m0saic 0.3.1 → 0.4.0

package/node_modules/@m0saic/dsl-file-formats/dist/cjs/m0v/m0vFile.js

@@ -1,2 +1,2 @@
-"use strict";var f=Object.defineProperty;var o=(e,r)=>f(e,"name",{value:r,configurable:!0});Object.defineProperty(exports,"__esModule",{value:!0}),exports.serializeM0vFile=serializeM0vFile,exports.parseM0vFile=parseM0vFile;const serializeM0File_1=require("../m0/serializeM0File");function serializeM0vFile(e){const r=e.created??new Date;if(e.outputs!==void 0&&(e.outputs===null||typeof e.outputs!="object"||Array.isArray(e.outputs)))throw new Error("serializeM0vFile: outputs must be an object map when provided");if(e.assets!==void 0&&(e.assets===null||typeof e.assets!="object"||Array.isArray(e.assets)))throw new Error("serializeM0vFile: assets must be an object map when provided");const t=e.app??null,n=e.appVersion??null,s=normalizeMeta(e.meta??null),i={format:"m0v",version:1,created:(0,serializeM0File_1.formatISO)(r),app:t&&t.trim()!==""?t.trim():null,appVersion:n&&n.trim()!==""?n.trim():null,meta:s,custom:e.custom??null};return e.outputs&&Object.keys(e.outputs).length>0&&(i.outputs=e.outputs),e.assets&&Object.keys(e.assets).length>0&&(i.assets=e.assets),JSON.stringify(i,null,2)+`
-`}o(serializeM0vFile,"serializeM0vFile");function normalizeMeta(e){if(!e)return null;const r={},t=["title","author","source","note"];for(const n of t){const s=e[n];if(s!=null){const i=s.trim();i!==""&&(r[n]=i)}}return Object.keys(r).length?r:null}o(normalizeMeta,"normalizeMeta");function parseM0vFile(e){if(typeof e!="string")throw new Error("parseM0vFile: input must be a string");let r;try{r=JSON.parse(e)}catch{throw new Error("parseM0vFile: invalid JSON")}if(!isPlainObject(r))throw new Error("parseM0vFile: expected JSON object");const t=r;if(t.format!=="m0v")throw new Error(`parseM0vFile: expected format "m0v", got "${String(t.format)}"`);if(t.version!==1)throw new Error(`parseM0vFile: expected version 1, got ${String(t.version)}`);const n=typeof t.created=="string"?t.created.trim():"";if(!n)throw new Error("parseM0vFile: missing created timestamp");const s=parseOptionalMap(t.outputs,"outputs"),i=parseOptionalMap(t.assets,"assets"),u=parseStringOrNull(t.app),l=parseStringOrNull(t.appVersion),c=parseMetaOrNull(t.meta),a={format:"m0v",version:1,created:n,app:u,appVersion:l,meta:c,custom:t.custom===void 0?null:t.custom};return s!==void 0&&(a.outputs=s),i!==void 0&&(a.assets=i),a}o(parseM0vFile,"parseM0vFile");function parseOptionalMap(e,r){if(e!==void 0){if(e===null)throw new Error(`parseM0vFile: invalid ${r} (expected object map or omit, got null)`);if(!isPlainObject(e))throw new Error(`parseM0vFile: invalid ${r} (expected object map, got `+(Array.isArray(e)?"array":typeof e)+")");return e}}o(parseOptionalMap,"parseOptionalMap");function parseStringOrNull(e){if(e==null||typeof e!="string")return null;const r=e.trim();return r||null}o(parseStringOrNull,"parseStringOrNull");function parseMetaOrNull(e){if(e==null)return null;if(!isPlainObject(e))throw new Error("parseM0vFile: invalid meta (expected object or null)");const r=e,t={};for(const n of["title","author","source","note"]){const s=r[n];if(typeof s=="string"){const i=s.trim();i&&(t[n]=i)}}return Object.keys(t).length?t:null}o(parseMetaOrNull,"parseMetaOrNull");function isPlainObject(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}o(isPlainObject,"isPlainObject");
+"use strict";var d=Object.defineProperty;var a=(e,t)=>d(e,"name",{value:t,configurable:!0});Object.defineProperty(exports,"__esModule",{value:!0}),exports.serializeM0vFile=serializeM0vFile,exports.parseM0vFile=parseM0vFile;const serializeM0File_1=require("../m0/serializeM0File");function serializeM0vFile(e){const t=e.created??new Date;if(e.outputs!==void 0&&(e.outputs===null||typeof e.outputs!="object"||Array.isArray(e.outputs)))throw new Error("serializeM0vFile: outputs must be an object map when provided");if(e.assets!==void 0&&(e.assets===null||typeof e.assets!="object"||Array.isArray(e.assets)))throw new Error("serializeM0vFile: assets must be an object map when provided");if(e.brand!==void 0&&(e.brand===null||typeof e.brand!="object"||Array.isArray(e.brand)))throw new Error("serializeM0vFile: brand must be an object map when provided");const r=e.app??null,i=e.appVersion??null,s=normalizeMeta(e.meta??null),n={format:"m0v",version:1,created:(0,serializeM0File_1.formatISO)(t),app:r&&r.trim()!==""?r.trim():null,appVersion:i&&i.trim()!==""?i.trim():null,meta:s,custom:e.custom??null};return e.outputs&&Object.keys(e.outputs).length>0&&(n.outputs=e.outputs),e.assets&&Object.keys(e.assets).length>0&&(n.assets=e.assets),e.brand&&Object.keys(e.brand).length>0&&(n.brand=e.brand),JSON.stringify(n,null,2)+`
+`}a(serializeM0vFile,"serializeM0vFile");function normalizeMeta(e){if(!e)return null;const t={},r=["title","author","source","note"];for(const i of r){const s=e[i];if(s!=null){const n=s.trim();n!==""&&(t[i]=n)}}return Object.keys(t).length?t:null}a(normalizeMeta,"normalizeMeta");function parseM0vFile(e){if(typeof e!="string")throw new Error("parseM0vFile: input must be a string");let t;try{t=JSON.parse(e)}catch{throw new Error("parseM0vFile: invalid JSON")}if(!isPlainObject(t))throw new Error("parseM0vFile: expected JSON object");const r=t;if(r.format!=="m0v")throw new Error(`parseM0vFile: expected format "m0v", got "${String(r.format)}"`);if(r.version!==1)throw new Error(`parseM0vFile: expected version 1, got ${String(r.version)}`);const i=typeof r.created=="string"?r.created.trim():"";if(!i)throw new Error("parseM0vFile: missing created timestamp");const s=parseOptionalMap(r.outputs,"outputs"),n=parseOptionalMap(r.assets,"assets"),u=parseOptionalMap(r.brand,"brand"),l=parseStringOrNull(r.app),c=parseStringOrNull(r.appVersion),f=parseMetaOrNull(r.meta),o={format:"m0v",version:1,created:i,app:l,appVersion:c,meta:f,custom:r.custom===void 0?null:r.custom};return s!==void 0&&(o.outputs=s),n!==void 0&&(o.assets=n),u!==void 0&&(o.brand=u),o}a(parseM0vFile,"parseM0vFile");function parseOptionalMap(e,t){if(e!==void 0){if(e===null)throw new Error(`parseM0vFile: invalid ${t} (expected object map or omit, got null)`);if(!isPlainObject(e))throw new Error(`parseM0vFile: invalid ${t} (expected object map, got `+(Array.isArray(e)?"array":typeof e)+")");return e}}a(parseOptionalMap,"parseOptionalMap");function parseStringOrNull(e){if(e==null||typeof e!="string")return null;const t=e.trim();return t||null}a(parseStringOrNull,"parseStringOrNull");function parseMetaOrNull(e){if(e==null)return null;if(!isPlainObject(e))throw new Error("parseM0vFile: invalid meta (expected object or null)");const t=e,r={};for(const i of["title","author","source","note"]){const s=t[i];if(typeof s=="string"){const n=s.trim();n&&(r[i]=n)}}return Object.keys(r).length?r:null}a(parseMetaOrNull,"parseMetaOrNull");function isPlainObject(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}a(isPlainObject,"isPlainObject");

