fundus 0.14.0 → 0.16.0

package/dist/core/library-validation.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Flat-space (id-space) library validation — the checks that must run over the
+ * *effective* (merged) library, because a host override record stores partial
+ * parameters that only validate once merged under its Package base, and a
+ * reference may cross the host/Package boundary. Pure and disk-free: id
+ * validity, unknown type, plugin parameter schema, manifest membership, manifest
+ * appearance tags, and reference errors. Disk/host-only checks (raw pointers,
+ * folders, `.gitkeep`) stay in `LibraryStore.validate`.
+ */
+import type { EffectiveLibrary } from './library.js';
+import type { ValidationIssueDto } from './api-types.js';
+import { type PluginDescriptorRegistry } from './reference-graph.js';
+export declare function flatLibraryIssues(library: EffectiveLibrary, plugins: PluginDescriptorRegistry): ValidationIssueDto[];

package/dist/core/library-validation.js

@@ -0,0 +1,48 @@
+import { assetIdError, manifestNameError } from './asset-id.js';
+import { manifestColorError, manifestEmojiError } from './manifest-appearance.js';
+import { collectAllReferences, referenceErrors } from './reference-graph.js';
+export function flatLibraryIssues(library, plugins) {
+    const issues = [];
+    for (const [name, record] of Object.entries(library.manifests)) {
+        const nameProblem = manifestNameError(name);
+        if (nameProblem)
+            issues.push({ message: nameProblem });
+        if (record.color !== undefined) {
+            const colorProblem = manifestColorError(record.color);
+            if (colorProblem)
+                issues.push({ message: `Manifest "${name}": ${colorProblem}` });
+        }
+        if (record.emoji !== undefined) {
+            const emojiProblem = manifestEmojiError(record.emoji);
+            if (emojiProblem)
+                issues.push({ message: `Manifest "${name}": ${emojiProblem}` });
+        }
+    }
+    for (const [assetId, record] of Object.entries(library.assets)) {
+        const idProblem = assetIdError(assetId);
+        if (idProblem)
+            issues.push({ assetId, message: idProblem });
+        const plugin = plugins[record.type];
+        if (!plugin) {
+            issues.push({ assetId, message: `Unknown asset type "${record.type}".` });
+        }
+        else {
+            try {
+                plugin.validateParameters(record.parameters);
+            }
+            catch (cause) {
+                issues.push({
+                    assetId,
+                    message: `Invalid parameters: ${cause instanceof Error ? cause.message : String(cause)}`
+                });
+            }
+        }
+        for (const manifest of record.manifests) {
+            if (!library.manifests[manifest]) {
+                issues.push({ assetId, message: `Unknown manifest "${manifest}".` });
+            }
+        }
+    }
+    issues.push(...referenceErrors(library, collectAllReferences(library, plugins)));
+    return issues;
+}

package/dist/core/library.d.ts

@@ -45,8 +45,27 @@ export interface Library {
     assets: Record<AssetId, AssetRecord>;
     manifests: Record<ManifestName, ManifestRecord>;
 }
+/**
+ * An asset record in the merged *effective* library, where `raw`/`rawHash` may
+ * be absent — an unfilled Package **slot**. Every `Library` record is a valid
+ * `EffectiveAssetRecord` (required fields satisfy optional ones), so single-root
+ * callers are unaffected. The effective library lives in memory only and is
+ * never serialized (a host `Library` always carries `raw`/`rawHash`).
+ */
+export interface EffectiveAssetRecord extends Omit<AssetRecord, 'raw' | 'rawHash'> {
+    raw?: string;
+    rawHash?: string;
+}
+/** The host library with all Packages merged under it (host wins). In-memory only. */
+export interface EffectiveLibrary extends Omit<Library, 'assets'> {
+    assets: Record<AssetId, EffectiveAssetRecord>;
+}
 /** A fresh, empty library. */
 export declare function createEmptyLibrary(): Library;
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+export declare function assertSafeKey(kind: 'asset' | 'manifest', key: string): void;
+export declare function parseImportSource(id: string, value: unknown): ImportSourceRecord;
+export declare function parseManifestRecord(name: string, value: Record<string, unknown>): ManifestRecord;
 /**
  * Parse and structurally validate a library file's JSON text. Throws with a
  * clear message on any malformed part; plugin parameter validation is a

