@tileflow/core 0.1.0-alpha.21 → 0.1.0-alpha.23

package/README.md

@@ -82,8 +82,8 @@ export default defineMap({
 });
 ```
 
-Map identity, scenes, and delivery policy belong to the leaf and do not inherit. Hosting policy such
-as allowed browser origins is delivery metadata because it does not change cartographic output.
+Map identity and scenes belong to the leaf and do not inherit. Hosted browser policy is configured
+in Tileflow and does not enter cartographic authoring or compilation.
 
 Set `projection: 'globe'` for MapLibre's adaptive globe preset. Global zooms render as a sphere,
 then transition to Mercator between zoom 10 and 12 so detailed streets remain planar. Omit the
@@ -147,20 +147,62 @@ registerTileflowContourProtocol({addProtocol: maplibregl.addProtocol});
 
 ## Authoring model
 
-Tileflow exposes one authoring concept: a map. `defineRootMap()` creates a complete compiler root;
-`defineMap()` creates an ordinary map whose `extends` value is another imported map object. All
-eight first-party maps are independent roots. They use the semantic Streets compiler while defining
+Tileflow exposes one authoring concept and one constructor: `defineMap()`. A complete map omits
+`extends`; an inherited map sets `extends` to another imported map object. All ten first-party
+maps are independent standalone maps. They use the sole semantic compiler while defining
 their complete designs and asset providers directly; no official map imports or extends another
-official map. Applications can extend any of those roots through the same public API. Streets
+official map. Applications can extend any of those maps through the same public API. Streets
 itself owns coordinated light and dark themes.
-There is no separate public recipe selector or compatibility alias.
+There is no public compiler selector or alternate compiler. The authoring contract has no recipe or
+cartographic compatibility alias.
+
+### Machine-readable V1 surface
+
+`tileflowAuthoringManifest` is the deterministic, deeply frozen description of the public semantic
+language. Its schema version is `tileflowAuthoringManifestSchemaVersion`. The manifest's `domains`
+array is generated from the compiler's closed registry and records exact compile order, module and
+service dependencies, and provided services. `operations` lists only integrated public operations:
+defining/extending a map, directly replacing, refining, disabling, or resetting a keyed domain,
+and adding owner-local render passes or target refinements. Direct declaration is the sole
+replacement syntax; there is no redundant `set()` helper.
+
+Agents and other tools can discover this contract without importing executable configuration:
+`tileflow language manifest --json` emits the manifest and `tileflow language schema --json` emits
+the packaged generated authoring/resolved JSON Schema. Both commands are deterministic, read-only,
+and network-free. The manifest links every domain to its authoring, options, patch, and resolved
+schema definitions, and enumerates the closed expression and render-selector vocabulary with its
+finite limits.
+
+The manifest also describes the exact structured compiler contract. A successful
+`createStyleResult()` has `{ok: true, diagnostics, report, style}`; a failure has
+`{ok: false, diagnostics, report}` and forbids `style`. Report schema version 1 requires
+`domains`, `map`, `planner`, `schemaVersion`, and sorted semantic `targets`; `theme`, source
+`requirements`, and physical `provenance` are optional. Pass `{inspection: true}` only when the
+read-only physical-output provenance sidecar is needed. Its IDs and indexes are diagnostic
+observations, never stable or addressable authoring targets.
+
+`diffTileflowMaps(before, after)` resolves both inputs before comparing them and returns semantic
+diff schema version 1:
 
-The serialized root literal `compiler: 'streets'` is the current compiler-family ABI identifier,
-retained for compatibility. It selects Core's semantic map engine; it does not select or import the
-official `streets` map, and it does not supply that map's modules, icons, fonts, or other assets.
-`compilerVersion` versions this ABI independently from map and package versions.
+```ts
+{
+  schemaVersion: 1,
+  from: {id, version},
+  to: {id, version},
+  summary: {add, remove, change, total},
+  changes: [
+    {kind: 'add', path: '/projection', after: 'globe'},
+    {kind: 'remove', path: '/modules/water', before: {/* ... */}},
+    {kind: 'change', path: '/view/zoom', before: 12, after: 13},
+  ],
+}
+```
 
-Custom build tooling can opt into a separate compiler-inspection sidecar from the build-only
+Paths are RFC 6901 JSON Pointers. Object keys compare recursively in code-unit order; arrays compare
+atomically because map inheritance replaces arrays. Leaf identity (`id`, `name`, `version`) and
+delivery metadata identify the endpoints but are not cartographic changes.
+
+Custom build tooling can opt into a separate, read-only diagnostic sidecar from the explicit build
 entrypoint:
 