package/node_modules/@m0saic/dsl-file-formats/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m0saic/dsl-file-formats",
-  "version": "2.0.1",
+  "version": "2.1.0",
   "main": "./dist/cjs/index.js",
   "exports": {
     ".": {

package/node_modules/@m0saic/knowledge/docs/README.md

@@ -45,6 +45,7 @@ disposes).
 | Overlays, passthroughs, identity | `skills/overlay-semantics.md`, `skills/passthrough-semantics.md`, `skills/identity.md` |
 | Build a template | `templates/philosophy-and-contract.md` → `templates/construction-strategy.md` → `templates/geometry-recipes.md` |
 | Template perf | `templates/patterns/perf-authoring-rules.md` |
+| A template that goes to paper (cards, banners, posters) | `templates/patterns/print-authoring.md` |
 | Data-driven templates | `templates/data-pipeline.md` |
 | Read/write `.m0` / `.m0c` / `.m0p` / `.m0v` | `file-formats/m0p-and-custom-field.md` |
 | Render via the CLI | `runtime/cli-usage.md` |

package/node_modules/@m0saic/knowledge/docs/file-formats/m0p-and-custom-field.md

@@ -23,7 +23,7 @@ These features shipped together in April 2026. They are foundational to v2 work
 | `.m0c` | JSON: DSL + StableKey-keyed labels + derive image + meta | One layout, with labels / overlays / derive thumbnail / `custom.*` |
 | `.m0g` | `.m0c`-shaped JSON with `format: "m0g"` + the `M0cGold` `gold` block | A **m0saic golden** ("mogging") — a tried-and-true, signed-off layout; `#mogging` comment-line convention (`types.ts`) |
 | `.m0p` | JSON: pack of `.m0c`-shaped variants under shared identity | Multiple coordinated variants (cross-canvas, brand pack, content set, themed collection) |
-| `.m0v` | JSON: `outputs` / `assets` / `custom` (`src/m0v/m0vFile.ts`) | **Mosaic Vocabulary** — user-tier shared brand language: output presets, palette, typography, asset paths. CLI `--m0v <path>`; `m0saic open` accepts it |
+| `.m0v` | JSON: `outputs` / `assets` / `brand` / `custom` (`src/m0v/m0vFile.ts`) | **Mosaic Vocabulary** — user-tier shared brand language: output presets, asset paths, and since 2026-10-19 the `brand` slot (the shop's name, logo, accent, site, … as strings — Mosaic Desktop's "Your brand" profile, `~/m0saic/solutions/<id>/brand.m0v`; see `templates/reference/brand-schema.md`). Every slot optional; palette, typography still ride in `custom`. CLI `--m0v <path>` reads `outputs`; `m0saic open` accepts it |
 
 `.m0` and `.m0c` are unchanged by the later formats' arrival — each is purely additive.
 This doc covers `.m0`/`.m0c`/`.m0p` in depth; `.m0g` and `.m0v` have their own type

package/node_modules/@m0saic/knowledge/docs/runtime/cli-usage.md

@@ -44,7 +44,11 @@ m0saic layout.m0           # .m0 / .m0c paths also accepted (index.ts:~7184-7270
 ## Command table
 
 18 `.command(` registrations in `index.ts` + `telemetry` registered by
-`registerTelemetryCommand(program)` (index.ts:~7138 → `utils/telemetry.ts:~372`).
+`registerTelemetryCommand(program)` (index.ts:~7138 → `utils/telemetry.ts:~372`) +
+`community` (`fetch`), `install`, `uninstall` registered by
+`registerTemplateInstallCommands(program, …)` (`utils/templateInstall.ts`, since
+0.4.0; also listed in `inlineDsl.ts` `KNOWN_SUBCOMMANDS` so they are never read as
+an inline m0 string).
 Two of the 18 sit inside `if (DEV_MODE) { … }` and are absent from the public
 help — see the DEV-GATED rows below.
 