package/dist/core/library.js

@@ -3,7 +3,7 @@ import { folderPathError } from './folder-path.js';
 export function createEmptyLibrary() {
     return { version: 1, folders: [], assets: {}, manifests: {} };
 }
-function isRecord(value) {
+export function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
 /**
@@ -13,12 +13,12 @@ function isRecord(value) {
  * this is a validator concern (reported as issues, not parse failures).
  */
 const DANGEROUS_KEYS = ['__proto__', 'constructor', 'prototype'];
-function assertSafeKey(kind, key) {
+export function assertSafeKey(kind, key) {
     if (DANGEROUS_KEYS.includes(key)) {
         throw new Error(`Library ${kind} key "${key}" is not allowed.`);
     }
 }
-function parseImportSource(id, value) {
+export function parseImportSource(id, value) {
     if (!isRecord(value)) {
         throw new Error(`Library asset "${id}" has a non-object "importSource".`);
     }
@@ -64,7 +64,7 @@ function parseAssetRecord(id, value, version) {
         record.importSource = parseImportSource(id, value.importSource);
     return record;
 }
-function parseManifestRecord(name, value) {
+export function parseManifestRecord(name, value) {
     const record = {};
     if ('color' in value && value.color !== undefined) {
         if (typeof value.color !== 'string') {

package/dist/core/manifest-membership.d.ts

@@ -6,7 +6,7 @@
  * picture is computed; server processing, codegen, delivered-size accounting,
  * and the editor state payload all consume it — no parallel closure walks.
  */
-import type { AssetId, Library, ManifestName } from './library.js';
+import type { AssetId, EffectiveLibrary, ManifestName } from './library.js';
 import { type ReferencesByAsset } from './reference-graph.js';
 /** One derived passive membership, with the attribution that explains it. */
 export interface PassiveMember {
@@ -47,7 +47,7 @@ export type LibraryMembership = Record<ManifestName, ManifestMembership>;
  * (`referenceClosure(explicit) − explicit`) with their via-attribution, and
  * the resulting delivery set.
  */
-export declare function computeLibraryMembership(library: Library, referencesByAsset: ReferencesByAsset): LibraryMembership;
+export declare function computeLibraryMembership(library: EffectiveLibrary, referencesByAsset: ReferencesByAsset): LibraryMembership;
 /**
  * Every asset delivered by at least one manifest, explicitly or passively —
  * the processing set (assets outside it are inert). An asset is

package/dist/core/package-declaration.d.ts

@@ -0,0 +1,43 @@
+import { type ImportSourceRecord, type ManifestName, type ManifestRecord, type AssetId } from './library.js';
+/**
+ * A `fundus.package.json` — a Package's declaration file. Same structural model
+ * as a host `Library`, with two relaxations: assets are byte-less **slots**
+ * (no `raw`/`rawHash`) that carry an optional `importSource`, and `folders` are
+ * ignored (folder organisation is a host-editor concern). A declaration is
+ * read-only input — Fundus never writes to it; overriding a Package asset writes
+ * an override record into the *host* library.
+ *
+ * The declaration `version` is the declaration schema version, independent of a
+ * host `Library.version` (which gates `importSource` on v2). A Package always
+ * declares its `importSource` slots without that gate.
+ */
+export interface PackageAssetDeclaration {
+    /** Asset type — which plugin owns this asset ('image' | 'slice' | …). */
+    type: string;
+    /** Plugin-owned parameter blob. Validated later, over the merged library. */
+    parameters: unknown;
+    /** Manifest membership. */
+    manifests: ManifestName[];
+    /** Optional repeatable origin the host (or a slot fill) can materialize. */
+    importSource?: ImportSourceRecord;
+}
+export interface PackageDeclaration {
+    /** Declaration schema version — currently always 1. */
+    version: 1;
+    assets: Record<AssetId, PackageAssetDeclaration>;
+    manifests: Record<ManifestName, ManifestRecord>;
+}
+/**
+ * Parse and structurally validate a `fundus.package.json` (JSON text). Delegates
+ * to {@link validatePackageDeclaration} after `JSON.parse`.
+ */
+export declare function parsePackageDeclaration(json: string, origin: string): PackageDeclaration;
+/**
+ * Structurally validate an already-parsed package declaration — the shared core of
+ * both the JSON path ({@link parsePackageDeclaration}) and the TypeScript-module path
+ * (a `fundus.package.ts` default export loaded via jiti). Throws with a clear,
+ * origin-tagged message on any malformed part. Plugin parameter validation and
+ * id/manifest-name validity are separate steps that run over the merged
+ * (effective) library, not here — mirroring `parseLibrary`. `version` defaults to 1.
+ */
+export declare function validatePackageDeclaration(value: unknown, origin: string): PackageDeclaration;