 ```ts
@@ -170,9 +212,9 @@ const {style, inspection} = createStyleWithInspection(map);
 ```
 
 `inspection.layers` stays aligned with the final Style layer order and records the semantic
-`owner`, `slot`, `target`, and ordered add/patch effects that contributed to each layer, including
-layers merged by the optimizer. `createStyleFromCatalogWithInspection` and
-`createStylesFromCatalogWithInspection` provide the corresponding internal catalog forms. The
+`owner`, `slot`, `target`, and ordered render passes/refinements represented by each layer, including
+layers merged by the physical planner. `createStyleFromCatalogWithInspection` and
+`createStylesFromCatalogWithInspection` provide the corresponding catalog-oriented forms. The
 ordinary Style bytes are identical to compilation without inspection; private compiler metadata is
 stripped before finalization, and the sidecar never enters a Style, runtime manifest, or production
 artifact unless a caller deliberately stores it.
@@ -186,8 +228,8 @@ a theme in the final collection.
 `modules` merges by domain name: an omitted domain remains inherited, while declaring `roads(...)`
 or another domain replaces that inherited module request and every compiler-owned contribution
 attached to it as a unit. `data`, `projection`, `terrain`, `marine`, `icons`, and the text provider
-are atomic; identity and tooling metadata are leaf-owned. `enabled: false` removes the domain and
-all of its inherited effects. The resolved result is a standalone map with no runtime dependency on
+are atomic; identity and tooling metadata are leaf-owned. `disable()` removes the domain and
+its complete inherited render stack. The resolved result is a standalone map with no runtime dependency on
 TypeScript imports.
 
 `icons` is an intentional exception to implicit array composition: omission inherits the exact
@@ -196,18 +238,17 @@ spread when the child should keep a parent's directories. `fonts` and `glyphs` a
 exclusive text providers; declaring either atomically replaces an inherited provider of either
 kind. Unknown keys and former compatibility shapes are rejected.
 
-Most authors should extend an existing root. `defineRootMap()` is reserved for defining a complete
-compiler-owned lineage:
+Most authors should extend an existing official or application map. A complete standalone map uses
+the same `defineMap()` call without `extends`:
 
 ```ts
-import {defineMap, defineRootMap, tileflowStreetsCompilerVersion} from '@tileflow/core';
+import {defineMap} from '@tileflow/core';
 import {streetsIcons, streetsThemes} from '@tileflow/maps';
 
-const companyRoot = defineRootMap({
-  id: 'company-root',
-  name: 'Company root',
+const companyBase = defineMap({
+  id: 'company-base',
+  name: 'Company base',
   version: 1,
-  root: {compiler: 'streets', compilerVersion: tileflowStreetsCompilerVersion},
   glyphs: {
     kind: 'url',
     url: 'https://api.tileflow.dev/fonts/{fontstack}/{range}.pbf',
@@ -222,38 +263,41 @@ const companyRoot = defineRootMap({
 export default defineMap({
   id: 'company-navigation',
   version: 1,
-  extends: companyRoot,
+  extends: companyBase,
   projection: 'globe',
 });
 ```
 
-The root above is complete as written. A map always owns its complete text provider; Core does not
+The standalone map above is complete as written. A map always owns its complete text provider; Core does not
 obtain fonts or sprites from World and never invents a fallback URL. The URL-backed first-party
-`streets`, `ferraris`, `harad`, `soundings`, and `verdant` roots declare their glyph providers
-directly, while `siegfried` declares packaged fonts, so ordinary imports and derived maps compile
-without out-of-band release metadata.
+`streets`, `baedeker`, `ferraris`, `harad`, `soundings`, `verdant`, and `sanFrancisto` maps declare their glyph
+providers directly, while `siegfried` declares packaged fonts, so ordinary imports and derived
+maps compile without out-of-band release metadata.
 