@@ -58,12 +62,15 @@ help — see the DEV-GATED rows below.
 | Command (index.ts line) | What it does |
 |---|---|
 | `make <input>` (~5095) | Primary render: template id / `.mosaic` / `.mosaicx` → video or image. Full flag surface below. |
-| `hello-world` | The first render — a thin alias for `make @m0saic/hello-world/v1` (the brand card; output defaults to `hello-world.mp4`). With `--template-repo <path...>` / `--community-repo <path>` it renders the loaded repo's **front door** instead: the first repo (load order) whose `repo.helloWorld` names a template that registered, announced as `Front door: <id> — <repo>'s hello-world`; no repos, or none that name one → the core card with a one-line why. Takes `-o -w -h --fps --durationMs --props --quiet --verbose` (no engine surface). Picker: the CLI source (not published). |
+| `hello-world` | The first render — a thin alias for `make @m0saic/hello-world/v1` (the brand card; output defaults to `hello-world.mp4`). With `--template-repo <path...>` it renders the loaded folder's **front door** instead: the first flagged repo (load order) whose `repo.helloWorld` names a template that registered (installed repos never are the front door; the community one is `m0saic make @m0saic-community/hello-world/v1` after `m0saic community fetch`), announced as `Front door: <id> — <repo>'s hello-world`; no repos, or none that name one → the core card with a one-line why. Takes `-o -w -h --fps --durationMs --props --quiet --verbose` (no engine surface). Picker: the CLI source (not published). |
 | `make-wireframe` (~5462) | Static wireframe PNG from `--m0 <string>` or `--mfile <path>`. |
 | `make-wireframe-animated` (~5568) | Animated wireframe MP4 from `--m0`/`--mfile`; extra `--disable-ui`. |
 | `flatten <input>` (~5680) | Inline all `type:mosaic` children of a `.mosaic`/template into one flat JSON doc — no render. |
 | `resolve <input>` (~5800) | `.mosaicx` recipe → resolved `.mosaic` provenance doc, no ffmpeg; `--flatten` also inlines children. |
-| `list-templates` (~5946) | Print registered template ids (`--json`); annotates primitive/internal/deprecated. |
+| `list-templates` (~6103) | Print registered template ids, grouped by source (since 0.4.0): `Built-in: N templates`, then `Installed <repo id> (<name>): <tag>, signed|unsigned, N templates` (community first), then `Folder <path>, <repo id> (<name>): N templates` for `--template-repo`. A heading is one line that never starts with `@`; ids stay one per line, flush left. `--source <name>` lists one group: `builtin`, `community`, or a repo id with or without `@` (any case); an unknown name exits 1 and lists the sources. `--json` = a flat sorted id array, filtered by `--source`. Annotates primitive/internal/deprecated. Grouping: the CLI source (not published). |
+| `community fetch` | **Since 0.4.0.** Install or update the official community templates from their latest signed GitHub release bundle, or report them current (`--force` reinstalls, `--quiet`). A valid signature is required. See "Installed template repos" below. Impl: the CLI source (not published). |
+| `install [source]` | **Since 0.4.0.** Install a template repo from its release bundle: `owner/repo[@tag]`, a GitHub repo or release page, a `bundle.json` / `.tgz` URL, or a bundle on disk. No source: list what is installed (`--json`). A third-party repo: once `bundle.json` is read, the third-party code notice, then a question (repo, tag, templates, size; default No) before the runtime downloads; `--yes` skips it and is required with no terminal (CI, pipes: exit 1, nothing installed). A repo signed by m0saic (second-party) gets one line instead, no question. Given the official community repo in any GitHub form, it runs `community fetch` instead. A private repo needs its access key: `--key-env <name>`, then `M0SAIC_REPO_KEY`, then the key saved for it; in a terminal it asks once and saves it. `--force`, `--quiet`. |
+| `uninstall <repoId>` | **Since 0.4.0.** Remove an installed template repo (files + entry) and its saved access key, if any; exit 1 with the installed ids when it is not installed. |
 | `doctor <repoDir>` | **Public since 0.2.0** (dev-gated at 0.1.0; founder ruling 2026-09-16, BURN-DOWN D5 → publish). Run the template conventions over a template repo folder — the same checks its build gate (`tools/check-registry.mjs`) runs, from outside (agents, reviewers, forks, CI on a fork): definition-time + render-time conventions (the 13 throw-posture ones incl. `latticeSmooth`) and, when the repo commits `layout-fingerprints/` or `.layout.m0` sidecars, the fingerprint diff. `--json` (one object: `ok, repo, mode, loadDiagnostics, rendered, skipped, errors, warnings, notes, fingerprints, conventions`), `--sweep` (also render on the standard 1080p canvases → `canvasEnvelope`), `--entry <path>`, `--src <dir>`. Loads through `loadTemplateRepoFromPath` under the external origin scope, so conventions RECORD rather than throw and one bad template never hides the rest. **Runs the repo's template module bodies in-process** — prints a trust warning to stderr (not under `--json`). Exit 1 on any error-severity finding or a fatal load diagnostic. It is the pack-publishing contract for community/starter authors ("the publish requirement for packs"). Impl: the CLI source (not published); locked public by `__tests__/cli.surface.test.js`. |
 | `browse-templates` (~6033) | **DEV-GATED** (whole command inside `if (DEV_MODE)`, 4792): interactive TTY picker (template → variant → confirm → delegates to `make`). It drives the E2E variant matrix and writes to `test-output/` — a development harness, not a user surface. |
 | `momo <message…>` (~6282) | **DEV-GATED** (whole command inside `if (DEV_MODE)`, 5040): relay English geometry instruction to Momo in a running Mosaic Desktop over the loopback bridge; exit 0 applied / 2 not-applied / 1 couldn't-run. |
@@ -177,8 +184,9 @@ mosaic; prints `Validation DEGRADED`), `--report` (`.output.json` /
 `--keep-temp`, `--quiet`, `--verbose`, `--prefer-pretty-m0` /
 `--prefer-canonical-m0` (printed-m0 form only; note: NOT `--prefer-*-m0saic`),
 `--background-color <color>`, `--template-repo <path...>` +
-`--template-repo-entry <file>` (external template repos), `--community-repo <path>`
-(ONE checkout of the official community repo — see the community gate below).
+`--template-repo-entry <file>` (a template repo folder for one run). Installed
+repos load with no flag; `--community-repo` was removed in 0.4.0 — see
+"Installed template repos" and the community gate below.
 
 **Encode surface** (index.ts:~4231-4338, mirrors the Make page's Advanced panel;
 precedence: flags > `.m0v` preset > doc-on-disk > engine default):
@@ -235,34 +243,140 @@ and neither is `doctor` (public since 0.2.0).
 > `momo` / `browse-templates` finds hits; that is the router table, not the
 > gated implementation.
 