package/dist/core/package-declaration.js

@@ -0,0 +1,80 @@
+import { assertSafeKey, isRecord, parseImportSource, parseManifestRecord } from './library.js';
+function parsePackageAsset(origin, id, value) {
+    if (!isRecord(value)) {
+        throw new Error(`Package "${origin}" asset "${id}" must be an object.`);
+    }
+    if (typeof value.type !== 'string' || value.type.length === 0) {
+        throw new Error(`Package "${origin}" asset "${id}" is missing a string "type".`);
+    }
+    if ('raw' in value || 'rawHash' in value) {
+        throw new Error(`Package "${origin}" asset "${id}" declares "raw"/"rawHash"; Packages ship byte-less slots only.`);
+    }
+    if (!Array.isArray(value.manifests) ||
+        value.manifests.some((entry) => typeof entry !== 'string')) {
+        throw new Error(`Package "${origin}" asset "${id}" must have a "manifests" array of strings.`);
+    }
+    // `parameters` is optional in the authored declaration — a resource is often just
+    // `{ type, manifests }`, a pure contract. Default to `{}`; the app's slot fill (and the
+    // merge over the effective library) supplies the real plugin parameters.
+    const record = {
+        type: value.type,
+        parameters: 'parameters' in value ? value.parameters : {},
+        manifests: value.manifests
+    };
+    if (value.importSource !== undefined) {
+        record.importSource = parseImportSource(id, value.importSource);
+    }
+    return record;
+}
+/**
+ * Parse and structurally validate a `fundus.package.json` (JSON text). Delegates
+ * to {@link validatePackageDeclaration} after `JSON.parse`.
+ */
+export function parsePackageDeclaration(json, origin) {
+    let value;
+    try {
+        value = JSON.parse(json);
+    }
+    catch (cause) {
+        throw new Error(`Package "${origin}" declaration is not valid JSON: ${cause instanceof Error ? cause.message : String(cause)}`);
+    }
+    return validatePackageDeclaration(value, origin);
+}
+/**
+ * Structurally validate an already-parsed package declaration — the shared core of
+ * both the JSON path ({@link parsePackageDeclaration}) and the TypeScript-module path
+ * (a `fundus.package.ts` default export loaded via jiti). Throws with a clear,
+ * origin-tagged message on any malformed part. Plugin parameter validation and
+ * id/manifest-name validity are separate steps that run over the merged
+ * (effective) library, not here — mirroring `parseLibrary`. `version` defaults to 1.
+ */
+export function validatePackageDeclaration(value, origin) {
+    if (!isRecord(value)) {
+        throw new Error(`Package "${origin}" declaration must be an object.`);
+    }
+    if (value.version !== undefined && value.version !== 1) {
+        throw new Error(`Package "${origin}" declaration has unsupported version ${JSON.stringify(value.version)} (expected 1).`);
+    }
+    if (!isRecord(value.assets)) {
+        throw new Error(`Package "${origin}" declaration "assets" must be an object.`);
+    }
+    if (value.manifests !== undefined && !isRecord(value.manifests)) {
+        throw new Error(`Package "${origin}" declaration "manifests" must be an object.`);
+    }
+    const assets = {};
+    for (const [id, record] of Object.entries(value.assets)) {
+        assertSafeKey('asset', id);
+        assets[id] = parsePackageAsset(origin, id, record);
+    }
+    const manifests = {};
+    if (isRecord(value.manifests)) {
+        for (const [name, record] of Object.entries(value.manifests)) {
+            assertSafeKey('manifest', name);
+            if (!isRecord(record)) {
+                throw new Error(`Package "${origin}" manifest "${name}" must be an object.`);
+            }
+            manifests[name] = parseManifestRecord(name, record);
+        }
+    }
+    return { version: 1, assets, manifests };
+}

