@warpgogol/werkstatt-shared 0.14.0 → 0.15.0

package/src/surface/blueprint.ts

@@ -12,11 +12,14 @@
 </non-goals>
 </MODULE_CONTRACT>
 <CHANGE_SUMMARY>
-  <item>RFC-0192: Blueprint type + entry assembly (no block baking yet).</item>
   <item>RFC-0199: resolveSlug/routesFor/assembleEntries/generateEntries take a LocalizedUniverse so URL segments localize per language while identity stays on the neutral tuple.</item>
   <item>RFC-0496: add BlueprintServiceConfig + ServicePublicationGate for website-service depth-1 service dossier configuration; add BlueprintLinkingParent for cross-surface parent linking.</item>
   <item>RFC-0497: add BlueprintIntersectionConfig + IntersectionGate + IntersectionSimilarity for website-local depth-5 intersection gate configuration.</item>
   <item>RFC-0500: add BlueprintHubConfig for depth-0 editorial knowledge hub configuration; add BlueprintStatusGate for record status filtering.</item>
+  <item>RFC-1106: step 5 — merge blueprint triplet
+
+surface/blueprint.ts now holds the blueprintSchema (sole declaration), all ~30 contract type names derived via z.infer, parseBlueprint, and the pure helpers. Deleted satellites blueprint-types.ts + blueprint-schema.ts, their package.json export entries, and the zero-consumer site shims (domain/surface/blueprint{,-types,-schema}.ts + 2 load-verification tests). All barrel consumers unchanged.</item>
+  <history>RFC-0192</history>
 </CHANGE_SUMMARY>
 */
 
@@ -38,71 +41,344 @@ import type {
   VirtualRouteEntry,
 } from "./types.ts";
 
