@promptframe/contracts 0.1.11 → 0.1.14

package/README.md

@@ -10,6 +10,8 @@ Key public exports:
 - `authoringStandardFreshnessDecisionSchema`: shared shape for local tooling and platform admission to explain whether an authoring package is current, warning-only, upload-blocking, or security-breaking.
 - `authoringUploadTargetSchema`: public upload lanes for `marketplace_authoring` and `project_private_generation`.
 - `componentReusabilityScoreSchema`: shared shape for deterministic component reuse diagnostics emitted by local CLI checks and platform admission.
+- `componentPublicResourceManifestSchema` and `componentRuntimeResourceManifestSchema`: public `public/` resource manifest and runtime URL shapes for component-bundled images, audio, video, fonts, JSON, and text.
+- `PROMPTFRAME_PUBLIC_RESOURCE_POLICY`: conservative path/type/size/SVG policy used by authoring tools before platform admission.
 - `PROMPTFRAME_PUBLIC_SECURITY_POLICY_DIGEST`: deterministic release-cohort fingerprint for the public security policy.
 - `@promptframe/contracts/security-evaluator`: AST-aware evaluator for JS / TS / TSX source diagnostics.
 

package/dist/index.d.ts

@@ -13,6 +13,47 @@ export declare const PROMPTFRAME_STYLE_CONTRACT_VERSION: "promptframe-style.v0.1
 export declare const AUTHORING_STANDARD_RELEASE_VERSION: "authoring-standard-release.v0.1.0";
 export declare const COMPONENT_REUSABILITY_CONTRACT_VERSION: "component-reusability.v0.1.0";
 export declare const COMPONENT_DEPENDENCY_POLICY_VERSION: "component-dependency-policy.v0.1.0";
+export declare const COMPONENT_PUBLIC_RESOURCES_CONTRACT_VERSION: "component-public-resources.v0.1.0";
+export declare const COMPONENT_PUBLIC_RESOURCE_POLICY_VERSION: "component-public-resource-policy.v0.1.0";
+export declare const PROMPTFRAME_PUBLIC_RESOURCE_LIMITS: {
+    readonly maxFiles: 64;
+    readonly maxFileBytes: number;
+    readonly maxTotalBytes: number;
+};
+export declare const PROMPTFRAME_PUBLIC_RESOURCE_ALLOWED_EXTENSIONS: {
+    readonly image: readonly [".png", ".jpg", ".jpeg", ".webp", ".gif", ".svg"];
+    readonly audio: readonly [".mp3", ".wav", ".m4a", ".ogg"];
+    readonly video: readonly [".mp4", ".webm"];
+    readonly font: readonly [".woff", ".woff2"];
+    readonly json: readonly [".json"];
+    readonly text: readonly [".txt", ".csv"];
+};
+export declare const PROMPTFRAME_PUBLIC_RESOURCE_POLICY: {
+    readonly policyVersion: "component-public-resource-policy.v0.1.0";
+    readonly contractVersion: "component-public-resources.v0.1.0";
+    readonly sourceDirectory: "public";
+    readonly limits: {
+        readonly maxFiles: 64;
+        readonly maxFileBytes: number;
+        readonly maxTotalBytes: number;
+    };
+    readonly allowedExtensions: {
+        readonly image: readonly [".png", ".jpg", ".jpeg", ".webp", ".gif", ".svg"];
+        readonly audio: readonly [".mp3", ".wav", ".m4a", ".ogg"];
+        readonly video: readonly [".mp4", ".webm"];
+        readonly font: readonly [".woff", ".woff2"];
+        readonly json: readonly [".json"];
+        readonly text: readonly [".txt", ".csv"];
+    };
+    readonly svgSafety: {
+        readonly mode: "safe_subset";
+        readonly rejectedSignals: readonly ["script", "foreignObject", "event_handler_attribute", "external_href", "javascript_url"];
+    };
+    readonly runtime: {
+        readonly injectedProp: "promptFrameResources";
+        readonly helper: "promptFramePublicResource(resourcesOrProps, publicPath, fallback?)";
+    };
+};
 export declare const PROMPTFRAME_PUBLIC_STANDARD_POLICY: {
     readonly policyVersion: "component-standard-policy.v0.1.0";
     readonly sourceVersion: "component-standard.v0.1.0";
@@ -255,6 +296,129 @@ export declare const PROMPTFRAME_PUBLIC_SECURITY_POLICY: {
         readonly reason: "Third-party components cannot observe host DOM or runtime boundaries.";
         readonly recommendation: "Use explicit props, layout inputs, and deterministic frame data instead of Observer APIs.";
         readonly docsPath: "/docs/component-authoring/security#browser-observer-abuse";
+    }, {
+        readonly id: "browser.image_beacon";
+        readonly label: "Image constructor network beacon";
+        readonly patterns: readonly ["\\bnew\\s+(?:(?:window|globalThis)\\.)?Image\\s*\\(|\\b(?:window|globalThis)\\.Image\\s*\\("];
+        readonly astMatchers: {
+            readonly globals: readonly ["Image"];
