@tryvitris/website-harness 0.0.0-stage → 0.1.0-beta.5

package/bin/vitris-stock.js

@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+import {
+  digest,
+  importStock,
+  readStockCatalog,
+  saveSelection,
+  searchStock,
+  stockBytes
+} from "./chunks/chunk-TY33XMHW.js";
+import "./chunks/chunk-G7MNMULR.js";
+import {
+  json,
+  save,
+  within
+} from "./chunks/chunk-T6PE4KN4.js";
+
+// scripts/stock-library.ts
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+var kernel = resolve(import.meta.dirname, "..");
+var argv = process.argv.slice(2);
+var arg = (key) => argv.includes(key) ? argv[argv.indexOf(key) + 1] : void 0;
+var command = argv[0];
+var catalogPath = resolve(arg("--catalog") || join(kernel, "src/stock/catalog.json"));
+var cache = resolve(arg("--cache") || join(kernel, "artifacts/stock-library"));
+if (!command || command === "--help") {
+  console.log("stock-library search [--query TEXT --industry ID --role ID --kind image|video]\nstock-library stage --out NEW_DIR\nstock-library import --site DIR --id ID --reason TEXT --route / [--cache DIR]\nstock-library select --site DIR --file MANIFEST\nstock-library verify [--cache DIR]\nstock-library publish --out NEW_REPORT_DIR [--cache DIR]\nStock stage never publishes. Inspection and catalog acceptance are separate.");
+} else if (command === "search") {
+  const query = arg("--query-file") ? JSON.parse(readFileSync(resolve(arg("--query-file")), "utf8")) : { text: arg("--query"), industry: arg("--industry"), role: arg("--role"), kind: arg("--kind"), limit: 12 };
+  console.log(JSON.stringify(searchStock(readStockCatalog(catalogPath).items, query), null, 2));
+} else if (command === "import") {
+  const id = arg("--id"), site = arg("--site");
+  if (!site) throw new Error("--site required");
+  const item = readStockCatalog(catalogPath).items.find((i) => i.id === id);
+  if (!item) throw new Error("Unknown stock asset");
+  const { findActivePreparation } = await import("./chunks/preparation-S4MG3RPL.js");
+  const current = existsSync(join(site, "agent/PREPARED.json"));
+  if (current && !findActivePreparation(site, "media") && !findActivePreparation(site, "asset-production")) throw new Error("Import stock during media or asset-production; route later additions through the declared owner");
+  const launch = existsSync(join(site, "launch.json")) ? json(join(site, "launch.json")) : {};
+  console.log(await importStock({ root: resolve(site), item, cacheRoot: cache, assetOrigin: arg("--origin") || process.env.VITRIS_STOCK_ORIGIN || process.env.VITRIS_BACKEND_ORIGIN || process.env.KERNEL_ORIGIN || launch.backendOrigin || launch.kernelOrigin, reason: arg("--reason") || "", placements: arg("--route") ? [arg("--route")] : [] }));
+} else if (command === "select") {
+  const site = arg("--site"), file = arg("--file");
+  if (!site || !file) throw new Error("--site and --file required");
+  saveSelection(resolve(site), json(resolve(file)));
+} else if (command === "publish") {
+  const outArg = arg("--out");
+  if (!outArg || existsSync(resolve(outArg))) throw new Error("Use a new --out report directory");
+  const vars = {};
+  if (existsSync(join(kernel, ".dev.vars"))) for (const line of readFileSync(join(kernel, ".dev.vars"), "utf8").split(/\r?\n/)) {
+    const m = line.match(/^([A-Z_]+)\s*=\s*["']?([^\s"']+)/);
+    if (m) vars[m[1]] = m[2];
+  }
+  const token = process.env.CLOUDFLARE_API_TOKEN || process.env.CF_API_TOKEN || vars.CLOUDFLARE_API_TOKEN || vars.CF_API_TOKEN;
+  const account = process.env.CLOUDFLARE_ACCOUNT_ID || process.env.CF_ACCOUNT_ID || vars.CLOUDFLARE_ACCOUNT_ID || vars.CF_ACCOUNT_ID;
+  if (!token || !account) throw new Error("Cloudflare credentials required for explicit stock publication");
+  const out = resolve(outArg);
+  mkdirSync(out, { recursive: true });
+  const catalog = readStockCatalog(catalogPath);
+  const uploaded = [];