-import type {
-  LocalizedString,
-  BlueprintAxis,
-  GeoDepth,
-  BlueprintLevelArticle,
-  BlueprintPillarHero,
-  BlueprintPillarAdaptationDimension,
-  BlueprintPillarAdaptation,
-  BlueprintPillarProductPrice,
-  BlueprintPillarFinalCta,
-  BlueprintPillar,
-  ServicePublicationGate,
-  BlueprintServiceConfig,
-  BlueprintLinkingParent,
-  IndustryPublicationGate,
-  BlueprintDossier,
-  IntersectionGate,
-  IntersectionSimilarity,
-  BlueprintIntersectionConfig,
-  BlueprintHubConfig,
-  BlueprintStatusGate,
-  BlueprintLevel,
-  BlueprintLinking,
-  BlueprintProjection,
-  EnrichedFieldSpec,
-  BlueprintDuplicatePolicy,
-  BlueprintEvidenceDepthPolicy,
-  BlueprintDemandDepthPolicy,
-  BlueprintDepthRolePolicy,
-  BlueprintPolicy,
-  Blueprint,
-} from "./blueprint-types.ts";
-
-export type {
-  LocalizedString,
-  BlueprintAxis,
-  GeoDepth,
-  BlueprintLevelArticle,
-  BlueprintPillarHero,
-  BlueprintPillarAdaptationDimension,
-  BlueprintPillarAdaptation,
-  BlueprintPillarProductPrice,
-  BlueprintPillarFinalCta,
-  BlueprintPillar,
-  ServicePublicationGate,
-  BlueprintServiceConfig,
-  BlueprintLinkingParent,
-  IndustryPublicationGate,
-  BlueprintDossier,
-  IntersectionGate,
-  IntersectionSimilarity,
-  BlueprintIntersectionConfig,
-  BlueprintHubConfig,
-  BlueprintStatusGate,
-  BlueprintLevel,
-  BlueprintLinking,
-  BlueprintProjection,
-  EnrichedFieldSpec,
-  BlueprintDuplicatePolicy,
-  BlueprintEvidenceDepthPolicy,
-  BlueprintDemandDepthPolicy,
-  BlueprintDepthRolePolicy,
-  BlueprintPolicy,
-  Blueprint,
-};
+import { z } from "zod";
+
+// ---------------------------------------------------------------------------
+// Blueprint schema — RFC-1106: the sole declaration of the Blueprint contract.
+// All Blueprint types below derive from blueprintSchema via z.infer; the former
+// blueprint-types.ts / blueprint-schema.ts satellites are merged here.
+// ---------------------------------------------------------------------------
+
+const localizedString = z.record(z.string(), z.string());
+
+const intRecord = z.record(z.string(), z.number().int());
+
+// RFC-0490: pillar-hub configuration for depth-0 hub pages.
+const pillarCtaSchema = z.object({
+  label: localizedString,
+  target: z.string().min(1),
+});
+
+const pillarHeroSchema = z.object({
+  eyebrow: localizedString,
+  heading: localizedString,
+  lead: localizedString,
+  primaryCta: pillarCtaSchema,
+  secondaryCta: pillarCtaSchema,
+});
+
+const pillarAdaptationDimensionSchema = z.object({
+  heading: localizedString,
+  body: localizedString,
+});
+
+const pillarAdaptationSchema = z.object({
+  heading: localizedString,
+  dimensions: z.array(pillarAdaptationDimensionSchema).min(1),
+});
+
+const pillarProductPriceSchema = z.object({
+  heading: localizedString,
+  body: localizedString,
+  priceRef: z.string().min(1).optional(),
+});
+
+const pillarFinalCtaSchema = z.object({
+  heading: localizedString,
+  body: localizedString,
+  primaryCta: pillarCtaSchema,
+  secondaryCta: pillarCtaSchema,
+});
+
+const pillarSchema = z.object({
+  hero: pillarHeroSchema,
+  adaptation: pillarAdaptationSchema,
+  productPrice: pillarProductPriceSchema,
+  finalCta: pillarFinalCtaSchema,
+  catalogHeading: localizedString.optional(),
+});
+
+// RFC-0492: dossier configuration for depth-1 industry pages.
+const industryPublicationGateSchema = z.object({
+  minServiceCategories: z.number().int().min(0),
+  minCustomerJourneys: z.number().int().min(0),
+  minTrustSignals: z.number().int().min(0),
+  minArchitectureEntries: z.number().int().min(0),
+  minModuleMappings: z.number().int().min(0),
+  minUniqueFaq: z.number().int().min(0),
+});
+
+const dossierSchema = z.object({
+  gate: industryPublicationGateSchema,
+  claimRestrictions: z.array(z.string().min(1)),
+  doorwayMaxFlaggedShare: z.number().min(0).max(1),
+  duplicateMaxSimilarity: z.number().min(0).max(1),
+  mode: z.enum(["warn", "fail"]),
+});
+
+// RFC-0496: service configuration for depth-1 service dossier pages.
+const servicePublicationGateSchema = z.object({
+  minServiceVariants: z.number().int().min(0),
+  minCustomerQuestions: z.number().int().min(0),
+  minPriceModels: z.number().int().min(0),
+  minFaq: z.number().int().min(0),
+  minPageStructure: z.number().int().min(0),
+});
+
+const serviceSchema = z.object({
+  gate: servicePublicationGateSchema,
+  claimRestrictions: z.array(z.string().min(1)),
+  mode: z.enum(["warn", "fail"]),
+});
+
+const intersectionGateSchema = z.object({
+  minLocalServiceQuestions: z.number().int().min(0),
+  minScenarios: z.number().int().min(0),
+  minLocalEvidence: z.number().int().min(0),
+  minUniqueContentBlocks: z.number().int().min(0),
+  minUniqueFaq: z.number().int().min(0),
+  minSources: z.number().int().min(0),
+});
+
+const intersectionSimilaritySchema = z.object({
+  similarityToIndustryPage: z.number().min(0).max(1),