+            readonly memberPaths: readonly ["window.Image", "globalThis.Image"];
+        };
+        readonly action: "reject";
+        readonly category: "network_exfiltration";
+        readonly severity: "high";
+        readonly reason: "Third-party components cannot create browser Image beacons that can send unmediated network requests.";
+        readonly recommendation: "Use Remotion <Img> with platform-provided asset props or PromptFrame public resources; do not construct browser Image objects.";
+        readonly docsPath: "/docs/component-authoring/security#browser-image-beacon";
+    }, {
+        readonly id: "browser.audio_beacon";
+        readonly label: "Audio constructor network beacon";
+        readonly patterns: readonly ["\\bnew\\s+(?:(?:window|globalThis)\\.)?Audio\\s*\\(|\\b(?:window|globalThis)\\.Audio\\s*\\("];
+        readonly astMatchers: {
+            readonly globals: readonly ["Audio"];
+            readonly memberPaths: readonly ["window.Audio", "globalThis.Audio"];
+        };
+        readonly action: "reject";
+        readonly category: "network_exfiltration";
+        readonly severity: "high";
+        readonly reason: "Third-party components cannot create browser Audio objects that can fetch remote media outside the platform asset boundary.";
+        readonly recommendation: "Use platform-provided audio assets and Remotion audio primitives rather than browser Audio constructors.";
+        readonly docsPath: "/docs/component-authoring/security#browser-audio-beacon";
+    }, {
+        readonly id: "browser.worker_context";
+        readonly label: "Worker / SharedWorker execution context";
+        readonly patterns: readonly ["\\bnew\\s+(?:Worker|SharedWorker)\\b|\\b(?:Worker|SharedWorker)\\s*\\("];
+        readonly astMatchers: {
+            readonly globals: readonly ["Worker", "SharedWorker"];
+            readonly memberPaths: readonly ["window.Worker", "window.SharedWorker", "globalThis.Worker", "globalThis.SharedWorker"];
+        };
+        readonly action: "reject";
+        readonly category: "browser_capability";
+        readonly severity: "high";
+        readonly reason: "Third-party components cannot create background execution contexts outside the render sandbox.";
+        readonly recommendation: "Keep component work synchronous, bounded, and frame-driven; move heavy preparation into platform-controlled build/admission steps.";
+        readonly docsPath: "/docs/component-authoring/security#browser-worker-context";
+    }, {
+        readonly id: "browser.window_open";
+        readonly label: "window.open new browsing context";
+        readonly patterns: readonly ["(?:window|globalThis)\\.open\\s*\\(|\\bopen\\s*\\("];
+        readonly astMatchers: {
+            readonly globals: readonly ["open"];
+            readonly memberPaths: readonly ["window.open", "globalThis.open"];
+        };
+        readonly action: "reject";
+        readonly category: "browser_capability";
+        readonly severity: "high";
+        readonly reason: "Third-party components cannot open new windows or tabs from preview/render code.";
+        readonly recommendation: "Remove window.open calls and express outbound links as platform-reviewed metadata outside component execution.";
+        readonly docsPath: "/docs/component-authoring/security#browser-window-open";
+    }, {
+        readonly id: "browser.cross_context_message";
+        readonly label: "Cross-context postMessage";
+        readonly patterns: readonly ["(?:window|globalThis|parent|top|opener)\\.postMessage\\s*\\(|\\bpostMessage\\s*\\("];
+        readonly astMatchers: {
+            readonly globals: readonly ["postMessage"];
+            readonly memberPaths: readonly ["window.postMessage", "globalThis.postMessage", "parent.postMessage", "top.postMessage", "opener.postMessage"];
+        };
+        readonly action: "reject";
+        readonly category: "browser_capability";
+        readonly severity: "high";
+        readonly reason: "Third-party components cannot send messages to parent, opener, top, or other browser contexts.";
+        readonly recommendation: "Use explicit component props and platform-owned events instead of postMessage from component code.";
+        readonly docsPath: "/docs/component-authoring/security#browser-cross-context-message";
+    }, {
+        readonly id: "browser.dynamic_script";