 ```mermaid
 flowchart LR
   A["tileflow.config.ts exports one map"] --> B["Resolve imported map lineage"]
-  B --> C["Complete design + domain compilers"]
-  C --> D["Ordered Streets layers"]
-  D --> E["MapLibre Style JSON"]
+  B --> C["Complete semantic design + closed domain registry"]
+  C --> D["Domain IR + assembly + render stacks"]
+  D --> E["Physical planner"]
+  E --> F["Single MapLibre lowering"]
+  F --> G["Validated Style JSON + compilation report"]
 ```
 
 Modules are keyed by domain, so object order never controls rendering and a domain can appear only
-once. A map extending Streets inherits its complete module set. Use `enabled: false` to replace and
-remove a domain deliberately. The public domains are `land`, `water`, `roads`, `buildings`, `boundaries`, `labels`,
-`poi`, `aeroways`, `transit`, `vegetation`, `addresses`, and `landforms`.
-The typed default recipe is exhaustive over that domain set, and a schema contract test verifies
-that every recipe entry keeps its key, type tag, validator, compiler orchestration, and root export
-in lockstep. Disabling `roads` also removes dependent road names, shields, and junction references;
+once. A map extending Streets inherits its complete module set. Use `disable()` to remove a domain
+deliberately. The public domains are `land`, `water`, `nautical`, `roads`, `buildings`, `boundaries`,
+`labels`, `poi`, `aeroways`, `transit`, `vegetation`, `addresses`, and `landforms`.
+The closed domain registry is exhaustive over that domain set and owns defaults, dependency order,
+services, and compiler orchestration. Contract tests keep its keys and type tags in lockstep with
+the strict resolved schema, generated authoring/options/patch/resolved schema aliases, and public
+exports. Disabling `roads` also removes dependent road names, shields, and junction references;
 independent place, water, aerodrome, and POI labels remain under the labels module.
 
 Every styling module supports semantic shortcuts and exact semantic targets. Visual style values
-accept typed token refs, documented `fixed(value, {reason})` values, raw MapLibre expressions through
-`expression(...)`, and zoom functions through `zoom.step(...)`, `zoom.linear(...)`, or
-`zoom.exponential(...)`. Refs and fixed leaves also work inside expressions and zoom stops.
+accept typed token refs, documented `fixed(value, {reason})` values, closed data expressions through
+`expr.*` plus `field(...)`, and zoom functions through `zoom.step(...)`, `zoom.linear(...)`, or
+`zoom.exponential(...)`. Refs and fixed leaves also work inside typed expressions and zoom stops.
 Structural controls such as presets, visibility, and zoom gates remain ordinary literals. Exact
 controls address stable concepts such as `roads.classes.primary.surface.fill`, not renderer layer
 IDs.
@@ -321,14 +365,14 @@ ordinary visual styles intentionally do not accept raw source filters.
 
 ## Compiled-style performance
 
-The Streets compiler resolves semantic modules and their owned contributions first, then compacts equivalent
+The semantic compiler resolves semantic modules and their owned contributions first, then compacts equivalent
 physical MapLibre layers. At high-detail zooms, road classes become a small set of data-driven
 cohorts; equivalent road labels and tunnel hatches share compatible buckets; and land-cover,
 land-use, and waterway classes share compatible buckets. Compaction selects
 cohorts from compiler-owned semantic targets, not by parsing physical IDs; its temporary
 owner/slot/target provenance is stripped from the public Style JSON.
 
-After optimization, Core embeds a bounded private `tileflow:interaction-manifest` lookup for the
+After physical planning, Core embeds a bounded private `tileflow:interaction-manifest` lookup for the
 final POI representations. `@tileflow/interactions/maplibre` validates and consumes that metadata
 so applications can bind to `domain: 'poi'` without depending on physical layer IDs. The lookup is
 paired atomically with the exact style it describes; it is not a public style-authoring API.
@@ -647,7 +691,7 @@ export default defineMap({
 });
 ```
 