+  similarityToCityPage: z.number().min(0).max(1),
+  similarityToServicePage: z.number().min(0).max(1),
+  similarityToOtherIntersections: z.number().min(0).max(1),
+});
+
+const intersectionSchema = z.object({
+  gate: intersectionGateSchema,
+  similarity: intersectionSimilaritySchema,
+  substanceIndependenceThreshold: z.number().min(0).max(1),
+  mode: z.enum(["warn", "fail"]),
+});
+
+// RFC-0500: hub configuration for depth-0 editorial knowledge hubs (ratgeber).
+const hubSchema = z.object({
+  cardFields: z.array(z.string().min(1)).min(1),
+  reservedSlugs: z.array(z.string().min(1)),
+});
+
+// RFC-0500: status gate — only records with allowed statuses are emitted as surface entries.
+const statusGateSchema = z.object({
+  allowedStatuses: z.array(z.string().min(1)),
+  excludedStatuses: z.array(z.string().min(1)),
+});
+
+// RFC-0496: cross-surface parent linking.
+const linkingParentSchema = z.object({
+  surface: z.string().min(1),
+  depth: z.number().int().min(0),
+  joinField: z.string().min(1),
+});
+
+// RFC-0325: static article metadata for a level with no per-record binding (depth-0 hubs).
+const blueprintLevelArticleSchema = z.object({
+  publishedAt: z.string().min(1),
+  updatedAt: z.string().min(1).optional(),
+  author: z.string().min(1).optional(),
+  tags: z.array(z.string().min(1)).optional(),
+});
+
+const evidencePolicySchema = z.object({
+  approvedNarrative: z.enum(["required", "optional"]).optional(),
+  requiredRecordFields: z.array(z.string().min(1)).optional(),
+  preferredEvidenceSources: z.array(z.string().min(1)).optional(),
+  minTupleSpecificFacts: z.number().int().min(0).optional(),
+  minWerkEvidence: z.number().int().min(0).optional(),
+  existenceSource: z.enum(["records", "works"]).optional(),
+  freshness: z.enum(["valid-and-current", "valid"]).optional(),
+  duplicate: z
+    .object({
+      method: z.enum(["shingle", "simhash"]).optional(),
+      maxSimilarityWithinCluster: z.number().min(0).max(1).optional(),
+    })
+    .optional(),
+  leadImage: z.enum(["required", "warning", "optional"]).optional(),
+  mode: z.enum(["error", "warning"]).optional(),
+});
+
+const demandPolicySchema = z.object({
+  minVolume: z.number().min(0).optional(),
+  allowIntents: z
+    .array(z.enum(["informational", "commercial", "transactional", "navigational"]))
+    .optional(),
+  missing: z.enum(["noindex", "do-not-emit"]).optional(),
+  staleAfterDays: z.number().int().min(0).optional(),
+});
+
+const depthRolePolicySchema = z.object({
+  indexability: z.enum(["index", "navigation-noindex", "evidence-gated"]),
+  canonicalTarget: z.union([z.literal("tradeHub"), z.number().int().min(0)]).optional(),
+  follow: z.boolean().optional(),
+  includeInSitemap: z.boolean().optional(),
+  geo: z.enum(["full", "twin-only", "off"]).optional(),
+  localEvidence: z
+    .object({
+      minVerifiedFacts: z.number().int().min(0).optional(),
+      minCitySpecificQa: z.number().int().min(0).optional(),
+      minUniqueTokenShare: z.number().min(0).max(1).optional(),
+      maxBodySimilarityWithinBranch: z.number().min(0).max(1).optional(),
+    })
+    .optional(),
+});
+
+export const blueprintSchema = z.object({
+  id: z.string().min(1),
+  entitlement: z.string().min(1),
+  dataset: z.object({ collection: z.string().min(1), status: z.string().optional() }),
+  axes: z
+    .array(
+      z.object({
+        id: z.string().min(1),
+        universe: z.union([
+          z.object({ collection: z.string().min(1), field: z.string().min(1) }),
+          z.object({ provider: z.string().min(1) }),
+        ]),
+        match: z.object({ recordField: z.string().min(1) }),
+      }),
+    )
+    .min(1),
+  levels: z
+    .array(
+      z.object({
+        depth: z.number().int().min(0),
+        slug: localizedString,
+        redirectToPageId: z.string().min(1).optional(),
+        constellation: z.string().min(1),
+        geo: z.enum(["full", "twin-only", "off"]).optional(),
+        titleTemplate: localizedString.optional(),
+        descriptionTemplate: localizedString.optional(),
+        intro: localizedString.optional(),
+        semanticType: z.string().min(1).optional(),
+        article: blueprintLevelArticleSchema.optional(),
+        pillar: pillarSchema.optional(),
+        dossier: dossierSchema.optional(),
+        service: serviceSchema.optional(),
+        intersection: intersectionSchema.optional(),
+        hub: hubSchema.optional(),
+      }),
+    )
+    .min(1),
+  policy: z.object({
+    minRecordsPerDepth: intRecord,
+    noindexBelowPerDepth: intRecord.optional(),
+    redirectPolicy: z.enum(["nearest-ancestor", "root"]).optional(),
+    trailingSlash: z.boolean().optional(),
+    maxStubDepth: z.number().int().optional(),
+    substanceMin: z.number().min(0).max(100).optional(),
+    substanceMinPerDepth: intRecord.optional(),
+    evidencePerDepth: z.record(z.string(), evidencePolicySchema).optional(),