-## External template repos and the community gate (2026-09-16)
-
-**Three reserved identities, exact-match, nothing else is checked:** template
-namespaces `@m0saic/` and `@m0saic-dev/`, repo id `@m0saic-community`
-(`index.ts:~907-909`; registry compare is case-insensitive, `templateRegistry.ts:~112`).
-Every other namespace / repo id is open. `--template-repo` never grants anything.
-
-**The grant.** `--community-repo <path>` says "this IS the official repo"; the
-`@m0saic-dev/` grant comes only from `verifyCommunityRelease()` (`@m0saic/product`
-`communityRelease.ts`) passing on the checkout's `release.json` against
-`LICENSE_PUBLIC_KEYS` (`publicKeys.ts` — the licence k1 family; rotation = append
-`k2`, ship, sign with `M0SAIC_SIGNING_KID=k2`; older CLIs report `unknown-kid`).
-The gate runs BEFORE the entry module is imported. All gate/notice lines go to
-stderr (survive `--quiet`, keep `--json` stdout clean):
-
-- ok → `✓ community repo verified: <tag> (signed, <kid>)`
-- else → `⚠  <path> is not a verified release of the official community repo
-  (<reason>). Loaded as an ordinary template repo — its @m0saic-dev/ ids are
-  refused. Get the official checkout: the link on m0saic.io/community` → the
-  reserved ids are refused in ONE collapsed line, `⚠  [template-repo]
-  TEMPLATE_ID_RESERVED_NAMESPACE: refused <N> ids in reserved namespace
-  (@m0saic-dev/…): <id1>, <id2>, <id3>, …` (other rejection codes stay one line
-  each) → the existing `❌ Refusing to use template repo` block → **exit 1**.
+## External template repos and the community gate (2026-09-16; installs 2026-10-13)
+
+**Three reserved namespaces and one reserved repo id, exact-match, nothing else
+is checked:** template namespaces `@m0saic/`, `@m0saic-dev/`, `@m0saic-community/`
+and repo id `@m0saic-community` (`RESERVED_TEMPLATE_NAMESPACES` /
+`RESERVED_COMMUNITY_REPO_ID` in `index.ts`; registry compare is case-insensitive,
+`templateRegistry.ts`). Every other namespace / repo id is open. A `--template-repo`
+folder never gets a grant in a shipped build.
+
+**Installed template repos (CLI 0.4.0).** `m0saic community fetch` and
+`m0saic install <source>` put release bundles (`bundle.json` + `runtime.tgz`,
+written by https://github.com/m0saic-project/m0saic-community-templates/blob/main/tools/pack-bundle.mjs — the starter's
+`npm run bundle` — and attached to a GitHub release; previews and samples are
+never downloaded) into `~/m0saic/template-repos/` (`M0SAIC_ROOT` moves it):
+`installed.json` + one unpacked runtime per repo at `<slug>/<tag or sha-…>/`.
+The store, download and checks are `@m0saic/product` `templateBundle.ts` (index
+parse, source resolution, download with a 30 s idle timeout + HTTP Range resume +
+size/sha256 checks, an extractor that writes only regular files and folders —
+links, devices, `..`, absolute paths, backslashes, `node_modules`,
+Windows-illegal names and duplicates are refused) and `installedTemplateRepos.ts`
+(lock, staging + swap, the signature and reserved-namespace checks). `community
+fetch` reads `github.com/m0saic-project/m0saic-community-templates/releases/latest/
+download/bundle.json` (`M0SAIC_COMMUNITY_GITHUB_REPO` overrides; the bundle must
+still verify) and installs, updates, or reports current; a signed install that no
+longer verifies is reinstalled. Install refusals: `not-signed` (any
+`@m0saic-community` bundle that does not verify — dev builds also take an
+unsigned one), `reserved-namespace` (manifest ids in a reserved namespace,
+unless the verified community repo), `check-failed` (the CLI loads the staged
+copy once, `checkStagedTemplateRepo`, before it replaces anything),
+`wrong-repo`, size / hash / tree mismatches, `busy` (another install holds
+`.lock`), `declined` (the question below answered no, cancelled, or no terminal
+and no `--yes`).
+
+**Asking first (2026-10-13).** `install` reads `bundle.json`, then decides
+(product `installTemplateBundle({ confirm })`: the hook runs after the index and
+the "current" check, before the runtime download, and the store lock is taken
+after it, so an open question never holds `.lock`; false throws `declined`). A
+copy that is already current is reported with no question. A third-party repo
+(a bare `.tgz` too) gets the notice, then `Install @acme (Acme Templates)
+v2026.10.1 (12 templates, 640 KB)?` (`Update @acme v2026.10.0 → v2026.10.1
+(…)?`, `Reinstall …?` for `--force` over the same tag, `Install the template
+repo at <source>?` with no `bundle.json`), default No: no prints `Nothing
+installed.`, exit 1. With no terminal (stdin or stdout not a TTY, or `CI` set)
+and no `--yes`: `✗ Not installed: m0saic asks before it installs a template
+repo, and there is no terminal to ask on.` + `Approve it explicitly: m0saic
+install <source> --yes`, exit 1, the runtime never downloaded (the `setup`
+rule). `--yes` never asks. The notice prints once per install, never at load.
+
+**One way in for the community templates.** `community fetch` never asks.
+`install` given the community repo's GitHub releases in any form
+(`owner/repo[@tag]`, the repo or a release page, a release file's URL; product
+`isCommunityBundleSource`) prints `The community templates install with m0saic
+community fetch; running that.` and runs it: the same pins (signed only, repo id
+`@m0saic-community` only), recorded as `community`, a tag kept
+(`fetchCommunityTemplates({ source })`). A `@m0saic-community` bundle from
+anywhere else (one packed on disk, tested before it is published) installs
+through `install` with no notice and no question, printing
+`@m0saic-community is m0saic's official community repo: it installs only if
+m0saic's signature verifies.`: safe on an unverified claim, since a bundle naming
+that repo id installs only if it verifies and an index that disagrees with the
+manifest inside is refused. A community not-found says `No community templates
+release there.` (a third-party one points at m0saic.io/developers/bundles).
+
+**Three tiers (2026-10-13).** First-party: the built-in templates and the community
+repo (signed; the only holder of the reserved namespaces). Second-party: a repo
+signed by m0saic in its own namespace (one m0saic built for a customer, signed with
+`scripts/sign-template-repo.mjs` like the starters; the starters land here too).
+Third-party: unsigned. `install` acts on `bundle.json`'s `signed` before the
+download: a second-party bundle prints `<repo id> (<name>) is signed by m0saic: it
+installs only if that signature verifies.`, with no third-party notice, no question
+and no `--yes` needed. The product refuses any bundle whose `bundle.json` says signed
+and whose signature does not verify (`not-signed`: `bundle.json says it is signed by
+m0saic, but the signature does not verify (<reason>)`), before the CLI's load check
+runs any code; it is never installed unsigned. A signature is not a namespace grant:
+a signed repo other than the community repo using reserved ids is still
+`reserved-namespace`.
+
+**Private repos (an access key, 2026-10-13).** A private GitHub repo that publishes
+bundles installs like any other, plus an access key: today a fine-grained GitHub
+token its owner hands out (that repo, Contents read-only). The key comes from
+`--key-env <NAME>` (the variable must be set; a source that is not a GitHub release
+exits 1), then `M0SAIC_REPO_KEY`, then the key saved for that owner/repo in
+`~/m0saic/template-repo-keys.json` (mode 0600, by lowercase owner/repo). There is no
+`--key <value>` flag (shell history, process lists). In a terminal, a GitHub source
+that answers not-found with no key, or refuses the key (`auth-failed`, `no-access`),
+prints why and asks `Access key for owner/repo (Enter to stop)` (masked), retries,
+and saves a key that worked (`Saved the access key for owner/repo (<file>); updates
+use it.`); keys from the environment are never saved. With no terminal, a GitHub
+not-found adds `A private repo needs its access key: run this in a terminal to enter
+it, or set M0SAIC_REPO_KEY.` Transport: `GET api.github.com/repos/<o>/<r>/releases/
+latest` (or `/tags/<tag>`) lists the assets, `bundle.json` is the index, and each
+file is `GET …/releases/assets/<id>` with `Accept: application/octet-stream` and
+`redirect: manual`; GitHub's redirect is followed without the key, which is only ever
+sent to `https://api.github.com` (`downloadToFile` refuses any other host). Every
+GitHub release form carries `githubRelease` (owner/repo[@tag], the repo and release
+pages, release file URLs; product `resolveKeyedGitHubSource`). Errors: `auth-failed`
+(401), `no-access` (404/403 with a key; a used-up rate limit is `http-error`).
+Records gain `github` ("owner/repo", lowercase, on any GitHub install) and
+`access: "key"`, never the key; `m0saic install` lists keyed repos `private`;
+`uninstall` deletes the saved key (`✓ removed … and its saved access key`). Access
+ending changes nothing installed (it keeps working offline); updates stop.
+
+**Loading.** `make`, `hello-world`, `list-templates` and `mcp` load the installed
+repos with no flag, once per process (the MCP server sees a new install after a
+restart), after any `--template-repo` folders — a folder with the same repo id
+wins (the developer's clone over its installed release) — and quietly (no notice,
+no "Loaded" line). An installed repo that fails to load is skipped with one
+warning instead of stopping the command. Installed repos never become
+`hello-world`'s front door. A not-registered `@m0saic-dev/…` /
+`@m0saic-community/…` id adds the hint `m0saic community fetch` when the
+community templates are not installed.
+
+**The grant.** The reserved namespaces go only to the installed
+`@m0saic-community` whose `release.json` passes `verifyCommunityRelease()`
+(`@m0saic/product` `communityRelease.ts`) against `LICENSE_PUBLIC_KEYS`
+(`publicKeys.ts` — the licence k1 family; rotation = append `k2`, ship, sign with
+`M0SAIC_SIGNING_KID=k2`; older CLIs report `unknown-kid`). It is checked at install
+and again on EVERY load (`gateCommunityRepo`, before the entry module is
+imported): pass → silent; fail → the copy is skipped, never imported (not even as
+an ordinary repo), with one stderr line: `⚠  [template-repo] the installed
+community templates (<tag>) no longer verify (<why>); skipped. Reinstall: m0saic
+community fetch --force`. A `--template-repo` folder whose repo id is
+`@m0saic-community` loads under ordinary rules in a shipped build: its reserved
+ids are refused in ONE collapsed line, `⚠  [template-repo]
+TEMPLATE_ID_RESERVED_NAMESPACE: refused <N> ids in reserved namespaces
+(@m0saic-community/…, @m0saic-dev/…): <id1>, <id2>, <id3>, …` (other rejection
+codes stay one line each) → `❌ Refusing to use template repo` with the hint
+`install its signed release instead: m0saic community fetch` → **exit 1**.
 