-Module recipes own structure and semantic behavior; visual fields accept typed token references.
+Semantic modules own structure and behavior; visual fields accept typed token references.
 Use a visual literal only inside a theme. If a module value intentionally must not vary, wrap it in
 `fixed(value, {reason})`. `tileflow inspect --json` reports stable `THEME_IMPLICIT_FIXED`
 diagnostics: implicit color, font, and image literals block Style compilation, while direct visual
@@ -657,14 +701,77 @@ deterministic OKLCH `color.mix()` keep derived palette logic inspectable. Unknow
 cross-category refs, token-schema drift, and unresolved visual nodes fail before Style JSON is
 emitted.
 
-There is no public physical-layer override surface. New cartographic behavior belongs to a typed
-control in its owning module. Official maps may add compiler-private semantic contributions, but
-each has exactly one module owner and is discarded atomically when that module is replaced or
-disabled. `createStyle()` validates the final optimized Style JSON with the MapLibre style spec and
-never returns an invalid style.
+There is no physical-layer override for the Tileflow basemap or separate official-map authoring
+surface. Basemap behavior belongs to a typed control or owner-local render stack. Every
+official and application map therefore follows the same schema, inheritance rules, diagnostics,
+and lowering path. `createStyle()` validates the final planned Style JSON with the MapLibre style
+spec and never returns an invalid style.
 