+    demandPerDepth: z.record(z.string(), demandPolicySchema).optional(),
+    depthRoles: z.record(z.string(), depthRolePolicySchema).optional(),
+    sitemapBudget: z.number().int().min(0).optional(),
+    maxThinShare: z.number().min(0).max(1).optional(),
+    regionalGateDepths: z.array(z.number().int().min(0)).optional(),
+    bake: z.enum(["inline", "lazy"]).optional(),
+    statusGate: statusGateSchema.optional(),
+  }),
+  linking: z
+    .object({
+      children: z.object({ limit: z.number().int() }).optional(),
+      siblings: z.object({ limit: z.number().int() }).optional(),
+      teasers: z
+        .object({
+          relevance: z.array(z.object({ sharedAxis: z.string(), weight: z.number() })).optional(),
+        })
+        .optional(),
+      parent: linkingParentSchema.optional(),
+    })
+    .optional(),
+  rotation: z.object({ variantsByTupleHash: z.boolean() }).optional(),
+  projection: z
+    .object({
+      title: localizedString.optional(),
+      description: z.union([localizedString, z.object({ ref: z.string() })]).optional(),
+    })
+    .optional(),
+  freshness: z
+    .object({
+      slaDaysPerDepth: intRecord,
+      field: z.string().min(1),
+      mode: z.enum(["any", "all", "median"]).optional(),
+    })
+    .optional(),
+  enrichedFields: z
+    .array(
+      z.object({
+        field: z.string().min(1),
+        promptId: z.string().min(1),
+        scopeDepth: z.number().int(),
+        maxTokens: z.number().int(),
+        // RFC-0207: output shape + generation granularity (both default to the original behavior).
+        kind: z.enum(["field", "narrative"]).optional(),
+        scope: z.enum(["tuple", "record"]).optional(),
+        axis: z.string().min(1).optional(),
+      }),
+    )
+    .optional(),
+});
+
+// ---------------------------------------------------------------------------
+// Derived contract types — every name the deleted blueprint-types.ts exported,
+// now inferred from the schema above.
+// ---------------------------------------------------------------------------
+
+/** A localized string map: lang → value. */
+export type LocalizedString = z.infer<typeof localizedString>;
+
+export type Blueprint = z.infer<typeof blueprintSchema>;
+export type BlueprintAxis = Blueprint["axes"][number];
+export type BlueprintLevel = Blueprint["levels"][number];
+export type BlueprintPolicy = Blueprint["policy"];
+export type BlueprintLinking = NonNullable<Blueprint["linking"]>;
+export type BlueprintProjection = NonNullable<Blueprint["projection"]>;
+export type EnrichedFieldSpec = NonNullable<Blueprint["enrichedFields"]>[number];
+
+export type GeoDepth = NonNullable<BlueprintLevel["geo"]>;
+export type BlueprintLevelArticle = NonNullable<BlueprintLevel["article"]>;
+export type BlueprintPillar = NonNullable<BlueprintLevel["pillar"]>;
+export type BlueprintPillarHero = BlueprintPillar["hero"];
+export type BlueprintPillarAdaptation = BlueprintPillar["adaptation"];
+export type BlueprintPillarAdaptationDimension = BlueprintPillarAdaptation["dimensions"][number];
+export type BlueprintPillarProductPrice = BlueprintPillar["productPrice"];
+export type BlueprintPillarFinalCta = BlueprintPillar["finalCta"];
+export type BlueprintDossier = NonNullable<BlueprintLevel["dossier"]>;
+export type IndustryPublicationGate = BlueprintDossier["gate"];
+export type BlueprintServiceConfig = NonNullable<BlueprintLevel["service"]>;
+export type ServicePublicationGate = BlueprintServiceConfig["gate"];
+export type BlueprintIntersectionConfig = NonNullable<BlueprintLevel["intersection"]>;
+export type IntersectionGate = BlueprintIntersectionConfig["gate"];
+export type IntersectionSimilarity = BlueprintIntersectionConfig["similarity"];
+export type BlueprintHubConfig = NonNullable<BlueprintLevel["hub"]>;
+
+export type BlueprintStatusGate = NonNullable<BlueprintPolicy["statusGate"]>;
+export type BlueprintLinkingParent = NonNullable<BlueprintLinking["parent"]>;
+export type BlueprintEvidenceDepthPolicy = NonNullable<BlueprintPolicy["evidencePerDepth"]>[string];
+export type BlueprintDemandDepthPolicy = NonNullable<BlueprintPolicy["demandPerDepth"]>[string];
+export type BlueprintDepthRolePolicy = NonNullable<BlueprintPolicy["depthRoles"]>[string];
+export type BlueprintDuplicatePolicy = NonNullable<BlueprintEvidenceDepthPolicy["duplicate"]>;
+
+export interface ParseBlueprintResult {
+  ok: boolean;
+  blueprint?: Blueprint;
+  errors: string[];
+}
+
+/** Validate an unknown value (parsed YAML) into a typed Blueprint. */
+export function parseBlueprint(value: unknown): ParseBlueprintResult {
+  const result = blueprintSchema.safeParse(value);
+  if (result.success) {
+    return { ok: true, blueprint: result.data, errors: [] };
+  }
+  return {
+    ok: false,
+    errors: result.error.issues.map(
+      (issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`,
+    ),
+  };
+}
 