+  const put = async (key, bytes, mime) => {
+    const r = await fetch(`https://api.cloudflare.com/client/v4/accounts/${account}/r2/buckets/vitris-assets/objects/${key}`, { method: "PUT", headers: { authorization: `Bearer ${token}`, "content-type": mime }, body: bytes, signal: AbortSignal.timeout(6e4) });
+    if (!r.ok) throw new Error(`R2 upload failed (${r.status}) for ${key}`);
+    uploaded.push(key);
+  };
+  try {
+    for (const item of catalog.items.filter((i) => i.status === "accepted")) {
+      await put(item.src.slice(1), await stockBytes(item, cache), item.kind === "video" ? "video/mp4" : "image/jpeg");
+      await put(item.thumb.slice(1), await stockBytes(item, cache, true), "image/jpeg");
+    }
+    const publicCatalog = { ...catalog, items: catalog.items.filter((i) => i.status === "accepted") };
+    await put("stock/catalog.json", Buffer.from(JSON.stringify(publicCatalog)), "application/json");
+    save(join(out, "publication.json"), { ok: true, catalogHash: digest(Buffer.from(JSON.stringify(publicCatalog))), uploaded, at: (/* @__PURE__ */ new Date()).toISOString() });
+  } catch (error) {
+    save(join(out, "publication.json"), { ok: false, uploaded, error: String(error), at: (/* @__PURE__ */ new Date()).toISOString() });
+    throw error;
+  }
+} else if (command === "verify") {
+  const failures = [];
+  for (const item of readStockCatalog(catalogPath).items) try {
+    await stockBytes(item, cache);
+    await stockBytes(item, cache, true);
+  } catch (e) {
+    failures.push(String(e));
+  }
+  console.log(JSON.stringify({ ok: !failures.length, failures }));
+  if (failures.length) process.exitCode = 1;
+} else if (command === "stage") {
+  const outArg = arg("--out");
+  if (!outArg) throw new Error("--out required");
+  const out = resolve(outArg);
+  if (existsSync(out)) throw new Error("Use a new acquisition directory");
+  let key = process.env.PEXELS_API_KEY;
+  if (!key && existsSync(join(kernel, ".dev.vars"))) key = readFileSync(join(kernel, ".dev.vars"), "utf8").match(/^PEXELS_API_KEY\s*=\s*["']?([^\s"']+)/m)?.[1];
+  if (!key) throw new Error("PEXELS_API_KEY is not configured");
+  const spec = json(join(kernel, "src/stock/coverage.json"));
+  const known = new Set(readStockCatalog(catalogPath).items.map((i) => `${i.kind}:${i.pexelsId}`));
+  const staged = { version: 2, items: [] };
+  mkdirSync(out, { recursive: true });
+  const errors = [];
+  const get = async (url) => {
+    const r = await fetch(url, { headers: { Authorization: key }, signal: AbortSignal.timeout(3e4) });
+    if (!r.ok) throw new Error(`Pexels response ${r.status}`);
+    return r.json();
+  };
+  const download = async (url, sub, ext) => {
+    const r = await fetch(url, { signal: AbortSignal.timeout(3e4) });
+    if (!r.ok) throw new Error(`Download response ${r.status}`);
+    const bytes = Buffer.from(await r.arrayBuffer());
+    const sha = digest(bytes);
+    const src = `/stock/${sub}/${sha}.${ext}`, file = within(out, src.slice(1));
+    mkdirSync(dirname(file), { recursive: true });
+    writeFileSync(file, bytes);
+    return { src, sha, bytes: bytes.length };
+  };
+  for (const kind of ["image", "video"]) for (const specItem of kind === "image" ? spec.imageQueries : spec.videoQueries) {
+    try {
+      const data = await get(`https://api.pexels.com/${kind === "image" ? "v1/search" : "videos/search"}?query=${encodeURIComponent(specItem.query)}&per_page=8`);
+      const candidates = (kind === "image" ? data.photos : data.videos).filter((hit) => !known.has(`${kind}:${hit.id}`)).slice(0, kind === "image" ? 3 : 2);
+      for (const hit of candidates) {
+        const video = kind === "video" ? hit.video_files.filter((f) => f.file_type === "video/mp4" && f.width >= 640 && f.width <= 1920).sort((a, b) => a.width - b.width)[0] : void 0;
+        if (kind === "video" && (!video || hit.duration > 30)) continue;