 **`release.json` v1:** `{ schemaVersion: 1, tag, publishedAt, treeSha256,
 signature: { kid, alg: "ed25519", sig: <base64url> } }` (`--unsigned` omits
 `signature`; the legacy `{ tag, publishedAt }` reads as `missing-signature`).
-Tree = every file under `dist/**` + `template-manifest.json` + `package.json`,
+Tree = every file under `dist/**` + `template-manifest.json` + `package.json` +
+`template-catalog.json` (each root file only when present),
 sorted POSIX paths, one `"<path>\0<sha256>\n"` line each; `*.json` hashed on
 `JSON.stringify(JSON.parse(text))` (BOM stripped; CRLF / re-indent survive, a
 key reorder does not), other files raw bytes; no symlink is ever followed.
@@ -287,7 +401,8 @@ repo root from the HOST's own `node_modules` walk — the CLI's vendored copies,
 the desktop's bundle, the workspace under dev — never from the checkout. So a
 clone with nothing installed loads anywhere (0.2.0 is the first CLI that
 can), and a `node_modules/@m0saic/template-utils` planted beside a tree is
-never evaluated, via `--community-repo` or `--template-repo` alike. Every
+never evaluated through a `--template-repo` folder (an installed copy with a
+`node_modules` beside its tree is refused by the gate before any import). Every
 other specifier (`sharp`, `@twemoji/svg`, relative paths) resolves as before,
 from the checkout. CommonJS only — an `.mjs` entry's static `import`s use the
 ESM resolver, which has no hook.
@@ -297,12 +412,33 @@ with `M0SAIC_SIGNING_KEY_FILE` (REQUIRED — no default path; production laptop
 only) under `M0SAIC_SIGNING_KID` (default `k1`), self-verifies against the
 embedded keys, writes `.gitattributes` (`* -text`). Unset or missing key =
 refused, never a silent unsigned release; `--unsigned` = loud banner, a snapshot
-no shipped CLI trusts.
+no shipped CLI trusts. After the tag: `node tools/pack-bundle.mjs --tag <tag>` in
+the snapshot, then `gh release create <tag> -R m0saic-project/m0saic-community-templates
+bundle/bundle.json bundle/runtime.tgz bundle/previews.tgz` — what `community fetch`
+installs (the mint's next steps print both lines).
+
+**Samples (2026-10-20).** A pack may ship sample pictures and clips for people
+with no assets yet: `template-manifest.json` names the folder in
+`repo.assets.samplesDir` (say `"samples"`), and `pack-bundle.mjs` packs every
+file under it as a third archive, `samples.tgz` (`bundle.json.samples {file,
+sha256, size, files, unpackedSize, dir} | null`; `--no-samples` skips it; the
+folder must sit inside the repo, hold no links, and stay under 128 MB unpacked —
+`samples-outside-repo`, `samples-missing`, `samples-too-large`). A manifest that
+names no folder ships none. Mosaic Desktop installs it beside the previews (best
+effort, `installed.json.samples = installed | none | failed`) and shows the
+folder as the Files dock's first place, "Samples" (a plain `samples/` folder in
+a clone or the dev stand-in counts too); the CLI never fetches it. Add
+`bundle/samples.tgz` to the `gh release create` line when the packer prints it.
 
 **DEV seam (workspace builds only, inside `if (DEV_MODE)`):** reasons
-`missing-release` / `missing-signature` are still granted — `✓ community repo:
-<path> (dev build: unsigned community checkout trusted)` (the in-repo
-https://github.com/m0saic-project/m0saic-community-templates/blob/main has no `release.json`) — and
+`missing-release` / `missing-signature` are still granted — for an installed copy
+(and `m0saic install` takes an unsigned community bundle), and for a
+`--template-repo` folder whose repo id is `@m0saic-community`: `✓ community
+templates from <path> (dev build: --template-repo trusted when it verifies or is
+unsigned)` (the in-repo https://github.com/m0saic-project/m0saic-community-templates/blob/main has no `release.json`;
+`scripts/bake-front-door-preview.mjs` and the community render e2e load it this
+way, against the real `~/m0saic` toolchain and license; a FIFO/socket/device tree
+is refused there) — and
 `M0SAIC_COMMUNITY_TRUST_KEY_PEM` (+ `M0SAIC_COMMUNITY_TRUST_KEY_KID`, default `k1`)
 adds a public key for tests. Tampered tree, forged release or unknown kid are
 refused even in dev. The tarball folds `process.env.M0SAIC_DEV` to `"0"` and the
@@ -310,14 +446,15 @@ audit bans the token, so none of this ships.
 
 **Lookalikes are a display concern** — one stderr line for UNSIGNED repos, never a
 refusal: `⚠  [template-repo] <subject> is not an official m0saic namespace — only
-@m0saic/ and @m0saic-dev/ are, and they are signed.` Subject: loaded publisher
-namespaces starting with `@m0saic` that are not exactly the two reserved ones →
+@m0saic/, @m0saic-dev/, @m0saic-community/ are, and they are signed.` Printed for a
+`--template-repo` folder on every load, for an installed repo once (at install).
+Subject: loaded publisher namespaces starting with `@m0saic` that are not exactly
+the reserved ones →
 else a repoId matching `/m0saic|mosaic/i` → else `"<displayName>" (<repoId>)`.
 Never for repoId exactly `@m0saic-community`: via `--template-repo` that gets
 `⚠  [template-repo] repo id "@m0saic-community" is reserved for the official
-community repo and this checkout is unverified — loading it under ordinary
-rules.` A `--community-repo` checkout that fails the gate gets ONLY the
-not-verified notice.
+community repo; this folder loads under ordinary rules (the signed release
+installs with: m0saic community fetch).`
 
 **Desktop:** `installVersion()` runs `validateCommunityTree` → `verifyCommunityTree`
 (inline-requires `@m0saic/product`) → refuses `tag-mismatch`; failure =
@@ -327,20 +464,23 @@ not-verified notice.
 seed/installed load path (`loadCommunityRepo`) does not re-verify; consent gate
 unchanged.
 