+        readonly label: "Dynamic script element creation";
+        readonly patterns: readonly ["document\\.createElement\\s*\\(\\s*['\"`]script['\"`]"];
+        readonly astMatchers: {
+            readonly documentCreateElementTags: readonly ["script"];
+        };
+        readonly action: "reject";
+        readonly category: "dynamic_code_execution";
+        readonly severity: "high";
+        readonly reason: "Third-party components cannot create script elements at preview or render time.";
+        readonly recommendation: "Use static imports that pass the public authoring build and security checks.";
+        readonly docsPath: "/docs/component-authoring/security#browser-dynamic-script";
+    }, {
+        readonly id: "browser.iframe_escape";
+        readonly label: "iframe boundary escape";
+        readonly patterns: readonly ["<iframe\\b|document\\.createElement\\s*\\(\\s*['\"`]iframe['\"`]"];
+        readonly astMatchers: {
+            readonly documentCreateElementTags: readonly ["iframe"];
+            readonly jsxElements: readonly ["iframe"];
+        };
+        readonly action: "reject";
+        readonly category: "browser_capability";
+        readonly severity: "high";
+        readonly reason: "Third-party components cannot create nested iframe boundaries inside the platform preview/render sandbox.";
+        readonly recommendation: "Render ordinary React/Remotion content and use platform-reviewed embeds outside component code.";
+        readonly docsPath: "/docs/component-authoring/security#browser-iframe-escape";
+    }, {
+        readonly id: "browser.fingerprint";
+        readonly label: "Browser fingerprinting surface";
+        readonly patterns: readonly ["navigator\\.(?:userAgent|language|languages|hardwareConcurrency|deviceMemory)|window\\.(?:innerWidth|innerHeight)|screen\\.(?:width|height)"];
+        readonly astMatchers: {
+            readonly memberPaths: readonly ["navigator.userAgent", "navigator.language", "navigator.languages", "navigator.hardwareConcurrency", "navigator.deviceMemory", "window.innerWidth", "window.innerHeight", "globalThis.innerWidth", "globalThis.innerHeight", "screen.width", "screen.height"];
+        };
+        readonly action: "reject";
+        readonly category: "privacy_fingerprinting";
+        readonly severity: "high";
+        readonly reason: "Third-party components cannot read browser fingerprinting or viewport surfaces for profiling or exfiltration.";
+        readonly recommendation: "Use explicit props, Remotion video config, or platform-provided layout inputs instead of browser environment fingerprints.";
+        readonly docsPath: "/docs/component-authoring/security#browser-fingerprint";
+    }, {
+        readonly id: "storage.browser_storage";
+        readonly label: "Browser storage or cookie access";
+        readonly patterns: readonly ["document\\.cookie|localStorage|sessionStorage"];
+        readonly astMatchers: {
+            readonly memberPaths: readonly ["document.cookie", "localStorage", "sessionStorage", "window.localStorage", "window.sessionStorage", "globalThis.localStorage", "globalThis.sessionStorage"];
+        };
+        readonly action: "reject";
+        readonly category: "unsafe_browser_storage";
+        readonly severity: "high";
+        readonly reason: "Marketplace components must not read cookies, localStorage, or sessionStorage from the user browser.";
+        readonly recommendation: "Use platform-provided props for state and never read browser storage from component code.";
+        readonly docsPath: "/docs/component-authoring/security#storage-browser-storage";
     }, {
         readonly id: "remotion.delay_render";
         readonly label: "Remotion delayRender lifecycle control";
@@ -296,11 +460,16 @@ export declare const PROMPTFRAME_PUBLIC_SECURITY_POLICY: {
         readonly id: "dom.dangerous_html";
         readonly label: "Dangerous HTML injection";
         readonly patterns: readonly ["dangerouslySetInnerHTML|\\.innerHTML\\s*="];
+        readonly astMatchers: {
+            readonly jsxAttributes: readonly ["dangerouslySetInnerHTML"];
+            readonly memberPathSuffixes: readonly ["innerHTML"];
+        };
         readonly action: "manual_review";
         readonly category: "dangerous_html_injection";
         readonly severity: "high";
         readonly reason: "HTML injection can bypass component rendering boundaries.";