 ## Data is separate from design
 
+Team data uses named logical sources and validated MapLibre overlays. The hosted identity never
+contains a CDN URL; `local` is the explicit account-free PMTiles resolution for Dev and Capture:
+
+```ts
+import {defineMap, hostedTileset, maplibreOverlay} from '@tileflow/core';
+import {streets} from '@tileflow/maps';
+
+const stores = hostedTileset({
+  tileset: 'stores',
+  local: './data/stores.pmtiles',
+  attribution: 'Store data © Example',
+});
+
+export default defineMap({
+  id: 'store-locator',
+  version: 1,
+  extends: streets,
+  sources: {stores},
+  overlays: {
+    stores: maplibreOverlay({
+      source: 'stores',
+      placement: 'above-roads',
+      layers: [
+        {
+          id: 'stores-points',
+          type: 'circle',
+          'source-layer': 'store_locations',
+          paint: {
+            'circle-color': ['match', ['get', 'category'], 'restaurant', '#ef4444', '#64748b'],
+          },
+        },
+      ],
+    }),
+  },
+});
+```
+
+Tileflow automatically registers only protocols in namespaces that Tileflow owns.
+`tileflow-pmtiles://` is reserved for PMTiles resources managed by Tileflow. Tileflow never
+automatically registers, removes, or replaces the global `pmtiles://` handler. Explicit PMTiles
+sources supplied by an application remain the application's responsibility.
+
+For local resolution, the Style URL is based on the logical tileset ID and remains stable when Dev
+creates a new immutable snapshot. Physical generation IDs and local content hashes never enter the
+Style representation. Each Dev PMTiles request retains the snapshot it resolved until its response
+is prepared, and strong generation ETags prevent one cached PMTiles read from silently combining
+ranges from different generations. Standalone Capture retains one snapshot for its complete render.
+Application Capture does not freeze every local dataset across the complete screenshot window; the
+application's development server remains authoritative for its per-read generation.
+
+`local` does not make build output own or publish the archive. Production builds reject unresolved
+local PMTiles. Explicitly publish the tileset through Tileflow's managed upload, validation,
+versioning, and hosting flow, or serve it from infrastructure owned by the application.
+
+One overlay owns one ordered group of ordinary MapLibre Style Layers. Public layer IDs are retained
+for `map.on(...)`, feature queries, and application state. Placement is one of `above-water`,
+`below-roads`, `above-roads`, `above-buildings`, `below-labels`, or `above-labels`; overlays sharing
+a placement sort by overlay ID. A map accepts up to 16 Team sources in addition to Tileflow World
+and terrain. These semantic boundaries do not expose generated basemap layer IDs.
+`sources` and `overlays` merge by key through `extends`, declarations replace atomically, and
+`remove()` deletes one inherited key. Removing a still-used source fails validation. There is no
+interaction DSL or parallel expression language.
+
 Omitting `data` selects the compiler-owned Tileflow World `v1` compatibility generation:
 
 ```ts
@@ -678,7 +785,7 @@ domain, while the font token catalog gives module styles a stable semantic targe
 explicit and atomic: a map may declare either ordered `fonts` directories
 for browser font files or a `glyphs` provider for PBF glyphs, never both. Omitting both inherits the
 parent's provider; declaring either replaces an inherited provider of either kind. After resolution,
-a map that emits text must have exactly one provider. A text-free root may omit both. On a derived
+a map that emits text must have exactly one provider. A text-free standalone map may omit both. On a derived
 map, omission inherits the parent provider while `fonts: []` explicitly removes it; that empty array
 is valid only when the resolved map emits no text.
 
@@ -720,7 +827,7 @@ another. Browser adapters load local faces before MapLibre. Native releases use
 `glyphs` URL provider instead, which enumerates the exact comma-joined MapLibre request keys in
 `fontStacks`.
 
-Streets, Ferraris, Härad, Soundings, and Verdant each declare
+Streets, Ferraris, Härad, Soundings, Verdant, and San Francisto each declare
 `https://api.tileflow.dev/fonts/{fontstack}/{range}.pbf` with the exact `Noto Sans Regular` and
 `Noto Sans Bold` stacks. That compatibility URL is canonical but not content-addressed; responses revalidate and
 do not make a resolved map byte-reproducible. Exact official glyph identity belongs to the
@@ -728,8 +835,8 @@ separately published `/base/<assetSetSha256>/glyphs/...` global base-asset contr
 `assetSetSha256` identifies the standalone glyph collection; it is not the same-domain value as the
 per-map `assetSetSha256` in `build-manifest.json`.
 Cyberpunk and Matrix each replace the URL provider with their own packaged Oxanium directory and
-reference the exact local faces `Oxanium Medium` and `Oxanium SemiBold`. Siegfried owns its packaged
-Cormorant Garamond Regular, SemiBold, and Italic faces.
+reference the exact local faces `Oxanium Medium` and `Oxanium SemiBold`. Baedeker and Siegfried
+each own a packaged directory containing Cormorant Garamond Regular, SemiBold, and Italic.
 
 Name the official generation deliberately, or use another OpenMapTiles-compatible vector source:
 
@@ -932,8 +1039,9 @@ source classes into one civic color.
 
 World and text assets are independent contracts. `tileflowWorld()` selects `world-v1/current` or an
 exact `releaseId + descriptorSha256`; a `glyphs` declaration contains its own complete URL. Ordinary
-imports of Streets, Ferraris, Härad, Siegfried, Soundings, Cyberpunk, Matrix, and
-Verdant remain usable because each official map owns or inherits a URL or packaged-font provider.
+imports of Streets, Baedeker, Ferraris, Härad, Siegfried, Soundings, Cyberpunk, Matrix, Verdant,
+and San Francisto
+remain usable because each official map owns or inherits a URL or packaged-font provider.
 URL-backed maps become exact-byte reproducible
 when the immutable global base-asset set is published and their explicit URL is updated to its
 `assetSetSha256` path; no World or compiler fallback participates in that rollout. The global
@@ -989,16 +1097,17 @@ subpaths. Node build integrations import the small deterministic map-identity co
 reproduces the same asset-set v1 hash from exact per-file identities after another system has
 independently confirmed the immutable bytes; package or bundle hashes are not substitutes. The
 previous aggregate-wrapper and recipe-selector APIs, `renderer`, top-level `tiles`/`tileset`, module
-arrays, and raw `layers` are not part of this API.
+arrays, and top-level raw `layers` are not part of this API. Raw MapLibre layers are accepted only
+inside a named `maplibreOverlay()` bound to a named Team source.
 
-`@tileflow/core/recipe` is nevertheless a real exported ABI used by `@tileflow/maps` to declare
-owner-scoped semantic effects for first-party recipes. It is a low-level compiler integration
-surface, not a recipe selector and not the ordinary application authoring API; application maps
-should use typed modules from the package root. Because Maps imports this subpath from its installed
-Core peer, incompatible changes to it participate in Core SemVer and package compatibility checks.
+Advanced cartography remains in the same public language: `withRenderStack()`, `renderPass()`, and
+`refineRenderTarget()` address owner-local semantic targets without exposing physical layer IDs,
+sources, source layers, raw filters, or before/after anchors. Typed `field()` references and
+`expr.*` builders stay semantic until the compiler's single lowering boundary. There is no recipe
+subpath or alternate compiler integration API.
 
 `mapRevisionSha256` hashes only resolved cartography: the effective design after `extends`, the
-compiler family, compiler-owned effective contributions, and exact source icon/font identities.
+semantic language, compiler-owned effective contributions, and exact source icon/font identities.
 Leaf `id`, `name`, editorial `mapVersion`, default `view`, capture `scenes`, and `delivery` policy do
 not change that content identity. They remain explicit on the map, manifest, Style, capture receipt,
 or Hosted deployment fingerprint that owns them. Compiler ABI, package versions, generated assets,
@@ -1049,7 +1158,6 @@ Framework adapters import the browser-only lifecycle kernel explicitly:
 import {
   attachTileflowFairUseNotice,
   attachTileflowMapLifecycle,
-  createTileflowMarkerController,
   createTileflowSessionStarter,
   createTileflowTransformRequest,
   registerTileflowWorldRequestBridge,
@@ -1076,13 +1184,24 @@ can set `grantTimeoutMs` from 1 to 120,000 milliseconds.
 server-owned commercial authorization. User `transformRequest` callbacks still run first; Tileflow
 then decorates only the resulting eligible URL and preserves the other request options.
 
+Set `analytics.surfaceId` to a stable product location when the same Map appears in several places:
+
+```ts
+const analytics = {surfaceId: 'store-locator'};
+```
+
+A Surface ID is 1–64 lowercase ASCII letters, digits, `.`, `_`, or `-`; it starts and ends with a
+letter or digit. Missing or invalid values become `default`. Use a durable integration name such as
+`checkout` or `dealer-search`, not a URL, branch, preview, random component instance, or user ID.
+Surface labels do not change authorization, entitlement, or Session identity.
+
 For exact Tileflow World release tiles, framework adapters also use the browser request bridge to
 observe the response's safe fair-use state without adding identity, query parameters, credentials,
 or user headers to the public World URL. The bridge requires the immutable release path and exactly
 one lowercase descriptor digest; the retired mutable World template is never intercepted. Early
 `GRACE` stays silent; signed late `GRACE` creates a compact
-accessible owner-action pill, and `CLAIM_REQUIRED` creates a stronger in-map banner. A missing
-header, absent tile, MapLibre error, or failed response cannot erase an existing claim action; a
+accessible owner-action pill, and `MANAGED_REQUIRED` creates a stronger in-map banner. A missing
+header, absent tile, MapLibre error, or failed response cannot erase an existing manage action; a
 later successful `OPEN` response can clear it. Shaped empty tiles remain render-safe while the owner
 action stays available. Successful World tile bodies are streamed with a 16 MiB maximum: an
 oversized `Content-Length` is rejected before reading, and chunked responses are cancelled as soon
@@ -1097,6 +1216,9 @@ Core. That package exports the maps and their reusable directory descriptors:
 