-Help wording for `make` / `hello-world` / `list-templates` is ONE string,
-test-locked (`__tests__/cli.flags.test.js`): "…Grants the @m0saic-dev/ namespace
-when its release signature verifies (unsigned or modified checkouts load as
-ordinary repos); the community checkout loads only this way".
+Help (test-locked, `__tests__/cli.surface.test.js`): the root epilog lists
+`m0saic community fetch`, `m0saic install <source>` and `--template-repo`;
+`make` / `hello-world` / `list-templates` carry `--template-repo` and point at
+`m0saic community fetch`; `--community-repo` is an unknown option
+(`cli.flags.test.js`). The gate and every on-disk tampering case are locked by
+`__tests__/community-install.signing.e2e.test.js`, the install flow by
+`__tests__/template-install.e2e.test.js`.
 
 ### Hardening (rounds 2 + 3, 2026-09-16)
 
-**Host-first `@m0saic/*` resolution.** https://github.com/m0saic-project/m0saic-packages/blob/main/packages/platform/src/template-repos/hostFirstResolution.ts (wired in `loadTemplateRepoFromPath.ts` via `registerHostFirstRepoRoot(repoRoot)` before the native `import(file://…)` of the entry): ONE wrapper around Node's real `Module._resolveFilename` (found by walking the prototype chain — under Jest `node:module` exports a subclass copy), installed once per process, persistent so render-time lazy requires are covered. A request matching `/^@m0saic\/[^/\\]+(?:\/.*)?$/` whose requesting module lies under a registered root (realpath'd) is resolved from the HOST's own `node_modules` walk — never the checkout's. Everything else (relative paths, non-`@m0saic` deps, host code) is untouched. CJS only. Consequences: a community clone loads from ANY directory with no `node_modules` (before this, `--community-repo` only worked inside the monorepo); a planted `node_modules/@m0saic/*` beside a verified tree is never evaluated, via either flag; a starter's `file:` link to `@m0saic/template-utils` resolves to the same physical package — no drift.
+**Host-first `@m0saic/*` resolution.** https://github.com/m0saic-project/m0saic-packages/blob/main/packages/platform/src/template-repos/hostFirstResolution.ts (wired in `loadTemplateRepoFromPath.ts` via `registerHostFirstRepoRoot(repoRoot)` before the native `import(file://…)` of the entry): ONE wrapper around Node's real `Module._resolveFilename` (found by walking the prototype chain — under Jest `node:module` exports a subclass copy), installed once per process, persistent so render-time lazy requires are covered. A request matching `/^@m0saic\/[^/\\]+(?:\/.*)?$/` whose requesting module lies under a registered root (realpath'd) is resolved from the HOST's own `node_modules` walk — never the checkout's. Everything else (relative paths, non-`@m0saic` deps, host code) is untouched. CJS only. Consequences: a template repo loads from ANY directory with no `node_modules` (an installed bundle never has one); a planted `node_modules/@m0saic/*` beside a tree is never evaluated through a `--template-repo` folder (and an installed copy carrying one is refused by the gate before import); a starter's `file:` link to `@m0saic/template-utils` resolves to the same physical package — no drift.
 
-**Fail-closed tree verification** (`inspectReleaseTree` in `communityRelease.ts`; desktop mirror `inspectCommunityTree` in the Mosaic Desktop / Web app source (not published), run by `installVersion`). A release tree is plain files and directories, nothing else. Refused, in this order after the signature check and before the hash compare: `symlink-in-tree` (ANY symlink — file or dir — under `dist/**`, `dist` itself, a signed root file, or ANY entry at the checkout root); `special-file-in-tree` (FIFO / socket / device anywhere in the same places — a FIFO named `dist/publishers.js` shadows the signed `dist/publishers/` dir and blocks or executes whoever opens it); `foreign-modules` (a `node_modules` dir at the root or under `dist/`, matched case-insensitively). `verifyCommunityRelease` lstats `release.json` before opening it (a FIFO planted there used to hang the verifier). The hasher THROWS `ReleaseTreeError` on a special entry rather than skipping it; `signCommunityRelease` refuses to sign such a tree. The signed payload is `"m0saic-community-release/v1\n<tag>\n<publishedAt>\n<treeSha256>\n"`. The CLI notice carries the detail for these reasons — `(foreign-modules: node_modules)`; for `special-file-in-tree` the CLI does NOT load the folder at all (an ordinary load provably hangs): notice + `❌ Refusing to use template repo` + exit 1.
+**Fail-closed tree verification** (`inspectReleaseTree` in `communityRelease.ts`; desktop mirror `inspectCommunityTree` in the Mosaic Desktop / Web app source (not published), run by `installVersion`). A release tree is plain files and directories, nothing else. Refused, in this order after the signature check and before the hash compare: `symlink-in-tree` (ANY symlink — file or dir — under `dist/**`, `dist` itself, a signed root file, or ANY entry at the checkout root); `special-file-in-tree` (FIFO / socket / device anywhere in the same places — a FIFO named `dist/publishers.js` shadows the signed `dist/publishers/` dir and blocks or executes whoever opens it); `foreign-modules` (a `node_modules` dir at the root or under `dist/`, matched case-insensitively). `verifyCommunityRelease` lstats `release.json` before opening it (a FIFO planted there used to hang the verifier). The hasher THROWS `ReleaseTreeError` on a special entry rather than skipping it; `signCommunityRelease` refuses to sign such a tree. The signed payload is `"m0saic-community-release/v1\n<tag>\n<publishedAt>\n<treeSha256>\n"`. The CLI's skip line carries the detail for these reasons — `(foreign-modules: node_modules)`; an installed copy that fails is never imported, so a `special-file-in-tree` (an ordinary load provably hangs) cannot block the process; a dev `--template-repo` community folder with one is refused (`❌ Refusing to use template repo` + exit 1).
 
 **Community deps.** The `@m0saic-dev/community-m` pack (the only `sharp` / `@twemoji/svg` user) was deleted as defunct on 2026-09-16; both left the community `package.json` and BOTH allowlists (`dep-allowlist.json` ↔ `TEMPLATE_REPO_DEP_ALLOWLIST`, lockstep-tested). Community templates may import only what the hosts ship: `@m0saic/{types,template-utils,dsl-stdlib,platform,dsl}` + `node:path`. A native or third-party runtime dep is a founder decision. `sharp` survives only as a root devDependency for core/templates tests.
 
-**Accepted residual.** A third-party `--template-repo` checkout with its own `node_modules` runs its own copies of non-`@m0saic` deps — third-party code, with the notice printed; it cannot obtain a reserved identity that way (adversary-verified). DEV builds (`M0SAIC_DEV=1`, compile-stripped from the tarball) still trust an unsigned checkout for `missing-release` / `missing-signature` only; a tampered or forged tree is refused even in dev.
+**Accepted residual.** A third-party `--template-repo` checkout with its own `node_modules` runs its own copies of non-`@m0saic` deps — third-party code, with the notice printed; it cannot obtain a reserved identity that way (adversary-verified). DEV builds (`M0SAIC_DEV=1`, compile-stripped from the tarball) still trust an unsigned community copy (installed, or a `--template-repo` folder) for `missing-release` / `missing-signature` only; a tampered or forged tree is refused even in dev.
 
