@samva/markup 0.1.0 → 0.1.2

package/dist/presets/public-handoff.js

@@ -1,5 +1,7 @@
 import { collectVariableReferences } from "../ast.js";
 import { parseSml } from "../parser.js";
+import { resolveTokenTable } from "../theme.js";
+import { baseTokens } from "../tokens.js";
 import { compileSource } from "../compile.js";
 import { RECOMMENDED_THEME, presetCatalog } from "../presets.js";
 import { publicTemplates, templateCollections } from "./public-gallery.js";
@@ -7,6 +9,18 @@ import { Result } from "effect";
 //#region presets/public-handoff.ts
 const SLUG = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 const ISO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/;
+const MAX_HTTPS_ASSET_LENGTH = 2048;
+const MAX_DATA_IMAGE_ASSET_LENGTH = 32768;
+const DATA_IMAGE = /^data:image\/(?:avif|gif|jpeg|png|svg\+xml|webp)(?:;charset=[a-z0-9-]+)?(?:;base64)?,[^\r\n]+$/i;
+const isTemplateReferenceProvenanceSource = (value) => value === "sanitized-synthetic" || value === "reviewed-public";
+const PUBLIC_TEMPLATE_FONT_TOKENS = new Set(Object.keys(resolveTokenTable({
+	base: baseTokens,
+	overrides: [RECOMMENDED_THEME]
+}).fontFamilies));
+const FONT_WEIGHT_TOKENS = new Set(Object.keys(resolveTokenTable({
+	base: baseTokens,
+	overrides: [RECOMMENDED_THEME]
+}).fontWeights));
 const sortedUnique = (values) => [...new Set(values)].sort();
 const sameStrings = (left, right) => JSON.stringify(sortedUnique(left)) === JSON.stringify(sortedUnique(right));
 const nonEmpty = (value) => value.trim().length > 0;
@@ -16,6 +30,75 @@ const issue = (artifactId, code, message) => ({
 	message
 });
 /**
+* Public imports may only refer to existing font-family tokens. A source may
+* still use the supported `font-*` weight utilities; this check deliberately
+* rejects a new family token instead of creating a corpus font-hosting path.
+*/
+const unsupportedPublicTemplateFontTokens = (source) => {
+	const unsupported = /* @__PURE__ */ new Set();
+	for (const match of source.matchAll(/\bclass\s*=\s*(["'])(.*?)\1/gs)) for (const className of (match[2] ?? "").split(/\s+/)) {
+		if (!className.startsWith("font-")) continue;
+		const token = className.slice(5);
+		if (!PUBLIC_TEMPLATE_FONT_TOKENS.has(token) && !FONT_WEIGHT_TOKENS.has(token)) unsupported.add(token);
+	}
+	return [...unsupported].sort();
+};
+/** Accept only bounded HTTPS URLs or the preview's self-contained image data. */
+const isSafePublicTemplateAsset = (value) => {
+	if (value.startsWith("data:")) return value.length <= MAX_DATA_IMAGE_ASSET_LENGTH && DATA_IMAGE.test(value);
+	const url = URL.parse(value);
+	return value.length <= MAX_HTTPS_ASSET_LENGTH && url?.protocol === "https:" && url.hostname.length > 0 && url.username.length === 0 && url.password.length === 0;
+};
+/** Normalizes one approved handoff for gallery and future agent consumers. */
+const toTemplateReferencePacket = (artifact) => ({
+	version: 1,
+	preset: artifact.preset,
+	gallery: {
+		...artifact.gallery,
+		path: `/templates/${artifact.gallery.slug}`
+	},
+	preview: artifact.preview,
+	publicMetadata: artifact.publicMetadata,
+	...artifact.provenance === void 0 ? {} : { provenance: artifact.provenance }
+});
+const jsonProjection = (kind, value) => ({
+	kind,
+	relativePath: `${kind}.json`,
+	contents: `${JSON.stringify(value, null, 2)}\n`
+});
+/**
+* Emits the five destination projections as deterministic bytes. The importer
+* owns no checked-in destination files; callers choose an explicit output dir.
+*/
+const emitTemplateReferencePacket = (packet) => [
+	{
+		kind: "source",
+		relativePath: "preset.samva",
+		contents: packet.preset.source
+	},
+	jsonProjection("catalog", {
+		id: packet.preset.id,
+		channel: packet.preset.channel,
+		category: packet.preset.category,
+		name: packet.preset.name,
+		description: packet.preset.description,
+		variables: packet.preset.variables
+	}),
+	jsonProjection("gallery", {
+		presetId: packet.preset.id,
+		...packet.gallery,
+		...packet.provenance === void 0 ? {} : { provenance: packet.provenance }
+	}),
+	jsonProjection("preview", packet.preview),
+	jsonProjection("editorial", {
+		cardTitle: packet.publicMetadata.cardTitle,
+		cardDescription: packet.publicMetadata.cardDescription,
+		guidance: packet.publicMetadata.guidance,
+		variables: packet.publicMetadata.variableDescriptions,
+		seo: packet.publicMetadata.seo
+	})
+];
+/**
 * Validates explicitly supplied, owner-approved artifacts without filesystem,
 * network, persistence, or discovery. Successful output is a projection for
 * the existing preset, public-gallery, preview, and editorial contracts; this
@@ -32,6 +115,7 @@ const validatePublicTemplateHandoff = (artifacts) => {
 	for (const artifact of artifacts) {
 		const id = artifact.preset.id;
 		if (artifact.approval.state !== "approved" || !nonEmpty(artifact.approval.approvedBy) || !ISO_TIMESTAMP.test(artifact.approval.approvedAt)) issues.push(issue(id, "approval", "owner approval and an ISO-8601 approval timestamp are required"));
