4 picks from the home page."
+      clearLandingHandoff()
+    }, [alias])
+
+\`alias\` is the screen's own alias — the same string the gate was given as \`target\`. A missing,
+expired or foreign handoff reads as \`null\`, and the screen then starts empty exactly as it does for
+someone who arrived from the menu; never treat its absence as an error.
+
+**Never:**
+- ask for an account, a payment, an email address or any personal detail before sign-in — the gate
+  collects choices and nothing else, and the handoff stores only those choices;
+- render a story code, a "Preview" badge or a dashed frame inside the gate — it is the product's
+  public face in production;
+- keep the hero's buttons beside a gate, or give the gate a second call to action.
 `),
 
   skill(ViableSkill.ResourceLayer, 'OwlMeans resources own the schema', `
@@ -1390,25 +1493,34 @@ the work is invisible and the user is left pressing a button that appears to do
   `),
 
   skill(ViableSkill.WorkerJobs, 'Queues, jobs and processors', `
-Three files have to agree, and a job that exists in two of the three is worse than one that
+Three server-side bindings have to agree, and a job that exists in two of the three is worse than one that
 exists in none — a declared name nothing processes is a message that piles up, and a processor
 with no declaration is dead code the barrel still imports.
 
-## 1. The queue — \`sources/backend/src/jobs/index.ts\`
+## 1. The protocol and queue — \`sources/backend/src/jobs/index.ts\`
 A queue is an ADDRESS: it says what exists and which job names it accepts. Both the api (which
 enqueues) and the worker (which consumes) read this one list, and a job name the queue does not
-declare is refused at enqueue time.
+declare is refused at enqueue time. The technical protocol belongs here too; common and web must
+not import it.
 
 \`\`\`ts
+export const jobProtocols = {
+  reportBuild: protocol(route(
+    'job:report:build', '/report-build',
+    queueRoute({ service: APP_WORKER, queue: APP_QUEUE, timeout: 30_000 }),
+  ), contract(typed())),
+}
 export const queues: QueueDeclaration[] = [
-  { name: APP_QUEUE, jobs: [app.job.test, app.job.<name>],
+  { name: APP_QUEUE, jobs: [jobProtocols.reportBuild.alias],
     worker: { concurrency: 4, lockDuration: 60_000 } },
 ]
 \`\`\`
 
-## 2. The alias and the entrypoint — \`sources/common/src\`
-The job's name IS its entrypoint alias. Declare \`app.job.<name>\` in \`consts.ts\` above the
-sentinel, and the protocol in \`entrypoints.ts\` with \`job()\` from \`@owlmeans/route\`.
+Use \`job()\` from \`@owlmeans/queue\`, never from the generic route package.
+
+## 2. The producer — \`sources/api/src/entrypoints.ts\`
+Bind \`bindClient(jobProtocols.reportBuild)\`. Public API contracts in common describe the domain
+operation and do not disclose that the handler delegates to a queue.
 
 ## 3. The processor — \`sources/worker/src/jobs/<name>.ts\`
 A PLAIN exported async function — named exports only, exactly like an endpoint handler. It never
@@ -1421,7 +1533,7 @@ imports \`handlers\` and never calls \`handlers<Context>()\`; that belongs only
     // sources/worker/src/entrypoints.ts — the ONLY wrap
     import * as jobs from '@/jobs/index.js'
     const worker = handlers<Context>()
-    bind(protocols.job.reportBuild, worker.request(protocols.job.reportBuild, jobs.handleReportBuildJob))
+    bind(jobProtocols.reportBuild, worker.request(jobProtocols.reportBuild, jobs.handleReportBuildJob))
 
 WRONG — the processor module ALSO calls \`handlers()\` and wraps itself, so the export bound above
 is wrapped a SECOND time. \`tsc\` catches it (\`TS2345 "BoundEntrypointHandler<…> is not
@@ -1430,7 +1542,7 @@ function\`:
 
     // WRONG — sources/worker/src/jobs/report-build.ts
     const worker = handlers<Context>()
-    export const handleReportBuildJob = worker.request(protocols.job.reportBuild, async (req, ctx) => { ... })
+    export const handleReportBuildJob = worker.request(jobProtocols.reportBuild, async (req, ctx) => { ... })
 
 It RETURNS its result; throwing a \`ResilientError\` subclass is how a refusal is reported, and the
 class survives the broker.
@@ -1443,7 +1555,7 @@ Two rules with no equivalent on the HTTP side:
   what it created, and say in a comment which of the two this one does.
 