+        const url = kind === "image" ? hit.src.large2x || hit.src.large : video.link;
+        const thumbUrl = kind === "image" ? hit.src.medium : hit.image;
+        if (!url || !thumbUrl) continue;
+        const original = await download(url, kind === "image" ? "images" : "videos", kind === "image" ? "jpg" : "mp4");
+        const thumb = await download(thumbUrl, "thumbs", "jpg");
+        staged.items.push({
+          id: `pexels-${kind}-${hit.id}`,
+          kind,
+          src: original.src,
+          thumb: thumb.src,
+          alt: hit.alt || specItem.query,
+          tags: specItem.query.split(" "),
+          categories: [specItem.industry],
+          credit: `${hit.photographer || hit.user?.name || "Creator"} / Pexels`,
+          pexelsId: hit.id,
+          sha256: original.sha,
+          bytes: original.bytes,
+          thumbSha256: thumb.sha,
+          thumbBytes: thumb.bytes,
+          sourceUrl: hit.url,
+          downloadUrl: url,
+          thumbnailUrl: thumbUrl,
+          acquiredAt: (/* @__PURE__ */ new Date()).toISOString(),
+          termsUrl: "https://www.pexels.com/license/",
+          width: kind === "video" ? video.width : void 0,
+          height: kind === "video" ? video.height : void 0,
+          duration: hit.duration,
+          status: "staged"
+        });
+        known.add(`${kind}:${hit.id}`);
+        save(join(out, "catalog.json"), staged);
+      }
+      console.log(`Staged ${specItem.query}`);
+    } catch (error) {
+      errors.push(`${specItem.query}: ${String(error)}`);
+    }
+  }
+  save(join(out, "acquisition.json"), { at: (/* @__PURE__ */ new Date()).toISOString(), items: staged.items.length, errors, published: false });
+  console.log(`${staged.items.length} candidates staged for inspection; ${errors.length} acquisition errors`);
+} else throw new Error(`Unknown command ${command}`);

package/bin/vitris-templates.js

@@ -0,0 +1,261 @@
+#!/usr/bin/env node
+import {
+  loadDevVars
+} from "./chunks/chunk-XGTHGWPW.js";
+import {
+  releaseRank,
+  themeHash,
+  validateManifest
+} from "./chunks/chunk-AUO5I56E.js";
+
+// scripts/templates.ts
+import { readFileSync, writeFileSync, readdirSync, lstatSync, realpathSync, existsSync, mkdirSync, renameSync, unlinkSync } from "node:fs";
+import { join, resolve, relative, sep, dirname } from "node:path";
+
+// scripts/lib/template-r2.ts
+import { createHash, createHmac } from "node:crypto";
+var sha = (bytes) => createHash("sha256").update(bytes).digest("hex");
+loadDevVars(process.cwd());
+var keyId = process.env.CF_ACCESS_KEY_ID;
+var secret = process.env.CF_SECRET_ACCESS_KEY;
+var endpoint = process.env.CF_S3_API_ENDPOINT;
+var bucket = process.env.VITRIS_TEMPLATE_BUCKET || "vitris-assets";
+var hmac = (key, value) => createHmac("sha256", key).update(value).digest();
+async function r2Request(method, key, body, mime, extra = {}) {
+  if (!keyId || !secret || !endpoint) throw Error("R2 S3 credentials are missing");
+  if (!key.startsWith("templates/") || key.includes("..")) throw Error("Publication outside template namespace");
+  if (!/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/.test(bucket)) throw Error("Invalid template bucket name");
+  const url = new URL(endpoint.replace(/\/$/, "") + "/" + bucket + "/" + key.split("/").map(encodeURIComponent).join("/"));
+  const date = (/* @__PURE__ */ new Date()).toISOString().replace(/[:-]|\.\d{3}/g, ""), day = date.slice(0, 8), payload = body ? sha(body) : sha(""), scope = day + "/auto/s3/aws4_request";
+  const headers = { "host": url.host, "x-amz-content-sha256": payload, "x-amz-date": date, ...mime ? { "content-type": mime } : {}, ...extra };
+  const names = Object.keys(headers).sort(), signed = names.join(";"), canonical = [method, url.pathname, "", names.map((n) => n + ":" + headers[n] + "\n").join(""), signed, payload].join("\n");