package/dist/core/package-merge.d.ts

@@ -0,0 +1,65 @@
+import { type AssetId, type EffectiveLibrary, type Library, type ManifestName, type ManifestRecord } from './library.js';
+import type { PackageAssetDeclaration } from './package-declaration.js';
+/** A parsed Package ready to merge: its declaration plus a provenance origin. */
+export interface ParsedPackage {
+    origin: string;
+    declaration: {
+        assets: Record<AssetId, PackageAssetDeclaration>;
+        manifests: Record<ManifestName, ManifestRecord>;
+    };
+}
+/** Where an effective asset came from — for `check` messages and the editor. */
+export type AssetProvenance = {
+    source: 'host';
+} | {
+    source: 'package';
+    origin: string;
+} | {
+    source: 'override';
+    origin: string;
+};
+export type MergeProvenance = Record<AssetId, AssetProvenance>;
+/** A merge-time finding. Conflicts/mismatches are errors; overrides are advisory. */
+export type MergeFinding = {
+    kind: 'package-conflict';
+    assetId: string;
+    origins: [string, string];
+    message: string;
+} | {
+    kind: 'package-type-mismatch';
+    assetId: string;
+    origin: string;
+    message: string;
+} | {
+    kind: 'package-overridden';
+    assetId: string;
+    origin: string;
+    message: string;
+};
+export interface MergeResult {
+    library: EffectiveLibrary;
+    provenance: MergeProvenance;
+    findings: MergeFinding[];
+}
+/**
+ * Deep-merge plugin `parameters` — overlay (host) wins. Recurses into plain
+ * objects only; arrays are replaced wholesale (host-replace) and `{ $asset }`
+ * reference markers are treated as atomic (never merged field-by-field). Applied
+ * to `parameters` only — the record-level `manifests` array is unioned by the
+ * caller, never routed through here.
+ */
+export declare function deepMergeParameters(base: unknown, overlay: unknown): unknown;
+/**
+ * Merge `packages` under `host` (host wins, per-field deep). Returns the merged
+ * effective library, per-asset provenance, and merge findings. `host` is an
+ * `EffectiveLibrary` so a raw-less host override branch stays reachable/testable
+ * and v2-ready; a plain `Library` is assignable.
+ */
+export declare function mergePackages(host: EffectiveLibrary, packages: ParsedPackage[]): MergeResult;
+/**
+ * Drop raw-less (unfilled) slots from an effective library, yielding a plain
+ * `Library` for processing/codegen. Safe only after the slot/validation gates
+ * pass — every remaining delivered asset then has `raw`; dropped slots are
+ * provably inert (not delivered).
+ */
+export declare function materializeLibrary(effective: EffectiveLibrary): Library;