 const DEFAULT_SEGMENT_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;
 

package/src/surface/decision-composer.ts

@@ -13,7 +13,12 @@
 </non-goals>
 </MODULE_CONTRACT>
 <CHANGE_SUMMARY>
-  <item>Architecture review 2026-07-10: initial implementation of composeIndexDecision and pure gate functions.</item>
+  <item>RFC-1097: step 6 — compass.migrate codemod run
+
+Mechanical v1 to v2 header migration across the workspace: 942 files rewritten — CHANGE_SUMMARY windows collapsed into history, forbidden v1 blocks stripped, KEY_DECISIONS seeded from @ai-invariant comments (5 files) or TODO placeholders (103 files), blocks reordered to canonical order.</item>
+  <item>RFC-1097: sweep — werkstatt-engine clean
+
+Sweep batch 4: 73 Compass headers on headerless engine files (certification, component-runtime, isolation, evolution, testing), real KEY_DECISIONS on 75 files (kernel, cache, dht, swim, gitmesh, runtime), ~80 purpose expansions (CONTRACT-02/PURPOSE-02), non-goals on 13 CONTRACT-03 files, CS-07 history literal fix repo-wide (253 files). Policy: .template.ts/.template.astro excludedPaths. werkstatt-engine now 0 diagnostics.</item>
 </CHANGE_SUMMARY>
 */
 