+		if (artifact.provenance !== void 0 && (!isTemplateReferenceProvenanceSource(artifact.provenance.source) || !nonEmpty(artifact.provenance.referenceId) || !ISO_TIMESTAMP.test(artifact.provenance.recordedAt))) issues.push(issue(id, "provenance", "provenance requires a supported source, identifier, and ISO-8601 timestamp"));
 		if (!SLUG.test(id) || !SLUG.test(artifact.gallery.slug)) issues.push(issue(id, "identity", "preset id and canonical slug must be lowercase kebab-case"));
 		if (existingIds.has(id) || suppliedIds.has(id)) issues.push(issue(id, "duplicate-id", `preset id "${id}" is already present`));
 		if (existingSlugs.has(artifact.gallery.slug) || suppliedSlugs.has(artifact.gallery.slug)) issues.push(issue(id, "duplicate-slug", `canonical slug "${artifact.gallery.slug}" is already present`));
@@ -40,6 +124,8 @@ const validatePublicTemplateHandoff = (artifacts) => {
 		const compiled = compileSource(artifact.preset.source, { theme: { overrides: [RECOMMENDED_THEME] } });
 		if (Result.isFailure(compiled)) issues.push(issue(id, "source", compiled.failure.message));
 		else if (artifact.preset.channel !== "email" || compiled.success.channel !== "email") issues.push(issue(id, "channel", "public template source must compile as email"));
+		const unsupportedFontTokens = unsupportedPublicTemplateFontTokens(artifact.preset.source);
+		if (unsupportedFontTokens.length > 0) issues.push(issue(id, "font-token", `unsupported public font token: ${unsupportedFontTokens.join(", ")}`));
 		const parsed = parseSml(artifact.preset.source);
 		if (Result.isSuccess(parsed)) {
 			const sourceVariables = [...collectVariableReferences(parsed.success)];
@@ -52,9 +138,8 @@ const validatePublicTemplateHandoff = (artifacts) => {
 		if (new Set(assetVariables).size !== assetVariables.length) issues.push(issue(id, "assets", "asset variable references must be unique"));
 		for (const asset of artifact.preview.assets) {
 			const value = artifact.preview.sampleData[asset.variable];
-			const url = value === void 0 ? null : URL.parse(value);
 			if (!artifact.preset.variables.includes(asset.variable)) issues.push(issue(id, "assets", `asset "${asset.variable}" is not a declared preset variable`));
-			if (url === null || url.protocol !== "https:") issues.push(issue(id, "assets", `asset "${asset.variable}" must reference a valid HTTPS sample URL`));
+			if (value === void 0 || !isSafePublicTemplateAsset(value)) issues.push(issue(id, "assets", `asset "${asset.variable}" must reference a bounded HTTPS or data:image sample URL`));
 		}
 		const metadata = artifact.publicMetadata;
 		const metadataStrings = [
@@ -77,29 +162,30 @@ const validatePublicTemplateHandoff = (artifacts) => {
 		for (const relatedId of artifact.gallery.relatedTemplates) if (relatedId === id || !allKnownIds.has(relatedId)) issues.push(issue(id, "reference", `related template "${relatedId}" is invalid`));
 	}
 	if (issues.length > 0) return Result.fail(issues);
-	return Result.succeed(artifacts.map((artifact) => ({
-		approval: {
-			...artifact.approval,
-			state: "approved"
-		},
-		preset: {
-			id: artifact.preset.id,
-			channel: artifact.preset.channel,
-			category: artifact.preset.category,
-			name: artifact.preset.name,
-			description: artifact.preset.description,
-			variables: artifact.preset.variables
-		},
-		source: artifact.preset.source,
-		gallery: {
-			...artifact.gallery,
-			path: `/templates/${artifact.gallery.slug}`
-		},
-		preview: artifact.preview,
-		publicMetadata: artifact.publicMetadata
-	})));
+	return Result.succeed(artifacts.map((artifact) => {
+		const reference = toTemplateReferencePacket(artifact);
+		return {
+			approval: {
+				...artifact.approval,
+				state: "approved"
+			},
+			preset: {
+				id: artifact.preset.id,
+				channel: artifact.preset.channel,
+				category: artifact.preset.category,
+				name: artifact.preset.name,
+				description: artifact.preset.description,
+				variables: artifact.preset.variables
+			},
+			source: artifact.preset.source,
+			gallery: reference.gallery,
+			preview: artifact.preview,
+			publicMetadata: artifact.publicMetadata,
+			reference
+		};
+	}));
 };
 //#endregion
-export { validatePublicTemplateHandoff };
+export { emitTemplateReferencePacket, isSafePublicTemplateAsset, toTemplateReferencePacket, unsupportedPublicTemplateFontTokens, validatePublicTemplateHandoff };
 
 //# sourceMappingURL=public-handoff.js.map

package/dist/presets/public-preview-artifacts.d.ts

@@ -1,6 +1,6 @@
 import { EmailPresetId } from "../presets.js";
-import { PublicTemplate } from "./public-gallery.js";
-import { PreviewQuality } from "./public-preview.js";
+import { n as PreviewQuality } from "../public-preview-u1Z9aaGq.js";
+import { t as PublicTemplate } from "../public-gallery-D0Zv0pZE.js";
 import { Result } from "effect";
 //#region presets/public-preview-artifacts.d.ts
 type PreviewSurface = "card" | "detail" | "og";