         readonly recommendation: "Render React nodes or sanitized text structures.";
+        readonly docsPath: "/docs/component-authoring/security#dom-dangerous-html";
     }, {
         readonly id: "package.install_script";
         readonly label: "Install script signal";
@@ -337,15 +506,6 @@ export declare const PROMPTFRAME_PUBLIC_SECURITY_POLICY: {
         readonly severity: "medium";
         readonly reason: "Source comments and strings cannot ask the platform to change rules, ranking, or admission.";
         readonly recommendation: "Remove prompt-injection-like strings.";
-    }, {
-        readonly id: "storage.browser_storage";
-        readonly label: "Browser storage access";
-        readonly patterns: readonly ["document\\.cookie|localStorage|sessionStorage"];
-        readonly action: "warn";
-        readonly category: "unsafe_browser_storage";
-        readonly severity: "medium";
-        readonly reason: "Marketplace components must not read user browser storage.";
-        readonly recommendation: "Use platform-provided props for state.";
     }, {
         readonly id: "network.remote_url";
         readonly label: "Hardcoded remote URL";
@@ -424,6 +584,186 @@ export declare const semverSchema: z.ZodString;
 export declare const componentIdSchema: z.ZodString;
 export declare const componentNameSchema: z.ZodString;
 export declare const relativePathSchema: z.ZodString;
+export declare const componentPublicResourceKindSchema: z.ZodEnum<["image", "audio", "video", "font", "json", "text"]>;
+export type ComponentPublicResourceKind = z.infer<typeof componentPublicResourceKindSchema>;
+export declare const componentPublicResourcePublicPathSchema: z.ZodEffects<z.ZodString, string, string>;
+export declare const componentPublicResourceSourcePathSchema: z.ZodEffects<z.ZodString, string, string>;
+export declare const componentPublicResourceArtifactPathSchema: z.ZodEffects<z.ZodString, string, string>;
+export declare const componentPublicResourceEntrySchema: z.ZodObject<{
+    publicPath: z.ZodEffects<z.ZodString, string, string>;
+    sourcePath: z.ZodEffects<z.ZodString, string, string>;
+    artifactPath: z.ZodEffects<z.ZodString, string, string>;
+    kind: z.ZodEnum<["image", "audio", "video", "font", "json", "text"]>;
+    contentType: z.ZodString;
+    sizeBytes: z.ZodNumber;
+    sha256: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    publicPath: string;
+    sourcePath: string;
+    artifactPath: string;
+    kind: "image" | "audio" | "video" | "font" | "json" | "text";
+    contentType: string;
+    sizeBytes: number;
+    sha256: string;
+}, {
+    publicPath: string;
+    sourcePath: string;
+    artifactPath: string;
+    kind: "image" | "audio" | "video" | "font" | "json" | "text";
+    contentType: string;
+    sizeBytes: number;
+    sha256: string;
+}>;
+export type ComponentPublicResourceEntry = z.infer<typeof componentPublicResourceEntrySchema>;
+export declare const componentPublicResourceManifestSchema: z.ZodObject<{
+    contractVersion: z.ZodLiteral<"component-public-resources.v0.1.0">;
+    basePath: z.ZodDefault<z.ZodLiteral<"/">>;
+    entries: z.ZodArray<z.ZodObject<{
+        publicPath: z.ZodEffects<z.ZodString, string, string>;
+        sourcePath: z.ZodEffects<z.ZodString, string, string>;
+        artifactPath: z.ZodEffects<z.ZodString, string, string>;
+        kind: z.ZodEnum<["image", "audio", "video", "font", "json", "text"]>;
+        contentType: z.ZodString;
+        sizeBytes: z.ZodNumber;
+        sha256: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        publicPath: string;
+        sourcePath: string;
+        artifactPath: string;
+        kind: "image" | "audio" | "video" | "font" | "json" | "text";
+        contentType: string;
+        sizeBytes: number;
+        sha256: string;
+    }, {
+        publicPath: string;
+        sourcePath: string;
+        artifactPath: string;
+        kind: "image" | "audio" | "video" | "font" | "json" | "text";
+        contentType: string;
+        sizeBytes: number;
+        sha256: string;
+    }>, "many">;
+    totalBytes: z.ZodNumber;
+    generatedAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    entries: {
+        publicPath: string;
+        sourcePath: string;
+        artifactPath: string;
+        kind: "image" | "audio" | "video" | "font" | "json" | "text";