package/dist/core/package-merge.js

@@ -0,0 +1,173 @@
+/**
+ * The pure Package merge: fold package-shipped partial libraries **under** the
+ * host library into one in-memory *effective* library. Host wins per-field
+ * (deep). No disk, no config — testable like `resolveConfig`. The effective
+ * library is never serialized (a host `Library` always carries `raw`/`rawHash`);
+ * `materializeLibrary` drops raw-less inert slots to hand a plain `Library` to
+ * processing/codegen once the slot/validation gates have passed.
+ */
+import { isAssetReference } from './asset-reference.js';
+import { compareCodeUnits } from './canonicalize.js';
+import { isRecord } from './library.js';
+function sortDedupManifests(names) {
+    return [...new Set(names)].sort(compareCodeUnits);
+}
+/**
+ * Deep-merge plugin `parameters` — overlay (host) wins. Recurses into plain
+ * objects only; arrays are replaced wholesale (host-replace) and `{ $asset }`
+ * reference markers are treated as atomic (never merged field-by-field). Applied
+ * to `parameters` only — the record-level `manifests` array is unioned by the
+ * caller, never routed through here.
+ */
+export function deepMergeParameters(base, overlay) {
+    if (isRecord(base) &&
+        isRecord(overlay) &&
+        !isAssetReference(base) &&
+        !isAssetReference(overlay)) {
+        const result = { ...base };
+        for (const [key, value] of Object.entries(overlay)) {
+            result[key] = key in base ? deepMergeParameters(base[key], value) : value;
+        }
+        return result;
+    }
+    return overlay;
+}
+/**
+ * Merge `packages` under `host` (host wins, per-field deep). Returns the merged
+ * effective library, per-asset provenance, and merge findings. `host` is an
+ * `EffectiveLibrary` so a raw-less host override branch stays reachable/testable
+ * and v2-ready; a plain `Library` is assignable.
+ */
+export function mergePackages(host, packages) {
+    const findings = [];
+    // Layer packages in declared order. First declaration of an id/manifest wins;
+    // a second package claiming an id is an (ambiguous-by-construction) error.
+    const pkgAssets = new Map();
+    const pkgManifests = new Map();
+    for (const { origin, declaration } of packages) {
+        for (const [id, decl] of Object.entries(declaration.assets)) {
+            const existing = pkgAssets.get(id);
+            if (existing) {
+                findings.push({
+                    kind: 'package-conflict',
+                    assetId: id,
+                    origins: [existing.origin, origin],
+                    message: `Asset "${id}" is declared by two Packages ("${existing.origin}" and "${origin}"); Package ids must be unique.`
+                });
+                continue;
+            }
+            pkgAssets.set(id, { origin, decl });
+        }
+        for (const [name, record] of Object.entries(declaration.manifests)) {
+            if (!pkgManifests.has(name))
+                pkgManifests.set(name, record);
+        }
+    }
+    const assets = {};
+    const provenance = {};
+    // Host assets: host-only pass through; host-over-package become overrides.
+    for (const [id, hostRecord] of Object.entries(host.assets)) {
+        const pkg = pkgAssets.get(id);
+        if (!pkg) {
+            assets[id] = { ...hostRecord };
+            provenance[id] = { source: 'host' };
+            continue;
+        }
+        if (pkg.decl.type !== hostRecord.type) {
+            findings.push({
+                kind: 'package-type-mismatch',
+                assetId: id,
+                origin: pkg.origin,
+                message: `Asset "${id}" overrides Package "${pkg.origin}" but changes its type from "${pkg.decl.type}" to "${hostRecord.type}"; changing the type is a different asset, not an override.`
+            });
+            assets[id] = { ...hostRecord };
+            provenance[id] = { source: 'override', origin: pkg.origin };
+            continue;
+        }
+        const merged = {
+            type: hostRecord.type,
+            parameters: deepMergeParameters(pkg.decl.parameters, hostRecord.parameters),
+            manifests: sortDedupManifests([...pkg.decl.manifests, ...hostRecord.manifests])
+        };
+        // Source unit (raw + rawHash + importSource) is coherent: if the host
+        // supplies bytes or its own import source, take the host's wholesale;
+        // otherwise inherit the Package's import source.
+        if (hostRecord.raw !== undefined || hostRecord.importSource !== undefined) {
+            if (hostRecord.raw !== undefined)
+                merged.raw = hostRecord.raw;
+            if (hostRecord.rawHash !== undefined)
+                merged.rawHash = hostRecord.rawHash;
+            if (hostRecord.importSource !== undefined)
+                merged.importSource = hostRecord.importSource;
+        }
+        else if (pkg.decl.importSource !== undefined) {
+            merged.importSource = pkg.decl.importSource;
+        }
+        assets[id] = merged;
+        provenance[id] = { source: 'override', origin: pkg.origin };
+        findings.push({
+            kind: 'package-overridden',
+            assetId: id,
+            origin: pkg.origin,
+            message: `Asset "${id}" from Package "${pkg.origin}" is overridden by the host library.`
+        });
+    }
+    // Package-only assets (byte-less slots).
+    for (const [id, { origin, decl }] of pkgAssets) {
+        if (Object.hasOwn(host.assets, id))
+            continue;
+        const record = {
+            type: decl.type,
+            parameters: decl.parameters,
+            manifests: sortDedupManifests(decl.manifests)
+        };
+        if (decl.importSource !== undefined)
+            record.importSource = decl.importSource;
+        assets[id] = record;
+        provenance[id] = { source: 'package', origin };
+    }
+    // Manifest records: Package declarations first, host overlays per field (host wins).
+    const manifests = {};
+    for (const [name, record] of pkgManifests)
+        manifests[name] = { ...record };
+    for (const [name, record] of Object.entries(host.manifests)) {
+        manifests[name] = { ...manifests[name], ...record };
+    }
+    const hasImportSource = Object.values(assets).some((record) => record.importSource !== undefined);
+    const library = {
+        version: hasImportSource ? 2 : host.version,
+        folders: host.folders,
+        assets,
+        manifests
+    };
+    return { library, provenance, findings };
+}
+/**
+ * Drop raw-less (unfilled) slots from an effective library, yielding a plain
+ * `Library` for processing/codegen. Safe only after the slot/validation gates
+ * pass — every remaining delivered asset then has `raw`; dropped slots are
+ * provably inert (not delivered).
+ */
+export function materializeLibrary(effective) {
+    const assets = {};
+    for (const [id, record] of Object.entries(effective.assets)) {
+        if (record.raw === undefined || record.rawHash === undefined)
+            continue;
+        const materialized = {
+            type: record.type,
+            raw: record.raw,
+            rawHash: record.rawHash,
+            parameters: record.parameters,
+            manifests: record.manifests
+        };
+        if (record.importSource !== undefined)
+            materialized.importSource = record.importSource;
+        assets[id] = materialized;
+    }
+    return {
+        version: effective.version,
+        folders: effective.folders,
+        assets,
+        manifests: effective.manifests
+    };
+}