+  const signing = hmac(hmac(hmac(hmac("AWS4" + secret, day), "auto"), "s3"), "aws4_request");
+  headers.authorization = `AWS4-HMAC-SHA256 Credential=${keyId}/${scope}, SignedHeaders=${signed}, Signature=${createHmac("sha256", signing).update("AWS4-HMAC-SHA256\n" + date + "\n" + scope + "\n" + sha(canonical)).digest("hex")}`;
+  return fetch(url, { method, headers, ...body ? { body } : {}, signal: AbortSignal.timeout(18e4) });
+}
+async function putVerified(key, body, mime) {
+  const hash = sha(body);
+  for (let attempt = 0; attempt < 3; attempt++) {
+    try {
+      const prior = await r2Request("GET", key);
+      if (prior.ok && sha(new Uint8Array(await prior.arrayBuffer())) === hash) return { key, sha256: hash, bytes: body.length };
+      if (prior.status !== 404 && !prior.ok) throw Error(`R2 read ${prior.status}: ${key}`);
+      if (prior.ok) throw Error("Immutable object conflict: " + key);
+      const written = await r2Request("PUT", key, body, mime);
+      if (!written.ok) throw Error(`R2 write ${written.status}: ${key}`);
+      const read = await r2Request("GET", key);
+      if (!read.ok || sha(new Uint8Array(await read.arrayBuffer())) !== hash) throw Error("Remote integrity failure: " + key);
+      return { key, sha256: hash, bytes: body.length };
+    } catch (error) {
+      if (attempt === 2) throw error;
+    }
+  }
+  throw Error("Unreachable");
+}
+
+// scripts/templates.ts
+var argv = process.argv.slice(2);
+var command = argv[0];
+var arg = (key) => argv[argv.indexOf(key) + 1];
+var origin = process.env.VITRIS_TEMPLATE_ORIGIN || "https://vitris-templates.jack-896.workers.dev";
+var json = (path) => JSON.parse(readFileSync(path, "utf8"));
+var confined = (root, path) => {
+  const resolved = realpathSync(resolve(root, path));
+  if (!resolved.startsWith(root + sep)) throw Error("Bundle path escapes its staging directory");
+  return resolved;
+};
+async function pool(items, action) {
+  let next = 0;
+  await Promise.all(Array.from({ length: 4 }, async () => {
+    while (next < items.length) await action(items[next++]);
+  }));
+}
+async function remoteCatalog() {
+  const r = await r2Request("GET", "templates/catalog.json", void 0, void 0, { "accept-encoding": "identity" });
+  if (!r.ok) throw Error("Remote catalog read failed");
+  const etag = r.headers.get("etag");
+  if (!etag || etag.startsWith("W/")) throw Error("Remote catalog needs a strong ETag for conditional publication");
+  return { catalog: await r.json(), etag };
+}
+async function syncLocalCatalog(catalog) {
+  const local = resolve("src/agent/theme-cloud.json"), temp = local + ".tmp";
+  writeFileSync(temp, JSON.stringify(catalog, null, 2));
+  for (let attempt = 0; ; attempt++) {
+    try {
+      renameSync(temp, local);
+      return;
+    } catch (error) {
+      if (attempt >= 4 || !["EPERM", "EACCES", "EBUSY"].includes(error.code)) throw error;
+      await new Promise((r) => setTimeout(r, 250));
+    }
+  }
+}
+async function verifyEntry(entry) {
+  const base = entry.base + `/templates/demo/${entry.revision}/${entry.theme.id}`;
+  await pool(entry.pages, async (page) => {
+    const r = await fetch(base + page.path);
+    if (!r.ok) throw Error(`Hosted route ${r.status}: ${page.path}`);
+    const html = await r.text();
+    if (!/<h1[\s>]/.test(html) || html.includes("/theme-assets/") || /__VITRIS_(?:PAGE|BRAND|LOGO|CSS|RETURN)/.test(html)) throw Error("Incomplete hosted route " + page.path);
+  });
+}
+if (command === "gallery") {
+  const { startTemplateGallery } = await import("./chunks/template-gallery-ET76ERZQ.js");
+  const port = argv.includes("--port") ? Number(arg("--port")) : 4390;
+  if (!Number.isInteger(port) || port < 0 || port > 65535) throw Error("Invalid gallery port");
+  console.log("Default Cloudflare template gallery: " + (await startTemplateGallery(port)).url);
+} else if (command === "publish") {