package/src/surface/geo.ts

@@ -12,7 +12,12 @@
 </MODULE_CONTRACT>
 <CHANGE_SUMMARY>
   <item>RFC-0195: initial GEO projection.</item>
-  <item>Architecture review 2026-07-10: extract blockTwinRegistry so each block type has a registered twin renderer instead of pattern-matching on prop shapes in renderTwin.</item>
+  <item>RFC-1097: step 6 — compass.migrate codemod run
+
+Mechanical v1 to v2 header migration across the workspace: 942 files rewritten — CHANGE_SUMMARY windows collapsed into history, forbidden v1 blocks stripped, KEY_DECISIONS seeded from @ai-invariant comments (5 files) or TODO placeholders (103 files), blocks reordered to canonical order.</item>
+  <item>RFC-1097: sweep — werkstatt-engine clean
+
+Sweep batch 4: 73 Compass headers on headerless engine files (certification, component-runtime, isolation, evolution, testing), real KEY_DECISIONS on 75 files (kernel, cache, dht, swim, gitmesh, runtime), ~80 purpose expansions (CONTRACT-02/PURPOSE-02), non-goals on 13 CONTRACT-03 files, CS-07 history literal fix repo-wide (253 files). Policy: .template.ts/.template.astro excludedPaths. werkstatt-engine now 0 diagnostics.</item>
 </CHANGE_SUMMARY>
 */
 

package/src/surface/index.ts

@@ -6,14 +6,18 @@
 </non-goals>
 </MODULE_CONTRACT>
 <CHANGE_SUMMARY>
-  <item>RFC-0192: initial barrel.</item>
-  <item>RFC-0271: export SurfaceModuleContext schema, type, and ownership helpers.</item>
-  <item>RFC-0276: export Bordbuch event/status schemas and types.</item>
-  <item>RFC-0280/RFC-0281: export DemandSignal and WerkRecord schemas.</item>
-  <item>RFC-0278/RFC-0279/RFC-0285: export governance schemas and types.</item>
-  <item>RFC-0282/RFC-0283: export visibility and breaker schemas.</item>
   <item>RFC-0284: export fleet Leitstand schemas and types.</item>
   <item>RFC-0264 cleanup: root barrel delegates governance exports to the governance subpath.</item>
+  <item>RFC-1097: step 6 — compass.migrate codemod run
+
+Mechanical v1 to v2 header migration across the workspace: 942 files rewritten — CHANGE_SUMMARY windows collapsed into history, forbidden v1 blocks stripped, KEY_DECISIONS seeded from @ai-invariant comments (5 files) or TODO placeholders (103 files), blocks reordered to canonical order.</item>
+  <item>RFC-1097: sweep — tail packages clean
+
+Sweep batch 3: rewrote ~95 purposes across werkstatt-knowledge, werkstatt-shared, godot-game, phaser-game, lifecycle-core, projektarchiv-*, portal-*, billing-*, typescript (CONTRACT-02/PURPOSE-02). Real KEY_DECISIONS on 5 godot utils, non-goals on 5 CONTRACT-03 files, headers on 4 headerless files, CS-07 history literal fix on 2 files. Policy: vitest.config.ts + test-fixtures testPatterns, worker-configuration.d.ts excludedPath. All non-site/engine packages now 0 diagnostics.</item>
+  <item>RFC-1106: step 5 — merge blueprint triplet
+
+surface/blueprint.ts now holds the blueprintSchema (sole declaration), all ~30 contract type names derived via z.infer, parseBlueprint, and the pure helpers. Deleted satellites blueprint-types.ts + blueprint-schema.ts, their package.json export entries, and the zero-consumer site shims (domain/surface/blueprint{,-types,-schema}.ts + 2 load-verification tests). All barrel consumers unchanged.</item>
+  <history>RFC-0192, RFC-0271, RFC-0276, RFC-0278, RFC-0280, RFC-0282</history>
 </CHANGE_SUMMARY>
 */
 
@@ -87,7 +91,7 @@ export {
   type LocalizedString,
 } from "./blueprint.ts";
 
-export { blueprintSchema, parseBlueprint, type ParseBlueprintResult } from "./blueprint-schema.ts";
+export { blueprintSchema, parseBlueprint, type ParseBlueprintResult } from "./blueprint.ts";
 