+        contentType: string;
+        sizeBytes: number;
+        sha256: string;
+    }[];
+    contractVersion: "component-public-resources.v0.1.0";
+    basePath: "/";
+    totalBytes: number;
+    generatedAt: string;
+}, {
+    entries: {
+        publicPath: string;
+        sourcePath: string;
+        artifactPath: string;
+        kind: "image" | "audio" | "video" | "font" | "json" | "text";
+        contentType: string;
+        sizeBytes: number;
+        sha256: string;
+    }[];
+    contractVersion: "component-public-resources.v0.1.0";
+    totalBytes: number;
+    generatedAt: string;
+    basePath?: "/" | undefined;
+}>;
+export type ComponentPublicResourceManifest = z.infer<typeof componentPublicResourceManifestSchema>;
+export declare const componentRuntimeResourceEntrySchema: z.ZodObject<{
+    publicPath: z.ZodEffects<z.ZodString, string, string>;
+    sourcePath: z.ZodEffects<z.ZodString, string, string>;
+    artifactPath: z.ZodEffects<z.ZodString, string, string>;
+    kind: z.ZodEnum<["image", "audio", "video", "font", "json", "text"]>;
+    contentType: z.ZodString;
+    sizeBytes: z.ZodNumber;
+    sha256: z.ZodString;
+} & {
+    url: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    publicPath: string;
+    sourcePath: string;
+    artifactPath: string;
+    kind: "image" | "audio" | "video" | "font" | "json" | "text";
+    contentType: string;
+    sizeBytes: number;
+    sha256: string;
+    url: string;
+}, {
+    publicPath: string;
+    sourcePath: string;
+    artifactPath: string;
+    kind: "image" | "audio" | "video" | "font" | "json" | "text";
+    contentType: string;
+    sizeBytes: number;
+    sha256: string;
+    url: string;
+}>;
+export declare const componentRuntimeResourceManifestSchema: z.ZodObject<{
+    contractVersion: z.ZodLiteral<"component-public-resources.v0.1.0">;
+    baseUrl: z.ZodOptional<z.ZodString>;
+    entries: z.ZodArray<z.ZodObject<{
+        publicPath: z.ZodEffects<z.ZodString, string, string>;
+        sourcePath: z.ZodEffects<z.ZodString, string, string>;
+        artifactPath: z.ZodEffects<z.ZodString, string, string>;
+        kind: z.ZodEnum<["image", "audio", "video", "font", "json", "text"]>;
+        contentType: z.ZodString;
+        sizeBytes: z.ZodNumber;
+        sha256: z.ZodString;
+    } & {
+        url: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        publicPath: string;
+        sourcePath: string;
+        artifactPath: string;
+        kind: "image" | "audio" | "video" | "font" | "json" | "text";
+        contentType: string;
+        sizeBytes: number;
+        sha256: string;
+        url: string;
+    }, {
+        publicPath: string;
+        sourcePath: string;
+        artifactPath: string;
+        kind: "image" | "audio" | "video" | "font" | "json" | "text";
+        contentType: string;
+        sizeBytes: number;
+        sha256: string;
+        url: string;
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    entries: {
+        publicPath: string;
+        sourcePath: string;
+        artifactPath: string;
+        kind: "image" | "audio" | "video" | "font" | "json" | "text";
+        contentType: string;
+        sizeBytes: number;
+        sha256: string;
+        url: string;
+    }[];
+    contractVersion: "component-public-resources.v0.1.0";
+    baseUrl?: string | undefined;
+}, {
+    entries: {
+        publicPath: string;
+        sourcePath: string;
+        artifactPath: string;
+        kind: "image" | "audio" | "video" | "font" | "json" | "text";
+        contentType: string;
+        sizeBytes: number;
+        sha256: string;
+        url: string;
+    }[];
+    contractVersion: "component-public-resources.v0.1.0";
+    baseUrl?: string | undefined;
+}>;
+export type ComponentRuntimeResourceManifest = z.infer<typeof componentRuntimeResourceManifestSchema>;
 export declare const promptFrameComponentTypeSchema: z.ZodEnum<["scene_template", "contained_widget", "overlay", "transition_effect"]>;
 export type PromptFrameComponentType = z.infer<typeof promptFrameComponentTypeSchema>;
 export declare const promptFrameManifestLayerSchema: z.ZodEnum<["foundation", "atom", "motion", "element", "scene_template"]>;
@@ -520,14 +860,14 @@ export declare const authoringUploadTargetPolicySchema: z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     target: "marketplace_authoring" | "project_private_generation";
     description: string;