+  if (!process.env.VITRIS_TEMPLATE_ORIGIN || !process.env.VITRIS_TEMPLATE_BUCKET) throw Error("Template publication requires your own VITRIS_TEMPLATE_ORIGIN and VITRIS_TEMPLATE_BUCKET");
+  const raw = arg("--bundle");
+  if (!argv.includes("--bundle") || !raw) throw Error("publish --bundle ABSOLUTE_STAGING_DIRECTORY");
+  const root = realpathSync(resolve(raw));
+  if (root === process.cwd() || root === resolve("src") || root === resolve("artifacts")) throw Error("Use a dedicated transient template bundle directory");
+  const draft = json(join(root, "template.json")), entry = draft.entry;
+  if (!entry?.theme || !/^[a-z0-9-]+$/.test(entry.theme.id) || !/^\d{4}-\d{2}-\d{2}\.\d+$/.test(entry.theme.release) || !entry.theme.tokens || !entry.browse || !entry.business) throw Error("Invalid template catalog metadata");
+  validateManifest(entry.theme.id, entry.pages);
+  const initial = await remoteCatalog();
+  if (argv.includes("--resume")) {
+    const published2 = initial.catalog.entries.find((e) => e.theme.id === entry.theme.id && e.theme.release === entry.theme.release);
+    if (!published2?.sourceArchive || published2.sourceHash !== themeHash(entry.theme)) throw Error("Resume requires the exact already-published template");
+    for (const p of entry.pages) {
+      const hosted = published2.pages.find((v) => v.pageId === p.pageId);
+      const recipe = json(confined(root, draft.recipes[p.pageId]));
+      if (!hosted || hosted.path !== p.path || hosted.recipe !== sha(JSON.stringify(recipe))) throw Error("Published recipe differs from staging: " + p.pageId);
+    }
+    if (published2.pages.length !== entry.pages.length) throw Error("Published route count differs from staging");
+    const response = await r2Request("GET", published2.sourceArchive);
+    if (!response.ok) throw Error("Published source archive unavailable");
+    const archiveBytes = new Uint8Array(await response.arrayBuffer());
+    if (published2.sourceArchive !== `templates/archives/${sha(archiveBytes)}/manifest.json`) throw Error("Source archive integrity failure");
+    const archive = JSON.parse(Buffer.from(archiveBytes).toString("utf8"));
+    if (!Array.isArray(archive.files) || !archive.files.length) throw Error("Resume requires a complete file snapshot");
+    for (const f of archive.files) {
+      const bytes2 = readFileSync(confined(root, f.path));
+      if (bytes2.length !== f.bytes || sha(bytes2) !== f.sha256) throw Error("Staging changed after publication; retain it for review: " + f.path);
+    }
+    await verifyEntry(published2);
+    const latest2 = await remoteCatalog();
+    if (!latest2.catalog.entries.some((e) => e.theme.id === entry.theme.id && e.revision === published2.revision && e.sourceArchive === published2.sourceArchive)) throw Error("Published snapshot changed during resume");
+    await syncLocalCatalog(latest2.catalog);
+    for (const f of archive.files) {
+      const bytes2 = readFileSync(confined(root, f.path));
+      if (bytes2.length !== f.bytes || sha(bytes2) !== f.sha256) throw Error("Staging changed during resume; retain it for review: " + f.path);
+    }
+    for (const f of archive.files) unlinkSync(confined(root, f.path));
+    console.log(JSON.stringify({ published: entry.theme.id, resumed: true, revision: published2.revision, pages: published2.pages.length, sourceArchive: published2.sourceArchive, localTemplateFilesRemoved: archive.files.length }));
+    process.exit(0);
+  }
+  const activeRelease = initial.catalog.release || initial.catalog.entries.map((e) => e.theme.release).sort((a, b) => releaseRank(b) - releaseRank(a))[0];
+  if (releaseRank(entry.theme.release) <= releaseRank(activeRelease)) throw Error("New and revised templates require a release newer than the active catalog");
+  const assets = draft.assets || [];
+  await pool(assets, async (a) => {
+    const file = confined(root, a.localFile), bytes2 = readFileSync(file);