package/dist/core/reference-graph.d.ts

@@ -7,7 +7,7 @@
  * enumerated (`collectAllReferences`) — no fs, no plugin introspection.
  */
 import type { CollectedReference } from './asset-reference.js';
-import type { AssetId, Library } from './library.js';
+import type { AssetId, EffectiveLibrary } from './library.js';
 import type { ValidationIssueDto } from './api-types.js';
 import type { AssetTypePluginDescriptor } from './plugins/contract.js';
 /** The plugin registry shape shared by server and tests: type → descriptor. */
@@ -19,13 +19,13 @@ export type ReferencesByAsset = Record<AssetId, CollectedReference[]>;
  * whose type is unknown or whose parameters do not validate contribute no
  * references — those problems are reported by the regular validation pass.
  */
-export declare function collectAllReferences(library: Library, plugins: PluginDescriptorRegistry): ReferencesByAsset;
+export declare function collectAllReferences(library: EffectiveLibrary, plugins: PluginDescriptorRegistry): ReferencesByAsset;
 /**
  * Reference *errors* (they block build/codegen): a reference to an unknown
  * asset, a target whose type is not among the field's expected types, and
  * cycles (composition is acyclic by nature).
  */
-export declare function referenceErrors(library: Library, referencesByAsset: ReferencesByAsset): ValidationIssueDto[];
+export declare function referenceErrors(library: EffectiveLibrary, referencesByAsset: ReferencesByAsset): ValidationIssueDto[];
 /**
  * The transitive reference closure of a set of assets, including the starting
  * set — the assets that must be delivered so the starting set renders as

package/dist/runtime/components/Image.svelte

@@ -1,21 +1,20 @@
 <!--
 	Thin <img> wrapper for an image manifest entry: renders the delivered proxy
 	with its intrinsic width/height attributes so layout never shifts while the
-	file loads.
+	file loads. Every other native <img> attribute passes straight through.
 -->
 <script lang="ts">
+	import type { HTMLImgAttributes } from 'svelte/elements';
 	import type { ImageManifestEntry } from '../../core/index.js';
 	import { logRender } from '../logging.js';
 
-	interface Props {
+	interface Props extends Omit<HTMLImgAttributes, 'src'> {
 		src: ImageManifestEntry;
-		alt?: string;
-		class?: string;
 	}
 