 Enqueue from an endpoint with the same typed call used for HTTP:
-\`context.entrypoint(appEntrypoints.job.<name>).call({ body: data })\`.
+\`context.entrypoint(jobProtocols.<name>).call({ body: data })\`.
   `),
 
   skill(ViableSkill.TargetAgents, 'LLM agents inside the application', `

package/src/skills/consts.ts

@@ -31,6 +31,11 @@ export enum ViableSkill {
   FormFeedback = 'form-feedback',
   StoreAccess = 'store-access',
   ViewModelNaming = 'viewmodel-naming',
+  /**
+   * The landing gate: a guest starts the key end-user story on the landing page and continues on
+   * its full-scale screen after signing in, with the choices carried over.
+   */
+  LandingGate = 'landing-gate',
 
   ResourceLayer = 'resource-layer',
   ResourceResults = 'resource-results',
@@ -99,6 +104,9 @@ export const SKILL_ORDER: Record<ViableSkill, number> = {
   [ViableSkill.FormFeedback]: 51,
   [ViableSkill.StoreAccess]: 52,
   [ViableSkill.ViewModelNaming]: 55,
+  // After the frontend rules it builds on (entrypoints, nav, shadcn, form feedback, the store), and
+  // before the backend block — it is only ever carried by analysis and frontend personas.
+  [ViableSkill.LandingGate]: 56,
   [ViableSkill.ResourceLayer]: 60,
   [ViableSkill.ResourceResults]: 62,
   [ViableSkill.ResourceMigrations]: 64,

package/src/skills/roles.ts

@@ -111,11 +111,17 @@ and you are told which one with each task.
 
   [ViablePersona.VisualDesigner]: persona(`
 You are a visual ui designer specializing in writing design guidelines and design systems
-for web applications that loves to produce expressive and bright interfaces.
-Unless a specification asks for something else, you default to a modern, expressive language —
-gradients, glass surfaces, layered shadows, restrained motion — while keeping every surface
-plainly readable. What makes a design yours is the values you choose, never the techniques you
-leave out.
+for web applications, and your interfaces are calm, precise and unmistakably the product's own.
+Your house style: a white ground in light mode and a black one in dark mode; colour from ONE
+product accent and never from backgrounds; depth only from hairlines, neutral tiles and a single
+floating shadow; a heavy grotesk display face with tight tracking and generous whitespace carrying
+the brand; motion that is small and belongs to the picture. You never reach for gradients, glass,
+blur or glow, and the older decoration classes a project still defines are painted flat and are
+never your tools. You change any of this only when the customer's specification explicitly asks —
+it names a background colour, a dark-only or coloured theme, a brand palette, or gradients. The
+product's subject matter is not such a request: a bakery is not a warm background, a bank is not a
+blue one. What makes a design this product's is its accent, its type and its illustration — never
+an added effect.
 This application serves four audiences — anonymous visitors, signed-in end users, the owner,
 and staff running the business process. Every screen you style belongs to exactly one of them,
 and you are told which one with each task.

package/src/types.ts

@@ -33,6 +33,17 @@ export interface SlotConstMetadata {
   brandingPrivacyUrl: string
   brandingCredit: string
   brandingHideCreditIntent: string
+  /**
+   * The Google tag the owner attached — a `GTM-` container or a `G-`/`GT-`/`AW-`/`DC-` tag id —
+   * loaded by the generated application behind its cookie consent, in the preview and in
+   * production alike.
+   *
+   * OPTIONAL, unlike the branding keys above, and OMITTED from a push while it is unset: a slot
+   * publisher built before the key existed validates the signed body against a schema that does
+   * not declare it, strips it, and refuses the whole configuration with a 401. An unset tag must
+   * therefore never reach one — which only absence guarantees.
+   */
+  brandingGoogleTag?: string
 }
 