+    if (sha(bytes2) !== a.sha256 || bytes2.length !== a.bytes) throw Error("Asset integrity failure " + a.id);
+    const key = `templates/assets/${a.sha256}/${a.file}`;
+    await putVerified(key, bytes2, a.mime);
+    a.url = origin + "/" + key;
+    if (a.licenseFile) {
+      const license = readFileSync(confined(root, a.licenseLocalFile));
+      if (sha(license) !== a.licenseHash) throw Error("Font license integrity failure");
+      const key2 = `templates/objects/${sha(license)}/${a.licenseFile}`;
+      await putVerified(key2, license, "text/plain");
+      a.licenseUrl = origin + "/" + key2;
+    }
+  });
+  const sourceFiles = [];
+  async function preserve(dir) {
+    for (const f of readdirSync(dir, { withFileTypes: true })) {
+      const file = join(dir, f.name), s = lstatSync(file);
+      if (s.isSymbolicLink()) throw Error("Template staging directories must not contain junctions or symlinks");
+      if (s.isDirectory()) await preserve(file);
+      else {
+        const bytes2 = readFileSync(file), name = relative(root, file).replaceAll("\\", "/"), key = `templates/archives/${sha(bytes2)}/${name}`;
+        await putVerified(key, bytes2, "application/octet-stream");
+        sourceFiles.push({ path: name, key, sha256: sha(bytes2), bytes: bytes2.length });
+      }
+    }
+  }
+  await preserve(root);
+  const pages = [];
+  for (const p of entry.pages) {
+    const input = draft.recipes[p.pageId];
+    if (!input) throw Error("Missing recipe " + p.pageId);
+    const value = json(confined(root, input));
+    if (!value.original || !value.brand || value.original.includes("/theme-assets/") || value.brand.includes("/theme-assets/")) throw Error("Recipe must have complete original and brand documents with Cloudflare assets");
+    const bytes2 = Buffer.from(JSON.stringify(value)), recipe = sha(bytes2);
+    await putVerified(`templates/objects/${recipe}/recipe.json`, bytes2, "application/json");
+    pages.push({ ...p, recipe });
+  }
+  const revision = sha(JSON.stringify({ theme: entry.theme, pages })), manifest = { version: 1, id: entry.theme.id, release: entry.theme.release, revision, name: entry.theme.name, business: entry.business, pages, tokens: entry.theme.tokens };
+  await putVerified(`templates/manifests/${revision}.json`, Buffer.from(JSON.stringify(manifest)), "application/json");
+  const sources = Buffer.from(JSON.stringify({ version: 1, files: sourceFiles })), sourceManifest = `templates/archives/${sha(sources)}/manifest.json`;
+  await putVerified(sourceManifest, sources, "application/json");
+  const published = { ...entry, pages, revision, base: origin, sourceArchive: sourceManifest, sourceHash: themeHash(entry.theme), thumbnails: {} };
+  await verifyEntry(published);
+  const { chromium } = await import("playwright");
+  const browser = await chromium.launch();
+  try {
+    for (const viewport of [{ width: 1440, height: 900 }, { width: 390, height: 844 }]) for (const featured of pages.filter((p) => p.featured).slice(0, 5)) {
+      const page = await browser.newPage({ viewport, reducedMotion: "reduce" });
+      let broken = false;
+      page.on("requestfailed", () => broken = true);
+      const r = await page.goto(origin + `/templates/demo/${revision}/${entry.theme.id}` + featured.path, { waitUntil: "networkidle" });
+      await page.evaluate("document.fonts.ready");
+      await page.evaluate('Promise.all(Array.from(document.images,i=>{i.loading="eager";return i.decode().catch(()=>null)}))');
+      const bad = await page.evaluate('Array.from(document.images).filter(i=>i.getAttribute("src")&&(!i.complete||!i.naturalWidth)).length');
+      if (!r?.ok() || broken || bad) throw Error("Hosted browser verification failed");
+      const bytes2 = await page.screenshot({ type: "jpeg", quality: 76 }), key = `templates/objects/${sha(bytes2)}/thumbnail.jpg`;
+      await putVerified(key, bytes2, "image/jpeg");