-    allowedVisibility: ("builtin" | "private" | "project_private" | "team" | "public")[];
+    allowedVisibility: ("public" | "builtin" | "private" | "project_private" | "team")[];
     requiresUploadTrustPipeline: boolean;
     requiresHumanPublishApproval: boolean;
     deterministicGateMode: "fail_closed";
 }, {
     target: "marketplace_authoring" | "project_private_generation";
     description: string;
-    allowedVisibility: ("builtin" | "private" | "project_private" | "team" | "public")[];
+    allowedVisibility: ("public" | "builtin" | "private" | "project_private" | "team")[];
     requiresUploadTrustPipeline?: boolean | undefined;
     requiresHumanPublishApproval?: boolean | undefined;
     deterministicGateMode?: "fail_closed" | undefined;
@@ -604,9 +944,10 @@ export declare const componentReusabilityScoreSchema: z.ZodObject<{
     generatedAt: z.ZodString;
 }, "strict", z.ZodTypeAny, {
     contractVersion: "component-reusability.v0.1.0";
+    generatedAt: string;
     score: number;
     uploadTarget: "marketplace_authoring" | "project_private_generation";
-    targetVisibility: "project_private" | "public" | "user_private" | "team_private";
+    targetVisibility: "public" | "project_private" | "user_private" | "team_private";
     recommendation: "reject" | "manual_review" | "warn" | "allow";
     signals: {
         severity: "error" | "info" | "warning";
@@ -615,11 +956,11 @@ export declare const componentReusabilityScoreSchema: z.ZodObject<{
         weight: number;
         reason: string;
     }[];
-    generatedAt: string;
 }, {
+    generatedAt: string;
     score: number;
     uploadTarget: "marketplace_authoring" | "project_private_generation";
-    targetVisibility: "project_private" | "public" | "user_private" | "team_private";
+    targetVisibility: "public" | "project_private" | "user_private" | "team_private";
     recommendation: "reject" | "manual_review" | "warn" | "allow";
     signals: {
         id: "propsRichness" | "hardcodedContentRisk" | "dataShapeRichness" | "styleConfigurability" | "domainNeutrality" | "emptyStateSupport" | "previewCaseCoverage" | "sourceFactsReuse";
@@ -628,7 +969,6 @@ export declare const componentReusabilityScoreSchema: z.ZodObject<{
         reason: string;
         severity?: "error" | "info" | "warning" | undefined;
     }[];
-    generatedAt: string;
     contractVersion?: "component-reusability.v0.1.0" | undefined;
 }>;
 export type ComponentReusabilityScore = z.infer<typeof componentReusabilityScoreSchema>;
@@ -669,14 +1009,14 @@ export declare const authoringStandardReleaseSchema: z.ZodObject<{
     }, "strict", z.ZodTypeAny, {
         target: "marketplace_authoring" | "project_private_generation";
         description: string;
-        allowedVisibility: ("builtin" | "private" | "project_private" | "team" | "public")[];
+        allowedVisibility: ("public" | "builtin" | "private" | "project_private" | "team")[];
         requiresUploadTrustPipeline: boolean;
         requiresHumanPublishApproval: boolean;
         deterministicGateMode: "fail_closed";
     }, {
         target: "marketplace_authoring" | "project_private_generation";
         description: string;
-        allowedVisibility: ("builtin" | "private" | "project_private" | "team" | "public")[];
+        allowedVisibility: ("public" | "builtin" | "private" | "project_private" | "team")[];
         requiresUploadTrustPipeline?: boolean | undefined;
         requiresHumanPublishApproval?: boolean | undefined;
         deterministicGateMode?: "fail_closed" | undefined;
@@ -701,7 +1041,7 @@ export declare const authoringStandardReleaseSchema: z.ZodObject<{
     uploadTargets: {
         target: "marketplace_authoring" | "project_private_generation";
         description: string;
-        allowedVisibility: ("builtin" | "private" | "project_private" | "team" | "public")[];
+        allowedVisibility: ("public" | "builtin" | "private" | "project_private" | "team")[];
         requiresUploadTrustPipeline: boolean;
         requiresHumanPublishApproval: boolean;
         deterministicGateMode: "fail_closed";
@@ -726,7 +1066,7 @@ export declare const authoringStandardReleaseSchema: z.ZodObject<{
     uploadTargets: {
         target: "marketplace_authoring" | "project_private_generation";
         description: string;
-        allowedVisibility: ("builtin" | "private" | "project_private" | "team" | "public")[];