 // Governance and operational schema bags (RFC-0271..0285) — explicit re-exports.
 export type {

package/src/surface/types.ts

@@ -46,7 +46,7 @@ export interface SurfaceRecordImage {
 }
 
 /**
- * RFC-0192: a block in a baked page. Structurally compatible with `@warpgogol/werkstatt-shared/share` `BlockEntry`, but
+ * RFC-0192: a block in a baked page. Structurally compatible with `@warpgogol/werkstatt-shared/page` `BlockEntry`, but
  * declared here so `@warpgogol/werkstatt-shared/surface` stays the lower-level package with no dependency on share
  * (avoids a workspace cycle — share consumes surface's route types).
  */
@@ -60,7 +60,7 @@ export interface SurfaceBlock {
   layer?: "shell" | "section";
 }
 
-/** RFC-0192: a baked block-declarative page. Structurally compatible with `@warpgogol/werkstatt-shared/share` `PageEntry`. */
+/** RFC-0192: a baked block-declarative page. Structurally compatible with `@warpgogol/werkstatt-shared/page` `PageEntry`. */
 export interface PageEntry {
   kind: "page";
   cosmicStar: string;

package/src/surface/vitest.config.ts

@@ -3,6 +3,7 @@ import { defineConfig } from "vitest/config";
 export default defineConfig({
   test: {
     environment: "node",
+    testTimeout: 30_000,
     include: ["src/**/*.test.ts"],
   },
 });