 export interface SlotSecretMetadata {
@@ -82,6 +93,25 @@ export interface SlotListMetadata {
    * hosts are always accepted and are never in this list.
    */
   allowedOrigins: string[]
+  /**
+   * Extra Content-Security-Policy source expressions the slot's runtime adds to what it serves —
+   * a third party a generated app legitimately needs that the platform does not already know about.
+   *
+   * OPTIONAL and omitted from a push while empty, for the reason `brandingGoogleTag` is: an older
+   * publisher refuses a signed body carrying a key its schema does not declare, and a slot
+   * provisioned before the key existed simply has no value for it. The runtime reads it
+   * defensively and filters every source before it reaches a header.
+   *
+   * The Google tag's hosts are NOT carried here: the publisher derives them itself from
+   * `brandingGoogleTag` (and, for a production build, from the record the build writes), so the
+   * tag and the hosts it needs cannot disagree. Nothing writes this key today; it is declared so the
+   * publisher's existing reader has a vocabulary entry and a schema slot.
+   *
+   * Deliberately NOT in `metadataLists`. That array enumerates the lists an OWNER stores — one
+   * `project-config` row each, loaded on every metadata read and pushed back verbatim — and no
+   * owner-facing setting stores this one.
+   */
+  cspSources?: string[]
 }
 
 export interface CustomSecretMetadata {

package/tests/blueprint.spec.ts

@@ -0,0 +1,98 @@
+import { describe, expect, test } from 'bun:test'
+import {
+  applyBlueprintCase, BLUEPRINT_CASES, BlueprintCase, landingGatePreferenceOf, LandingGatePreference,
+  personaSkillsOf,
+} from '../src/blueprint/index.js'
+import type { Blueprint } from '../src/blueprint/index.js'
+import { ViableSkill } from '../src/skills/consts.js'
+import { ViablePersona } from '../src/skills/roles.js'
+
+/** Just enough of a blueprint for a case to be applied to — the shape a test builds. */
+const base = (extra: Partial<Blueprint> = {}): Blueprint => ({
+  id: 'test-blueprint',
+  title: 'Test',
+  technology: { id: 'ts', language: 'typescript', runtime: 'bun', extensions: ['.ts'], buildScripts: {}, packageManager: 'bun' },
+  stack: { id: 'owlmeans', framework: 'owlmeans', topology: {} as Blueprint['stack']['topology'], skills: [ViableSkill.TsStyle] },
+  template: { id: 'seed', overlay: 'seed', patches: [] },
+  createApp: { id: 'create-app', package: '@owlmeans/create-app', bare: true, template: 'bare' },
+  packages: {
+    id: 'packages',
+    capabilities: { postgres: true, kv: false, queue: false, worker: false, agents: false, validation: true },
+    libraries: {},
+    skills: [ViableSkill.ShadcnUi],
+    personaSkills: { [ViablePersona.BusinessAnalyst]: [ViableSkill.MainFlowFocus] },
+  },
+  ...extra,
+})
+
+describe('viable-common - the landing-gate preference', () => {
+  test('answers Allow for no blueprint, no layer and a value this deploy never heard of', () => {
+    expect(landingGatePreferenceOf()).toBe(LandingGatePreference.Allow)
+    expect(landingGatePreferenceOf(base())).toBe(LandingGatePreference.Allow)
+    expect(landingGatePreferenceOf({ experience: { landingGate: 'insist' as never } }))
+      .toBe(LandingGatePreference.Allow)
+    expect(landingGatePreferenceOf({ experience: { landingGate: LandingGatePreference.Discourage } }))
+      .toBe(LandingGatePreference.Discourage)
+  })
+
+  test('each case weighs the gate: web and the AI kinds encourage, scalable allows, a game discourages', () => {
+    const preferences = Object.fromEntries(Object.values(BlueprintCase).map(id =>
+      [id, landingGatePreferenceOf(applyBlueprintCase(base(), id))]))
+
+    expect(preferences).toEqual({
+      [BlueprintCase.Web]: LandingGatePreference.Encourage,
+      [BlueprintCase.Scalable]: LandingGatePreference.Allow,
+      [BlueprintCase.AiPipeline]: LandingGatePreference.Encourage,
+      [BlueprintCase.AiAgent]: LandingGatePreference.Encourage,
+      [BlueprintCase.Game]: LandingGatePreference.Discourage,
+    })
+  })
+
+  test('a case overrides the base layer key by key, and no case leaves a blueprint without one', () => {
+    const allowing = base({ experience: { landingGate: LandingGatePreference.Allow } })
+
+    expect(landingGatePreferenceOf(applyBlueprintCase(allowing, BlueprintCase.Game)))
+      .toBe(LandingGatePreference.Discourage)
+    expect(applyBlueprintCase(base(), undefined).experience).toBeUndefined()
+    expect(Object.isFrozen(applyBlueprintCase(base(), BlueprintCase.Web).experience)).toBe(true)
+  })
+})
+
+describe('viable-common - the landing-gate skill in the cases', () => {
+  const gatePersonas = [
+    ViablePersona.BusinessAnalyst, ViablePersona.UxDesigner, ViablePersona.LayoutArchitect,
+    ViablePersona.ComponentArchitect, ViablePersona.UiViewCoder, ViablePersona.UiNavCoder,
+  ]
+
+  test('reaches the analyst and the frontend personas of every encouraging case, and nobody else', () => {
+    for (const id of [BlueprintCase.Web, BlueprintCase.AiPipeline, BlueprintCase.AiAgent]) {
+      const cased = applyBlueprintCase(base(), id)
+      for (const persona of gatePersonas) {
+        expect(personaSkillsOf(cased, persona), `${id} → ${persona}`).toContain(ViableSkill.LandingGate)
+      }
+      expect(personaSkillsOf(cased, ViablePersona.ApiCoder)).not.toContain(ViableSkill.LandingGate)
+    }
+    for (const id of [BlueprintCase.Scalable, BlueprintCase.Game]) {
+      const cased = applyBlueprintCase(base(), id)
+      for (const persona of gatePersonas) {
+        expect(personaSkillsOf(cased, persona), `${id} → ${persona}`).not.toContain(ViableSkill.LandingGate)
+      }
+    }
+  })
+
+  test('is merged with what a case and the base already give a persona, never in place of it', () => {
+    const agent = applyBlueprintCase(base(), BlueprintCase.AiAgent)
+
+    expect(personaSkillsOf(agent, ViablePersona.BusinessAnalyst)).toEqual([
+      ViableSkill.MainFlowFocus, ViableSkill.AgenticChoice, ViableSkill.LandingGate,
+    ])
+    expect(personaSkillsOf(agent, ViablePersona.UxDesigner))
+      .toEqual([ViableSkill.AgenticChoice, ViableSkill.LandingGate])
+    expect(personaSkillsOf(agent, ViablePersona.WorkerCoder)).toEqual([
+      ViableSkill.AgenticChoice, ViableSkill.TargetLlm, ViableSkill.LibrariesAi,
+      ViableSkill.TargetAgentTools,
+    ])
+    expect(BLUEPRINT_CASES[BlueprintCase.AiPipeline].patch.packages?.personaSkills?.[ViablePersona.BusinessAnalyst])
+      .toEqual([ViableSkill.AgenticChoice, ViableSkill.LandingGate])
+  })
+})