+      published.thumbnails[featured.pageId] ??= {};
+      published.thumbnails[featured.pageId][viewport.width === 1440 ? "desktop" : "mobile"] = origin + "/" + key;
+      await page.close();
+    }
+  } finally {
+    await browser.close();
+  }
+  const latest = await remoteCatalog();
+  if (latest.etag !== initial.etag) throw Error("Catalog changed during publication; retry to merge the latest entries");
+  const previous = latest.catalog.entries.find((e) => e.theme.id === entry.theme.id);
+  if (previous && previous.theme.release === entry.theme.release && previous.revision !== revision) throw Error("Revisions need a new release; the prior release remains immutable");
+  const catalog = { ...latest.catalog, release: entry.theme.release, history: [...latest.catalog.history || [], ...previous && previous.revision !== revision ? [previous] : []], entries: [...latest.catalog.entries.filter((e) => e.theme.id !== entry.theme.id), published], assets: [...latest.catalog.assets.filter((a) => !assets.some((b) => b.id === a.id)), ...assets.map(({ localFile, licenseLocalFile, ...a }) => a)] };
+  const bytes = Buffer.from(JSON.stringify(catalog)), saved = await r2Request("PUT", "templates/catalog.json", bytes, "application/json", { "if-match": latest.etag });
+  if (!saved.ok) throw Error("Catalog changed or publication failed: " + saved.status);
+  const check = await remoteCatalog();
+  if (sha(JSON.stringify(check.catalog)) !== sha(bytes)) throw Error("Published catalog verification failed");
+  await syncLocalCatalog(catalog);
+  for (const f of sourceFiles) {
+    const file = confined(root, f.path);
+    if (sha(readFileSync(file)) !== f.sha256) throw Error("Staging changed after publication; retain it for review");
+  }
+  for (const f of sourceFiles) unlinkSync(confined(root, f.path));
+  console.log(JSON.stringify({ published: entry.theme.id, revision, pages: pages.length, sourceArchive: sourceManifest, localTemplateFilesRemoved: sourceFiles.length }));
+} else if (command === "verify") {
+  const { catalog } = await remoteCatalog(), id = argv.includes("--id") ? arg("--id") : void 0, entries = catalog.entries.filter((e) => !id || e.theme.id === id);
+  if (!entries.length) throw Error("Unknown hosted template");
+  for (const entry of entries) {
+    await verifyEntry(entry);
+    console.log(JSON.stringify({ verified: entry.theme.id, pages: entry.pages.length }));
+  }
+} else if (command === "restore-source") {
+  const { catalog } = await remoteCatalog(), entry = catalog.entries.find((e) => e.theme.id === arg("--id")), out = argv.includes("--out") ? arg("--out") : void 0;
+  if (!entry?.sourceArchive || !out || existsSync(resolve(out))) throw Error("Use --id ID --out NEW_TRANSIENT_DIRECTORY");
+  const r = await r2Request("GET", entry.sourceArchive);
+  if (!r.ok) throw Error("Source archive unavailable");
+  const manifest = await r.json(), root = resolve(out);
+  if (manifest.parts) throw Error("Legacy multipart source recovery requires the private maintainer archive tooling");
+  mkdirSync(root, { recursive: true });
+  for (const f of manifest.files) {
+    const file = resolve(root, f.path);
+    if (!file.startsWith(root + sep) || f.path.includes("..")) throw Error("Unsafe source archive path");
+    const r2 = await r2Request("GET", f.key);
+    if (!r2.ok) throw Error("Source object unavailable");
+    const bytes = new Uint8Array(await r2.arrayBuffer());
+    if (sha(bytes) !== f.sha256) throw Error("Source integrity failure");
+    mkdirSync(dirname(file), { recursive: true });
+    writeFileSync(file, bytes);
+  }
+  console.log("Restored into transient staging: " + root);
+} else console.log("templates gallery [--port 4390]\ntemplates publish --bundle ABSOLUTE_TRANSIENT_DIRECTORY\ntemplates verify [--id TEMPLATE_ID]\ntemplates restore-source --id TEMPLATE_ID --out NEW_TRANSIENT_DIRECTORY");
+export {
+  verifyEntry
+};