+        allowedVisibility: ("public" | "builtin" | "private" | "project_private" | "team")[];
         requiresUploadTrustPipeline?: boolean | undefined;
         requiresHumanPublishApproval?: boolean | undefined;
         deterministicGateMode?: "fail_closed" | undefined;
@@ -839,14 +1179,14 @@ export declare const componentRefSchema: z.ZodObject<{
     contractVersion: "component-ref.v0.1.0";
     componentId: string;
     version: string;
-    visibility: "builtin" | "private" | "project_private" | "team" | "public";
+    visibility: "public" | "builtin" | "private" | "project_private" | "team";
     sourceHash: string;
     schemaHash: string;
     bundleHash?: string | undefined;
 }, {
     componentId: string;
     version: string;
-    visibility: "builtin" | "private" | "project_private" | "team" | "public";
+    visibility: "public" | "builtin" | "private" | "project_private" | "team";
     sourceHash: string;
     schemaHash: string;
     contractVersion?: "component-ref.v0.1.0" | undefined;
@@ -977,16 +1317,16 @@ export declare const componentManifestEntrySchema: z.ZodObject<{
     schemaHash: z.ZodString;
     bundleHash: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
+    sourcePath: string;
     sourceHash: string;
     schemaHash: string;
-    sourcePath: string;
     componentExport: string;
     propsSchemaPath: string;
     bundleHash?: string | undefined;
 }, {
+    sourcePath: string;
     sourceHash: string;
     schemaHash: string;
-    sourcePath: string;
     propsSchemaPath: string;
     bundleHash?: string | undefined;
     componentExport?: string | undefined;
@@ -1118,16 +1458,16 @@ export declare const componentManifestSchema: z.ZodEffects<z.ZodObject<{
         schemaHash: z.ZodString;
         bundleHash: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
+        sourcePath: string;
         sourceHash: string;
         schemaHash: string;
-        sourcePath: string;
         componentExport: string;
         propsSchemaPath: string;
         bundleHash?: string | undefined;
     }, {
+        sourcePath: string;
         sourceHash: string;
         schemaHash: string;
-        sourcePath: string;
         propsSchemaPath: string;
         bundleHash?: string | undefined;
         componentExport?: string | undefined;
@@ -1157,9 +1497,9 @@ export declare const componentManifestSchema: z.ZodEffects<z.ZodObject<{
         max: number;
     };
     entry: {
+        sourcePath: string;
         sourceHash: string;
         schemaHash: string;
-        sourcePath: string;
         componentExport: string;
         propsSchemaPath: string;
         bundleHash?: string | undefined;
@@ -1194,7 +1534,7 @@ export declare const componentManifestSchema: z.ZodEffects<z.ZodObject<{
     standardSourceHash?: string | undefined;
     componentType?: "scene_template" | "contained_widget" | "overlay" | "transition_effect" | undefined;
     layer?: "scene_template" | "foundation" | "atom" | "motion" | "element" | undefined;
-    category?: "scene_template" | "motion" | "background" | "text" | "media" | "shape" | "card" | "layout" | "effect" | undefined;
+    category?: "text" | "scene_template" | "motion" | "background" | "media" | "shape" | "card" | "layout" | "effect" | undefined;
     trustLevel?: "trusted_builtin" | "trusted_private" | "trusted_marketplace" | "untrusted_temporary" | undefined;
     reviewStatus?: "draft" | "pending_review" | "approved" | "rejected" | "archived" | undefined;
 }, {
@@ -1215,9 +1555,9 @@ export declare const componentManifestSchema: z.ZodEffects<z.ZodObject<{
         max: number;
     };
     entry: {
+        sourcePath: string;
         sourceHash: string;
         schemaHash: string;
-        sourcePath: string;
         propsSchemaPath: string;
         bundleHash?: string | undefined;
         componentExport?: string | undefined;
@@ -1248,7 +1588,7 @@ export declare const componentManifestSchema: z.ZodEffects<z.ZodObject<{
     standardSourceHash?: string | undefined;
     componentType?: "scene_template" | "contained_widget" | "overlay" | "transition_effect" | undefined;
     layer?: "scene_template" | "foundation" | "atom" | "motion" | "element" | undefined;
-    category?: "scene_template" | "motion" | "background" | "text" | "media" | "shape" | "card" | "layout" | "effect" | undefined;
+    category?: "text" | "scene_template" | "motion" | "background" | "media" | "shape" | "card" | "layout" | "effect" | undefined;