package/tests/branding.spec.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'bun:test'
 
-import { brandingEnv } from '../src/branding.js'
+import { BRANDING_ENV_KEYS, brandingEnv } from '../src/branding.js'
+import { metadataConfigs, metadataLists } from '../src/consts.js'
 
 /**
  * `BRANDING_CREDIT` is the one key whose ABSENCE means something different from an explicit
@@ -32,6 +33,25 @@ describe('brandingEnv', () => {
       BRANDING_PRIVACY_URL: '',
       BRANDING_CREDIT: '1',
       BRANDING_PRODUCT: 'Acme CRM',
+      BRANDING_GOOGLE_TAG: '',
     })
   })
+
+  it('carries the Google tag, and emits it empty when none is set', () => {
+    // The METADATA key is omitted from a push while unset (an older publisher refuses it); the
+    // ENVIRONMENT key is always there, and '' is what tells the build to load no tag.
+    expect(brandingEnv({ brandingGoogleTag: 'G-ABC123XYZ' }).BRANDING_GOOGLE_TAG).toBe('G-ABC123XYZ')
+    expect(brandingEnv({}).BRANDING_GOOGLE_TAG).toBe('')
+  })
+
+  it('emits exactly the keys BRANDING_ENV_KEYS names', () => {
+    expect(Object.keys(brandingEnv({})).sort()).toEqual([...BRANDING_ENV_KEYS].sort())
+  })
+})
+
+describe('the metadata vocabulary', () => {
+  it('delivers the Google tag as a config key, and keeps the derived CSP list out of the stored lists', () => {
+    expect(metadataConfigs).toContain('brandingGoogleTag')
+    expect(metadataLists as string[]).not.toContain('cspSources')
+  })
 })