-	let { src, alt = '', class: className = '' }: Props = $props();
+	let { src, ...rest }: Props = $props();
 
 	$effect(() => logRender(src));
 </script>
 
-<img src={src.src} width={src.width} height={src.height} {alt} class={className} />
+<img src={src.src} width={src.width} height={src.height} {...rest} />

package/dist/runtime/components/Image.svelte.d.ts

@@ -1,8 +1,7 @@
+import type { HTMLImgAttributes } from 'svelte/elements';
 import type { ImageManifestEntry } from '../../core/index.js';
-interface Props {
+interface Props extends Omit<HTMLImgAttributes, 'src'> {
     src: ImageManifestEntry;
-    alt?: string;
-    class?: string;
 }
 declare const Image: import("svelte").Component<Props, {}, "">;
 type Image = ReturnType<typeof Image>;

package/dist/server/build.js

@@ -6,29 +6,44 @@
 import { loadConfig } from './config-loader.js';
 import { LibraryStore } from './library-store.js';
 import { processAssets } from './processing/processor.js';
-import { generateManifestModules } from './codegen.js';
-import { serverPluginsByType } from './plugins.js';
-import { formatCheckFinding } from './check.js';
-import { typesForFileName } from '../core/index.js';
+import { generateManifestModules, manifestModuleCollisionIssues } from './codegen.js';
+import { descriptorsByType, serverPluginsByType } from './plugins.js';
+import { formatCheckFinding, packageSlotFindings } from './check.js';
+import { collectAllReferences, computeLibraryMembership, flatLibraryIssues, materializeLibrary, mergePackages, typesForFileName } from '../core/index.js';
 import { classifyRawDirectory } from './raw-reconciliation.js';
 import { rawSafetyIssues } from './raw-safety.js';
 export async function runBuild(projectRoot, registry = serverPluginsByType) {
     const config = await loadConfig(projectRoot);
     const store = new LibraryStore(config, registry);
-    const library = await store.read();
+    const host = await store.read();
+    // Merge Packages under the host; validate the effective library; process +
+    // generate over the materialized (raw-bearing) subset. Raw scans stay host.
+    const { library: effective, provenance, findings: mergeFindings } = mergePackages(host, config.packages ?? []);
+    const materialized = materializeLibrary(effective);
     const descriptors = Object.values(registry).map((plugin) => plugin.descriptor);
     const compatibleTypes = (path) => typesForFileName(path, descriptors);
-    const classification = await classifyRawDirectory(config.rawDir, library, (path) => compatibleTypes(path).length > 0);
+    const classification = await classifyRawDirectory(config.rawDir, host, (path) => compatibleTypes(path).length > 0);
+    const referencesByAsset = collectAllReferences(effective, descriptorsByType(registry));
+    const membership = computeLibraryMembership(effective, referencesByAsset);
     const issues = [
-        ...(await store.validate(library)),
-        ...rawSafetyIssues(library, classification, compatibleTypes)
+        ...mergeFindings
+            .filter((finding) => finding.kind !== 'package-overridden')
+            .map((finding) => ({ assetId: finding.assetId, message: finding.message })),
+        ...(await store.validate(host, { flatSpace: false })),
+        ...flatLibraryIssues(effective, descriptorsByType(registry)),
+        ...manifestModuleCollisionIssues(effective.manifests),
+        ...rawSafetyIssues(host, classification, compatibleTypes),
+        ...packageSlotFindings(effective, provenance, membership).map((finding) => ({
+            assetId: finding.assetId,
+            message: finding.message
+        }))
     ];
     if (issues.length > 0) {
         const lines = issues.map((issue) => `  - ${formatCheckFinding({ kind: 'validation', assetId: issue.assetId, message: issue.message })}`);
         throw new Error(`Library validation failed:\n${lines.join('\n')}`);
     }
-    await store.syncFolders(library);
-    const processing = await processAssets(config, library, registry);
-    const codegen = await generateManifestModules(config, library, processing.proxies, registry);
+    await store.syncFolders(host);
+    const processing = await processAssets(config, materialized, registry);
+    const codegen = await generateManifestModules(config, materialized, processing.proxies, registry);
     return { processing, codegen };
 }