     trustLevel?: "trusted_builtin" | "trusted_private" | "trusted_marketplace" | "untrusted_temporary" | undefined;
     dependencies?: Record<string, string> | undefined;
     peerDependencies?: Record<string, string> | undefined;
@@ -1273,9 +1613,9 @@ export declare const componentManifestSchema: z.ZodEffects<z.ZodObject<{
         max: number;
     };
     entry: {
+        sourcePath: string;
         sourceHash: string;
         schemaHash: string;
-        sourcePath: string;
         componentExport: string;
         propsSchemaPath: string;
         bundleHash?: string | undefined;
@@ -1310,7 +1650,7 @@ export declare const componentManifestSchema: z.ZodEffects<z.ZodObject<{
     standardSourceHash?: string | undefined;
     componentType?: "scene_template" | "contained_widget" | "overlay" | "transition_effect" | undefined;
     layer?: "scene_template" | "foundation" | "atom" | "motion" | "element" | undefined;
-    category?: "scene_template" | "motion" | "background" | "text" | "media" | "shape" | "card" | "layout" | "effect" | undefined;
+    category?: "text" | "scene_template" | "motion" | "background" | "media" | "shape" | "card" | "layout" | "effect" | undefined;
     trustLevel?: "trusted_builtin" | "trusted_private" | "trusted_marketplace" | "untrusted_temporary" | undefined;
     reviewStatus?: "draft" | "pending_review" | "approved" | "rejected" | "archived" | undefined;
 }, {
@@ -1331,9 +1671,9 @@ export declare const componentManifestSchema: z.ZodEffects<z.ZodObject<{
         max: number;
     };
     entry: {
+        sourcePath: string;
         sourceHash: string;
         schemaHash: string;
-        sourcePath: string;
         propsSchemaPath: string;
         bundleHash?: string | undefined;
         componentExport?: string | undefined;
@@ -1364,7 +1704,7 @@ export declare const componentManifestSchema: z.ZodEffects<z.ZodObject<{
     standardSourceHash?: string | undefined;
     componentType?: "scene_template" | "contained_widget" | "overlay" | "transition_effect" | undefined;
     layer?: "scene_template" | "foundation" | "atom" | "motion" | "element" | undefined;
-    category?: "scene_template" | "motion" | "background" | "text" | "media" | "shape" | "card" | "layout" | "effect" | undefined;
+    category?: "text" | "scene_template" | "motion" | "background" | "media" | "shape" | "card" | "layout" | "effect" | undefined;
     trustLevel?: "trusted_builtin" | "trusted_private" | "trusted_marketplace" | "untrusted_temporary" | undefined;
     dependencies?: Record<string, string> | undefined;
     peerDependencies?: Record<string, string> | undefined;
@@ -1387,14 +1727,14 @@ export declare const componentCapabilityCardSchema: z.ZodObject<{
         contractVersion: "component-ref.v0.1.0";
         componentId: string;
         version: string;
-        visibility: "builtin" | "private" | "project_private" | "team" | "public";
+        visibility: "public" | "builtin" | "private" | "project_private" | "team";
         sourceHash: string;
         schemaHash: string;
         bundleHash?: string | undefined;
     }, {
         componentId: string;
         version: string;
-        visibility: "builtin" | "private" | "project_private" | "team" | "public";
+        visibility: "public" | "builtin" | "private" | "project_private" | "team";
         sourceHash: string;
         schemaHash: string;
         contractVersion?: "component-ref.v0.1.0" | undefined;
@@ -1517,7 +1857,7 @@ export declare const componentCapabilityCardSchema: z.ZodObject<{
         contractVersion: "component-ref.v0.1.0";
         componentId: string;
         version: string;
-        visibility: "builtin" | "private" | "project_private" | "team" | "public";
+        visibility: "public" | "builtin" | "private" | "project_private" | "team";
         sourceHash: string;
         schemaHash: string;
         bundleHash?: string | undefined;
@@ -1551,7 +1891,7 @@ export declare const componentCapabilityCardSchema: z.ZodObject<{
     componentRef: {
         componentId: string;
         version: string;
-        visibility: "builtin" | "private" | "project_private" | "team" | "public";
+        visibility: "public" | "builtin" | "private" | "project_private" | "team";
         sourceHash: string;
         schemaHash: string;
         contractVersion?: "component-ref.v0.1.0" | undefined;