package/tests/connect-convert.spec.ts

@@ -3,7 +3,7 @@ import Ajv from 'ajv'
 import addFormats from 'ajv-formats'
 import { RouteMethod, route } from '@owlmeans/route'
 import { aliasOf, openProtocol, protocols } from '@owlmeans/entrypoint'
-import { connect, ConnectInquiryKind, ConnectJobKind, ConnectOpKind } from '../src/connect/consts.js'
+import { connect, ConnectInquiryKind, ConnectOpKind } from '../src/connect/consts.js'
 import { connectProtocols } from '../src/connect/entrypoints.js'
 import { connectRef } from '../src/connect/references.js'
 import {
@@ -151,12 +151,6 @@ describe('viable-common - the conversion additions to the connector contract', (
     // while the two enums stay byte-identical — `manager-api` does not depend on the model
     // runtime, so nothing else in the stack would notice one of them gaining a fourth shape.
     expect(Object.values(ConnectInquiryKind)).toEqual(Object.values(InquiryKind))
-    // One job kind per stage: each stage is its own pipeline run, looked up by the alias its kind
-    // names, so a single `convert` kind would match whichever run row happened to be newest.
-    expect(ConnectJobKind.ConvertIntake).toBe('convert-intake')
-    expect(ConnectJobKind.ConvertAnalysis).toBe('convert-analysis')
-    expect(ConnectJobKind.ConvertExtraction).toBe('convert-extraction')
-    expect(ConnectJobKind.ConvertImplementation).toBe('convert-implementation')
-    expect(ConnectJobKind.ConvertPurge).toBe('convert-purge')
+    expect(connect.convert.status).toBe('viable:manager-api:connect:convert:status')
   })
 })

package/tests/connect-entrypoints.spec.ts

@@ -1,10 +1,11 @@
 import { describe, expect, test } from 'bun:test'
-import { openProtocol, protocols } from '@owlmeans/entrypoint'
+import Ajv from 'ajv'
+import { aliasOf, openProtocol, protocols } from '@owlmeans/entrypoint'
 import { DEFAULT_GUARD } from '@owlmeans/auth-common'
-import { route } from '@owlmeans/route'
-import { connect, ConnectJobKind } from '../src/connect/consts.js'
+import { route, RouteMethod } from '@owlmeans/route'
+import { connect, CONNECT_BRANDING_GOOGLE_TAG_MAX } from '../src/connect/consts.js'
+import { ConnectProjectBrandingSaveSchema } from '../src/connect/schemas.js'
 import { connectProtocols } from '../src/connect/entrypoints.js'
-import { JOB_SEPARATOR, jobIdOf, parseJobId } from '../src/connect/jobs.js'
 import { connectRef } from '../src/connect/references.js'
 
 describe('@owlmeans/viable-common — connector protocol tree', () => {
@@ -18,40 +19,60 @@ describe('@owlmeans/viable-common — connector protocol tree', () => {
     expect(tree.session.open.alias).toBe(connect.session.open)
     expect(tree.project.llm.alias).toBe(connect.project.llm)
     expect(tree.project.converterLlm.alias).toBe(connect.project.converterLlm)
+    expect(tree.story.status.alias).toBe(connect.story.status)
     expect(tree.convert.proceed.alias).toBe(connect.convert.proceed)
     expect(tree.inquiry.answer.alias).toBe(connect.inquiry.answer)
     expect(tree.files.list.alias).toBe(connect.files.list)
-    expect(protocols(tree)).toHaveLength(32)
-    expect(new Set(protocols(tree).map(protocol => protocol.alias)).size).toBe(32)
+    expect(protocols(tree)).toHaveLength(34)
+    expect(new Set(protocols(tree).map(protocol => protocol.alias)).size).toBe(34)
   })
 