 ```ts
 import {
+  baedeker,
+  baedekerFonts,
+  baedekerIcons,
   cyberpunk,
   cyberpunkFonts,
   cyberpunkIcons,
@@ -1107,6 +1229,8 @@ import {
   matrix,
   matrixFonts,
   matrixIcons,
+  sanFrancisto,
+  sanFrancistoIcons,
   siegfried,
   siegfriedFonts,
   siegfriedIcons,
@@ -1120,13 +1244,18 @@ import {
 } from '@tileflow/maps';
 ```
 
-All eight official maps are complete compiler roots. Each selects the semantic Streets compiler
-without importing or extending another official map and declares its own icon directory.
+All ten official maps are complete standalone maps. The sole semantic compiler is implicit; none
+imports or extends another official map, and each declares its own icon directory.
 Streets declares `[streetsIcons]` and exposes its complete coordinated appearances as
 `streetsThemes.light` and `streetsThemes.dark`; image tokens select the matching sidewalk pattern
-without changing the asset collection. Cyberpunk declares `[cyberpunkIcons]` and
-`[cyberpunkFonts]`; Matrix independently declares `[matrixIcons]` and `[matrixFonts]`. The same
-asset operation is available to applications:
+without changing the asset collection. Baedeker declares `[baedekerIcons]`, whose eight original
+patterns support its travel-atlas design, and `[baedekerFonts]`, its own Cormorant Garamond
+directory; it derives contours in the browser from unpackaged Mapterhorn terrain tiles. Cyberpunk
+declares `[cyberpunkIcons]` and `[cyberpunkFonts]`; Matrix
+independently declares `[matrixIcons]` and `[matrixFonts]`. San Francisto declares
+`[sanFrancistoIcons]` for its four technical hatches and schematic POI node, derives contours from
+unpackaged Mapterhorn tiles, and uses the canonical Noto Sans glyph provider. The same asset
+operation is available to applications:
 