 ## Wireframe commands
 

package/node_modules/@m0saic/knowledge/docs/runtime/ffmpeg-expression-limits.md

@@ -115,3 +115,10 @@ at t=0 or grind at ~1 fps. That one is neither parse depth nor `geq` eval cost
 that wall is engine-internal: `.ai/moat/runtime/macos-swscale-thread-cap.md`
 (absent in the shipped copy; symptom summary: dense still-image canvases freeze
 at t=0 / grind ~1 fps on macOS — the engine's threadGuard mitigates it).
+Since 0.4.0 the same guard also caps every video decoder in a dense command:
+past six threaded video inputs each `-i` takes `-threads K` (K = 32 / inputs,
+between 1 and 4), because each mp4 decoder otherwise keeps a frame-thread pool of
+one thread per core plus that many frames in flight — 22 inputs on an 8 GB machine
+swapped until the kernel panicked. Stills, lavfi graphs and the engine's own qtrle
+intermediates are not counted. Measured on the panic case (16 videos, 5 s at
+1080p, 8 GB): 29 s, 1.3 GB peak, no swap.

package/node_modules/@m0saic/knowledge/docs/templates/README.md

@@ -53,7 +53,8 @@ duplicated here.
 [`prop type: json`](reference/json-prop-type.md) ·
 [`template flags`](reference/template-flags.md) ·
 [`grid builder`](reference/grid.md) · [`MosaicColor`](reference/mosaic-color.md) ·
-[`prop bindings`](reference/prop-bindings.md)
+[`prop bindings`](reference/prop-bindings.md) ·
+[`brand schema`](reference/brand-schema.md)
 
 ## patterns/ — distilled experience
 
@@ -63,3 +64,6 @@ duplicated here.
   early template generation.
 - [`primitive-extraction-pattern.md`](patterns/primitive-extraction-pattern.md)
   — when/how to extract primitives (incl. Rule 7: verify NESTED).
+- [`print-authoring.md`](patterns/print-authoring.md) — P1–P6 for a deliverable
+  that goes to paper: paper's black floor, the gap a pattern needs, recheck the
+  small inks, lock it in a test, proof on the stock.

package/node_modules/@m0saic/knowledge/docs/templates/patterns/print-authoring.md

@@ -0,0 +1,97 @@
+# Print authoring rules
+
+> Templates layer. For any template whose deliverable goes to paper (cards, banners,
+> wraps, posters). A screen is backlit; paper only reflects, and has a black floor.
+> Tune a print palette on the screen and the shadows that read there print as one
+> flat black. P1–P5 were paid for by a printed business card (2026-10-18); P6 by a
+> 10 ft booth banner (2026-10-16).
+
+## P1 — A dark pattern must clear paper's black floor
+Paper only gets so black. Soft-proofed through Adobe's press profiles, a near-black
+navy (#050314, L\* 1.3 on screen) prints at **L\* 11 on coated stock (FOGRA39)** and
+**L\* 29 on uncoated stock (FOGRA29)**. Everything darker than the floor collapses
+onto it, and the gaps just above it shrink. Keep every ink that must stay distinct
+well clear of it: the pattern at **L\* 28 or more** in the file, at least **25 L\*
+over the ground**. That prints about 20 apart on coated stock and 10 on uncoated.
+
+Paid for: `@m0saic/brand/business-card/v1` and `v2` tuned the dark field on screen,
+tiles at L\* 6.5 on an L\* 1.3 navy (`DEFAULT_FIELD_OPACITY = 0.28`,
+https://github.com/m0saic-project/m0saic-packages/blob/main/packages/templates/src/m0saic/brand/business-card/v1/business-card.ts#L142). The
+printed cards were flat black; the brick showed only under a strong light. The
+soft proof agrees: those tiles print 2.4 L\* above the navy on coated stock and 1.6 on
+uncoated. v3's dark tiles default to #434574 (L\* 31.1), which prints 20 and 10.6 above
+(https://github.com/m0saic-project/m0saic-packages/blob/main/packages/templates/src/m0saic/brand/business-card/v3/business-card.ts#L174).
+
+**Lift the lightness, keep the hue, and raise the chroma — then raise it again for
+paper.** A dark brand colour lifted to print lightness at its old chroma reads as
+grey: v3's first cut, #48465C (chroma 14), was the navy's hue but looked like slate.
+Luminance stays put as chroma rises, so the print gap and every text contrast hold.
+Print also takes chroma away: soft-proofed, chroma 24 printed at 21 (coated) and 17
+(uncoated), and chroma 30 printed at 26 and 20, with the hue steady (294° → 288°).
+Only 30 still read blue on uncoated stock, so v3 ships 30. Judge hue and chroma in
+CIELCh through the press profile, not by eye on a backlit screen.
+
+## P2 — A light pattern needs a smaller gap
+Highlights survive print well. About **9 L\* under the page** reads as "clearly there,
+still soft": business card v3's light tiles #E5DCD0 under an ivory #FAF7F2, the same
+tint as the jewelry booth's printed fabric banner.
+
+## P3 — Lifting a dark pattern lowers text contrast; recheck the small inks
+Text sits on the pattern as well as the ground. When the tiles move from L\* 6.5 to
+30.8, v2's secondary grey #8A89A3 falls to 2.7:1. v3 lifts it to #B0AFC6 (4.2:1 on
+the tiles, 9.5:1 on the navy) so the 8 pt role / handle / command lines still read
+(https://github.com/m0saic-project/m0saic-packages/blob/main/packages/templates/src/m0saic/brand/business-card/v3/business-card.ts#L257). Hold
+secondary inks to **4:1 or better against the pattern**.
+
+## P4 — Lock print contrast in a test
+Compute L\* and contrast from the template's palette function, and assert P1–P3. A
+later screen-only tweak then cannot quietly undo them. Reference: the "print
+contrast" block in
+https://github.com/m0saic-project/m0saic-packages/blob/main/packages/templates/src/m0saic/brand/business-card/v3/business-card.test.ts#L138.
+
+## P5 — Soft-proof, then proof on the stock you are ordering
+Stocks differ: uncoated, coated and fabric each have their own floor and gamut.
+First soft-proof. Take each ink sRGB → the press CMYK profile (relative colorimetric
+with black-point compensation, a RIP's usual RGB path), then → Lab (absolute
+colorimetric) for what the sheet will measure. littleCMS through Pillow's
+`ImageCms` does it with Adobe's `CoatedFOGRA39.icc` / `UncoatedFOGRA29.icc`. Then give
+the reviewer a ladder, a few strengths of the knob that sets the pattern, to print
+before the order. Keep that knob exposed (v3: `fieldOpacity`) so a stock that needs
+more can get it without a new version.
+
+Re-verify (as of 2026-10-18):
+`grep -n "DEFAULT_FIELD_OPACITY\|DARK_FIELD_INK\|#B0AFC6" https://github.com/m0saic-project/m0saic-packages/blob/main/packages/templates/src/m0saic/brand/business-card/v3/business-card.ts
+
+## P6 — Print scale: the walls past 8K
+A 10 ft banner at 150 DPI is 18000 × 14400 px, 259 MP. Measured on the 8 GB M1 Air
+(`@qsbuilds/booth/backdrop/v1`, 2026-10-16; re-measured 2026-10-20 through the
+engine's own jpeg path):
+
+- **ffmpeg's frame limit** is `(8·W + 1024)·(H + 128) < 2^31 − 1`
+  (`av_image_check_size`). 18000 × 14400 passes by about 2 %; at that width a frame
+  can be at most 14679 px tall, so a 120 × 102 in artwork (pocket allowance) does not
+  fit at 150 DPI (146 DPI is the most). Compute this in the template and refuse with
+  the max DPI; do not discover it in ffmpeg.
+- **It renders.** About 105 flat tiles plus one masked M: 128–148 s and ~1.5 GB peak
+  RSS for the lossless PNG master, which is under 1 MB for flat colour art. One scaled
+  image at the same size goes straight to a jpeg in 6 s at 1.4 GB.
+- **JPEG at that size is the engine's job since 0.4.0.** Every `.jpg` still is
+  `mjpeg` at `yuvj444p` with the quantizer pinned to the best tables
+  (`-q:v 1 -qmin 1 -qmax 1`), one encoder thread, and `-huffman default` once the
+  canvas is 64 MP or more: the encoder's default `-huffman optimal` buffers every
+  coefficient of ~12 M blocks and failed to open (`ENOMEM`) at 259 MP. Huffman is
+  lossless, so quality is unchanged. `encodes` to `jpeg` / `png` / `tiff` / `bmp`
+  reach a real muxer too. A `.jpg` output or a `jpeg` encode is enough; the `mjpeg`
+  container with hand-set encoder options is no longer needed.
+- **Metadata:** the engine writes no DPI and no ICC. A JPEG's JFIF APP0 density and
+  an APP2 `ICC_PROFILE` can be written afterwards by rebuilding only the header
+  segments, leaving the scan data byte-identical (the booth's `render.mjs` does this).
+- **Proof labels:** svg-rasterized text is one inline mask per line; ~45 labels over
+  a full-canvas drawbox track drove `OVERLAY_CHAIN_DEEP` to 24. Plain `drawtext`
+  labels (no `rasterizer`) carry no mask; the only mask left is the logo.
+- **Keep inches authoritative** and convert edges, not sizes, with one rounding
+  rule. Never upscale a proof. Verify the written file (dimensions, chroma sampling,
+  density, profile, a full decode), not the plan.
+
+Re-verify (as of 2026-10-20):
+`grep -n "DEFAULT_JPEG_STILL_HUGE_PIXELS\|huffman" the render engine source (not published)

package/node_modules/@m0saic/knowledge/docs/templates/reference/brand-schema.md

@@ -0,0 +1,73 @@
+# A template repo's brand schema (`m0saic.brand.json`)
+
+**Since:** Mosaic Desktop 0.4.0 line (2026-10-19). **Applies to:** any template repo a solution or a
+Mosaic Consumer install connects. The CLI ignores the file.
+
+## What it is
+
+A person using Mosaic for Jewelry, or a Mosaic Consumer install built around one business, fills in
+their details **once** — "Your brand" on the Templates page: a name, a logo, colours, a website, where
+they post most — and every design that has a place for those opens with them already in. The profile is
+kept per solution on the machine as `~/m0saic/solutions/<id>/brand.m0v`, the `brand` slot of a Mosaic
+Vocabulary (`.m0v`; see `file-formats/m0p-and-custom-field.md` §1).
+
+A template repo says **what to ask for** and **which props take it** by shipping `m0saic.brand.json`
+at its root, beside `m0saic.workspace.json`:
+
+```json
+{
+  "fields": [
+    { "key": "lyricFont", "label": "Your font", "placeholder": "The one your lyrics land in", "kind": "choice",
+      "options": [{ "value": "anton", "label": "Anton" }, { "value": "bebas-neue", "label": "Bebas Neue" }] },
+    { "key": "textColor", "label": "Lyric colour", "placeholder": "#FFFFFF", "kind": "color" },
+    { "key": "fontFile", "label": "Your own font file", "placeholder": "A .ttf or .otf", "kind": "file" },
+    { "key": "channel", "label": "Where you post most", "kind": "choice",
+      "options": [{ "value": "instagram-reel", "label": "Instagram Reels" }, { "value": "tiktok", "label": "TikTok" }] }
+  ],
+  "props": { "font": "lyricFont", "textColor": "textColor", "fontFile": "fontFile", "platform": "channel" }
+}
+```
+
+- `fields[]` — what the profile asks for. `key` (a prop-style identifier), `label`, optional
+  `placeholder`, and `kind`: `text` | `color` | `file` | `choice`. A `choice` needs `options`
+  (`{ value, label }`; a bare string is a value that is its own label). A value outside the options is
+  never seeded.
+- `props` — template prop name → field key. **Top-level props only.** The field must be one of
+  `fields[]` (or one of the app's own, below).
+
+## What Desktop does with it
+
+- Reads the file when the repo loads (a local folder, or a GitHub source once installed), beside the
+  manifest; drops it when the source is forgotten.
+- **Seeds on a fresh open.** When a template opens with no props of its own (not from a `.mosaicx`, a
+  share link or an agent), every mapped prop the template declares gets the profile's value, folded into
+  the template's **defaults** — so the open is not dirty, a rebuild keeps the values, and a saved recipe
+  carries them like any value. The person can still change any of them per post. A `media` prop takes
+  the file path; a `media[]` prop takes a one-item list.
+- **Asks only what some prop takes.** The profile shows the fields that some mapped prop reads; a field
+  nothing reads would promise what no design does.
+- **Merges across repos.** A solution may have a map of its own (the jewelry pack's prop names are declared
+  in the app) and several connected repos; the solution's map comes first, then each repo's, and a prop
+  is never re-mapped once mapped.
+- **The app's own fields win for their keys:** `name`, `tagline`, `logo`, `accent`, `site`, `email`,
+  `phone`, `address`, `platform` (the app's channel list: story / feed / square / landscape / email). A
+  repo mapping `brand → name` gets the app's "Brand name" field. A repo whose `platform` prop takes
+  **its own** values should map it to a key of its own (`channel`), not `platform`.
+
+## Authoring rules
+
+- One schema per repo, at the root. Keep the prop names consistent across the repo's templates — the
+  schema is the API the templates adhere to; a template that spells `brandName` differently is simply
+  not seeded.
+- Keys are identifiers (`^[a-zA-Z][a-zA-Z0-9]*$`); at most 24 fields. Odd fields and unmapped props are
+  dropped, not fatal.
+- The file is outside the signature (`dist/` + the manifest, package and catalog): adding or changing it never
+  moves a release's verdict. It rides in `runtime.tgz` when present (packer `BRAND_FILE`, 2026-10-20), so a repo
+  installed from a release has it too — **re-pack and re-publish the bundle** after changing it; a clone or the
+  dev stand-in reads it straight from disk.
+- The CLI reads none of this; a `.mosaicx` written by Make carries the seeded values as plain props.
+
+## See also
+
+- `templates/reference/prop-bindings.md` — how props reach tiles on the canvas.
+- `file-formats/m0p-and-custom-field.md` §1 — `.m0v`, the Mosaic Vocabulary, and its `brand` slot.