package/src/tests/signing-core.test.ts

@@ -0,0 +1,129 @@
+/*
+<MODULE_CONTRACT>
+<purpose>RFC-0921: Unit tests for the shared signing core — sign/verify round-trip, key generation, canonicalization.</purpose>
+</MODULE_CONTRACT>
+<CHANGE_SUMMARY>
+  <item>RFC-0921: initial signing core unit tests.</item>
+</CHANGE_SUMMARY>
+*/
+
+import { describe, it, expect } from "vitest";
+import {
+  generateKeyPair,
+  toHex,
+  fromHex,
+  toPem,
+  fromPem,
+  canonicalBytes,
+  signBytes,
+  verifyBytes,
+  sign,
+  verify,
+} from "../signing/index.ts";
+
+describe("signing core — key generation", () => {
+  it("generates a valid Ed25519 keypair (32-byte private + 32-byte public)", async () => {
+    const keyPair = await generateKeyPair();
+    expect(keyPair.privateKey).toBeInstanceOf(Uint8Array);
+    expect(keyPair.publicKey).toBeInstanceOf(Uint8Array);
+    expect(keyPair.privateKey.length).toBe(32);
+    expect(keyPair.publicKey.length).toBe(32);
+  });
+
+  it("generates unique keypairs on each call", async () => {
+    const a = await generateKeyPair();
+    const b = await generateKeyPair();
+    expect(toHex(a.privateKey)).not.toBe(toHex(b.privateKey));
+    expect(toHex(a.publicKey)).not.toBe(toHex(b.publicKey));
+  });
+});
+
+describe("signing core — encoding helpers", () => {
+  it("toHex / fromHex round-trip", () => {
+    const bytes = new Uint8Array([0, 1, 2, 255, 128, 64]);
+    const hex = toHex(bytes);
+    expect(hex).toBe("000102ff8040");
+    expect(fromHex(hex)).toEqual(bytes);
+  });
+
+  it("toPem / fromPem round-trip for private key", () => {
+    const bytes = new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8]);
+    const pem = toPem(bytes, "private");
+    expect(pem).toContain("-----BEGIN" + " PRIVATE KEY-----");
+    expect(pem).toContain("-----END" + " PRIVATE KEY-----");
+    expect(fromPem(pem)).toEqual(bytes);
+  });
+
+  it("toPem / fromPem round-trip for public key", () => {
+    const bytes = new Uint8Array([10, 20, 30, 40, 50, 60, 70, 80]);
+    const pem = toPem(bytes, "public");
+    expect(pem).toContain("-----BEGIN" + " PUBLIC KEY-----");
+    expect(pem).toContain("-----END" + " PUBLIC KEY-----");
+    expect(fromPem(pem)).toEqual(bytes);
+  });
+});
+
+describe("signing core — sign/verify", () => {
+  it("sign and verify round-trip with payload", async () => {
+    const keyPair = await generateKeyPair();
+    const payload = { buildId: "test-123", signedAt: "2026-08-22T00:00:00Z", outputsDigest: "abc" };
+    const signature = await sign(keyPair.privateKey, payload);
+    expect(signature).toBeInstanceOf(Uint8Array);
+    expect(signature.length).toBe(64);
+
+    const valid = await verify(keyPair.publicKey, payload, signature);
+    expect(valid).toBe(true);
+  });
+
+  it("verification fails with tampered payload", async () => {
+    const keyPair = await generateKeyPair();
+    const payload = { buildId: "test-123", signedAt: "2026-08-22" };
+    const signature = await sign(keyPair.privateKey, payload);
+
+    const tampered = { buildId: "tampered", signedAt: "2026-08-22" };
+    const valid = await verify(keyPair.publicKey, tampered, signature);
+    expect(valid).toBe(false);
+  });
+
+  it("verification fails with wrong public key", async () => {
+    const keyPairA = await generateKeyPair();
+    const keyPairB = await generateKeyPair();
+    const payload = { test: "data" };
+    const signature = await sign(keyPairA.privateKey, payload);
+
+    const valid = await verify(keyPairB.publicKey, payload, signature);
+    expect(valid).toBe(false);
+  });
+
+  it("signBytes / verifyBytes round-trip with raw message", async () => {
+    const keyPair = await generateKeyPair();
+    const message = new TextEncoder().encode("hello world");
+    const signature = await signBytes(keyPair.privateKey, message);
+    expect(signature.length).toBe(64);
+
+    const valid = await verifyBytes(keyPair.publicKey, message, signature);
+    expect(valid).toBe(true);
+  });
+
+  it("verifyBytes returns false on invalid signature (not throw)", async () => {
+    const keyPair = await generateKeyPair();
+    const message = new TextEncoder().encode("test");
+    const badSignature = new Uint8Array(64);
+    const valid = await verifyBytes(keyPair.publicKey, message, badSignature);
+    expect(valid).toBe(false);
+  });
+});
+
+describe("signing core — canonicalBytes", () => {
+  it("produces deterministic bytes regardless of key order", () => {
+    const a = canonicalBytes({ b: 2, a: 1, c: 3 });
+    const b = canonicalBytes({ a: 1, c: 3, b: 2 });
+    expect(a).toEqual(b);
+  });
+
+  it("produces different bytes for different payloads", () => {
+    const a = canonicalBytes({ a: 1 });
+    const b = canonicalBytes({ a: 2 });
+    expect(a).not.toEqual(b);
+  });
+});

package/src/{share → text}/css-value-normalize.ts

@@ -13,7 +13,12 @@ disagree on equality.
 </non-goals>
 </MODULE_CONTRACT>
 <CHANGE_SUMMARY>
-  <item>Initial: unified normalizeCssValue from site-kernel-codegen and site-kernel-checks.</item>
+  <item>RFC-1097: step 6 — compass.migrate codemod run
+
+Mechanical v1 to v2 header migration across the workspace: 942 files rewritten — CHANGE_SUMMARY windows collapsed into history, forbidden v1 blocks stripped, KEY_DECISIONS seeded from @ai-invariant comments (5 files) or TODO placeholders (103 files), blocks reordered to canonical order.</item>
+  <item>RFC-1097: sweep — werkstatt-engine clean
+
+Sweep batch 4: 73 Compass headers on headerless engine files (certification, component-runtime, isolation, evolution, testing), real KEY_DECISIONS on 75 files (kernel, cache, dht, swim, gitmesh, runtime), ~80 purpose expansions (CONTRACT-02/PURPOSE-02), non-goals on 13 CONTRACT-03 files, CS-07 history literal fix repo-wide (253 files). Policy: .template.ts/.template.astro excludedPaths. werkstatt-engine now 0 diagnostics.</item>
 </CHANGE_SUMMARY>
 */