-  test('carries no story routes: stories are planning cards served by the planning tree', () => {
-    expect((tree as Record<string, unknown>).story).toBeUndefined()
-    expect((connect as Record<string, unknown>).story).toBeUndefined()
-    expect((connectRef as unknown as Record<string, unknown>).story).toBeUndefined()
-    expect(protocols(tree).some(protocol => protocol.alias.includes(':story:'))).toBe(false)
+  test('reads and saves a project\'s branding at one path, under the owned base and no paid gate', () => {
+    const paid = connectProtocols({
+      guard: DEFAULT_GUARD,
+      gate: { alias: 'test-gate', params: ['owner'] },
+      localLlm: { alias: 'test-paid-llm', params: ['cap'] },
+      updateBase: openProtocol(route('manager:update', '/update')),
+    })
+    const get = paid.project.branding.get
+    const save = paid.project.branding.save
+
+    expect(get.alias).toBe(connect.project.branding.get)
+    expect(save.alias).toBe(connect.project.branding.save)
+    expect(get.route.route.path).toBe('/project/:id/branding')
+    expect(save.route.route.path).toBe('/project/:id/branding')
+    expect(get.route.route.method).toBe(RouteMethod.GET)
+    expect(save.route.route.method).toBe(RouteMethod.POST)
+    expect(aliasOf(get.route.route.parent)).toBe(connect.base)
+    expect(aliasOf(save.route.route.parent)).toBe(connect.base)
+    // The paid local-LLM gate sits on its own two routes; branding carries no gate of its own and
+    // inherits only the base's guard and ownership gate.
+    expect(paid.project.llm.gate?.alias).toBe('test-paid-llm')
+    expect(get.gate).toBeUndefined()
+    expect(save.gate).toBeUndefined()
+    expect(connectRef.project.branding.save.alias).toBe(connect.project.branding.save)
+    expect(connectRef.project.branding.get.alias).toBe(connect.project.branding.get)
   })
-})
 
-describe('@owlmeans/viable-common — connector job ids', () => {
-  test('a story job id names the card and splits back into its parts', () => {
-    const id = jobIdOf(ConnectJobKind.StoryDevelop, 'project-card', 'story-card')
+  test('the branding save body is a patch of strings that can never carry the credit', () => {
+    const validate = new Ajv({ strict: false }).compile(ConnectProjectBrandingSaveSchema)
 
-    expect(id).toBe(['story-develop', 'project-card', 'story-card'].join(JOB_SEPARATOR))
-    expect(parseJobId(id)).toEqual({
-      kind: ConnectJobKind.StoryDevelop, projectId: 'project-card', suffix: 'story-card',
-    })
+    expect(validate({})).toBe(true)
+    expect(validate({ googleTag: 'GTM-ABCD123', termsUrl: '/terms', privacyUrl: '' })).toBe(true)
+    expect(validate({ copyright: '' })).toBe(false)
+    expect(validate({ hideCredit: true })).toBe(false)
+    expect(validate({ googleTag: 'G-'.padEnd(CONNECT_BRANDING_GOOGLE_TAG_MAX + 1, 'X') })).toBe(false)
   })
 
-  test('a job with no subject carries no suffix', () => {
-    expect(parseJobId(jobIdOf(ConnectJobKind.ProjectInit, 'p1'))).toEqual({
-      kind: ConnectJobKind.ProjectInit, projectId: 'p1',
-    })
+  test('keeps story mutations in planning and exposes only the composed story status', () => {
+    expect(Object.keys(tree.story)).toEqual(['status'])
+    expect(Object.keys(connect.story)).toEqual(['status'])
+    expect(Object.keys(connectRef.story)).toEqual(['status'])
+    expect(tree.story.status.route.route.path).toBe('/project/:id/story/:storyId/status')
   })
-
-  test('a suffix that contains the separator is rejoined, never truncated', () => {
-    const suffix = `run${JOB_SEPARATOR}tail`
-
-    expect(parseJobId(jobIdOf(ConnectJobKind.PipelineResume, 'p1', suffix)).suffix).toBe(suffix)
+  test('has no generic connector job endpoint', () => {
+    expect((tree.project as Record<string, unknown>).job).toBeUndefined()
+    expect((connect.project as Record<string, unknown>).job).toBeUndefined()
+    expect((connectRef.project as Record<string, unknown>).job).toBeUndefined()
   })
 })