 ```ts
 export default defineMap({
@@ -1148,6 +1277,6 @@ sprite selector, icon mapping, icon-specific inheritance, additive command, or c
 and prepares ordinary public artifacts without serializing installation paths. It compiles one
 deterministic sprite from the final icon composition and validates every literal `icon-image`,
 `fill-pattern`, and `line-pattern` in the final style against it. It also prepares any declared font
-directories generically; `cyberpunkFonts`, `matrixFonts`, and `siegfriedFonts` are ordinary package
-descriptors rather than pipeline special cases. Calling the pure compiler for a map whose style needs unprepared
+directories generically; `baedekerFonts`, `cyberpunkFonts`, `matrixFonts`, and `siegfriedFonts` are
+ordinary package descriptors rather than pipeline special cases. Calling the pure compiler for a map whose style needs unprepared
 assets fails instead of emitting broken runtime references.

package/THIRD_PARTY_NOTICES.md

@@ -1,7 +1,7 @@
 # Third-party notices
 
-`@tileflow/core/browser` embeds `maplibre-contour` 0.1.0 so contour rendering remains local and
-does not require executable code from a public CDN. The complete upstream license follows.
+`@tileflow/core/browser` embeds `maplibre-contour` 0.1.0, `PMTiles` 4.4.0, and `fflate` 0.8.2 so
+contour and local archive rendering remain self-contained. The complete upstream licenses follow.
 
 ## maplibre-contour 0.1.0
 
@@ -168,6 +168,64 @@ See <https://github.com/nodejs/node/blob/main/LICENSE> for more information.
 
 ---
 
+## PMTiles 4.4.0
+
+The below license (BSD-3) applies to the reference implementations in this repository.
+
+The PMTiles specification itself is public domain, or CC0 where applicable.
+
+Sample tilesets available in this repository are subject to their own license terms.
+
+Copyright 2021 Protomaps LLC
+
+Redistribution and use in source and binary forms, with or without modification, are permitted
+provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this list of conditions
+   and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice, this list of
+   conditions and the following disclaimer in the documentation and/or other materials provided
+   with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors may be used to
+   endorse or promote products derived from this software without specific prior written
+   permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
+IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
+CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+---
+
+## fflate 0.8.2
+
+MIT License
+
+Copyright (c) 2023 Arjun Barrett
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+associated documentation files (the "Software"), to deal in the Software without restriction,
+including without limitation the rights to use, copy, modify, merge, publish, distribute,
+sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT
+NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT
+OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+---
+
 ## TypeScript helper code
 
 The bundled browser entry retains TypeScript helper code and its complete upstream notice: