tileflow 0.1.0-alpha.1 → 0.1.0-alpha.3

package/README.md

@@ -131,6 +131,41 @@ Each manifest command entry declares its `outputKind`, `outputVersion`, and stab
 `outputSchemaRef`. `raw-authoring-manifest` and `raw-config-reference` identify the two bootstrap
 documents above; `command-envelope` identifies the ordinary version-1 CLI contract.
 
+## Coordinates
+
+These local commands require an explicitly provided compatible runtime distribution. No public
+native runtime download is currently offered; package installation or the default setup URL does
+not supply one. The verified production profile is Linux x64 on Debian 12, glibc 2.36 and Node 24.
+The examples below use development artifacts and do not establish public platform support.
+
+Coordinates commands use a locally provisioned execution release. They do not use Map
+configuration, account state, or a Hosted fallback. Provision first from a distribution source, then
+run the local commands against the active cache entry or an explicit runtime directory.
+
+```sh
+tileflow setup coordinates --source /path/to/distribution.json --cache-dir /path/to/coordinates-cache --development --json
+tileflow coordinates search --query ETRS89 --runtime-dir /path/to/installed-release --development --json
+tileflow coordinates describe --id EPSG:25830 --runtime-dir /path/to/installed-release --development --json
+tileflow coordinates operations --from EPSG:4258 --to EPSG:25832 --runtime-dir /path/to/installed-release --development --json
+tileflow coordinates transform --from EPSG:4258 --to EPSG:25832 --positions '[[12,55]]' --runtime-dir /path/to/installed-release --development --json
+```
+
+`setup coordinates --source` accepts a distribution URL, a local `distribution.json`, or a directory
+that contains one. `--archive` is a local archive alias and rejects URLs. Setup verifies every asset
+declared by the selected distribution before it records the active release. `--development` is
+required for a development distribution.
+
+Every execution command accepts `--runtime-dir`, `--release`, and `--development`. With no
+`--runtime-dir`, it opens the cache entry selected by setup. `search` accepts `--query`, `describe`
+accepts `--id`, `operations` accepts `--from` and `--to`, and `transform` also accepts JSON
+`--positions`.
+
+For a complete request, use exactly one of `--request '<json>'` or `--input <file|->`. These forms
+cannot be combined with the command's convenience request flags. Input is limited to 32 KiB, must be
+valid UTF-8 JSON, and `-` reads standard input. Success writes one JSON document to stdout. A
+structured failure writes one JSON document to stderr and exits with status 1. Plain `--help` remains
+human-readable; `--help --json` is a structured failure.
+
 `tileflow explain` compiles exactly one map/theme selection through `createStyleResult()` and emits
 its structured `report` and safe compiler `diagnostics`; it deliberately omits the usually large
 MapLibre `style`. In a singular config, `--map` is optional; a multi-map workbench requires it.
@@ -490,6 +525,11 @@ npx tileflow status --map-id map_AbCdEfGhIjKlMnOp
 npx tileflow logout
 ```
 
+Changing or resetting the hosted account password revokes saved personal CLI sessions. The next
+account or hosted command stops with a clear message and asks you to run `tileflow login` again.
+Project API and CI keys are independent project credentials and are not removed by a personal
+password change.
+
 The dashboard creates the Map and browser-access policy before repository setup. Keep that exact
 Map ID in the deploy action. If the config contains several maps, select the authored map explicitly:
 

package/dist/index.js

@@ -10,6 +10,7 @@ import { hostname } from "os";
 import { dirname as dirname10, isAbsolute as isAbsolute4, relative as relative5, resolve as resolve7, sep as sep5 } from "path";
 import { createInterface } from "readline/promises";
 import pc3 from "picocolors";
+import { createLocalCoordinates, setupCoordinates } from "@tileflow/coordinates-runtime";
 import {
   auditTileflowMapThemeValues,
   getTileflowStyleFontFaces,
@@ -64,6 +65,7 @@ import { chmod, mkdir, open, readFile, rename, unlink } from "fs/promises";
 import { homedir } from "os";
 import { dirname, resolve } from "path";
 import { z } from "zod";
+var rejectedAccountSessionMessage = "The saved Tileflow account session is no longer valid. Run tileflow login to authorize this machine again.";
 var maximumAuthFileBytes = 1024 * 1024;
 var maximumOrigins = 16;
 var accountSchema = z.object({
@@ -1588,6 +1590,353 @@ function printHumanConfigInspection(inspection) {
   console.log("Run tileflow inspect --json for the complete machine-readable result.");
 }
 
+// src/coordinates-command.ts
+import { lstat as lstat2, open as open3 } from "fs/promises";
+import { CoordinatesSetupError } from "@tileflow/coordinates-runtime";
+import {
+  CoordinatesContractError,
+  coordinatesFailureSchema,
+  coordinatesLimits,
+  parseCoordinatesJsonRequest,
+  parseCoordinatesRequest
+} from "@tileflow/coordinates/contract";
+var CoordinatesInputError = class extends Error {
+  constructor(reason) {
+    super("Coordinates input could not be read.");
+    this.reason = reason;
+  }
+  reason;
+};
+function registerCoordinatesCommands(program2, dependencies) {
+  const setup = program2.commands.find((command2) => command2.name() === "setup") ?? program2.command("setup").description("Provision local Tileflow tooling");
+  configureCommand(
+    setup.command("coordinates").description("Provision an offline Coordinates execution release").option("--source <url-or-path>", "distribution manifest URL or offline path").option("--archive <path>", "offline archive path alias").option("--cache-dir <path>", "Coordinates cache directory").option("--release <release-id>", "required Coordinates release identity").option("--development", "allow a development distribution").option("--json", "print one JSON receipt")
+  ).action(async (options, command2) => {
+    if (options.help) {
+      printHelp(command2, options.json, () => printSetupFailure());
+      return;
+    }
+    if (command2.args.length > 0 || options.source && options.archive || options.archive && isRemoteLocation(options.archive)) {
+      printSetupFailure(new CoordinatesSetupError("COORDINATES_SETUP_INVALID_REQUEST"));
+      return;
+    }
+    const controller = (dependencies.createSignalController ?? installSignalAbortController)();
+    try {
+      const receipt = await dependencies.setupCoordinates({
+        source: options.archive ?? options.source,
+        cacheDirectory: options.cacheDir,
+        requiredReleaseId: options.release,
+        allowDevelopment: options.development,
+        signal: controller.signal
+      });
+      printDocument(receipt);
+    } catch (error) {
+      printSetupFailure(error);
+    } finally {
+      controller.close();
+    }
+  });
+  const coordinates = program2.command("coordinates").description("Inspect and execute Coordinates requests using a provisioned local release");
+  configureCommand(coordinates).option("--json", "print one JSON response");
+  coordinates.action((options, command2) => {
+    if (options.help) {
+      printHelp(
+        command2,
+        options.json,
+        () => printFailure(invalidRequest(null, "INVALID_VALUE", { path: ["command"] }))
+      );
+      return;
+    }
+    const reason = command2.args.length === 0 ? "INVALID_VALUE" : "UNKNOWN_FIELD";
+    printFailure(invalidRequest(null, reason, { path: ["command"] }));
+  });
+  registerOperation(
+    coordinates,
+    "search",
+    dependencies,
+    (options) => parseRequest("search", options, { query: options.query })
+  );
+  registerOperation(
+    coordinates,
+    "describe",
+    dependencies,
+    (options) => parseRequest("describe", options, { id: options.id })
+  );
+  registerOperation(
+    coordinates,
+    "operations",
+    dependencies,
+    (options) => parseRequest("operations", options, { from: options.from, to: options.to })
+  );
+  registerOperation(
+    coordinates,
+    "transform",
+    dependencies,
+    (options) => parseTransformRequest(options)
+  );
+}
+function registerOperation(coordinates, name, dependencies, parse3) {
+  const command2 = configureCommand(
+    coordinates.command(name).description(`Run the local Coordinates ${name} operation`).option("--request <json>", "complete JSON request").option("--input <path-or-dash>", "complete JSON request file, or - for standard input").option("--runtime-dir <path>", "prepared Coordinates runtime directory").option("--release <release-id>", "required Coordinates release identity").option("--development", "allow a development runtime").option("--json", "print one JSON response")
+  );
+  if (name === "search") command2.option("--query <text>", "search query");
+  if (name === "describe") command2.option("--id <crs-id>", "CRS identifier");
+  if (name === "operations" || name === "transform") {
+    command2.option("--from <crs-id>", "source CRS identifier").option("--to <crs-id>", "target CRS identifier");
+  }
+  if (name === "transform") command2.option("--positions <json>", "JSON coordinate positions");
+  command2.action(async (options, invoked) => {
+    const parent = invoked.parent?.opts();
+    const wantsHelp = options.help ?? parent?.help;
+    const wantsJson = options.json ?? parent?.json;
+    if (wantsHelp) {
+      printHelp(
+        invoked,
+        wantsJson,
+        () => printFailure(invalidRequest(name, "INVALID_VALUE", { path: ["command"] }))
+      );
+      return;
+    }
+    if (invoked.args.length > 0) {
+      printFailure(invalidRequest(name, "UNKNOWN_FIELD", { path: ["options"] }));
+      return;
+    }
+    const controller = (dependencies.createSignalController ?? installSignalAbortController)();
+    let local;
+    try {
+      const request = await resolveRequest(
+        name,
+        options,
+        parse3,
+        dependencies.readInput,
+        controller.signal
+      );
+      local = await dependencies.createLocalCoordinates({
+        directory: options.runtimeDir,
+        requiredReleaseId: options.release,
+        allowDevelopment: options.development,
+        signal: controller.signal
+      });
+      const response = await local[name](request, { signal: controller.signal });
+      await local.close();
+      local = void 0;
+      printDocument(response);
+    } catch (error) {
+      printFailure(error, name);
+    } finally {
+      try {
+        await local?.close();
+      } catch {
+      } finally {
+        controller.close();
+      }
+    }
+  });
+}
+function configureCommand(command2) {
+  return command2.allowUnknownOption(true).allowExcessArguments(true).helpOption(false).option("-h, --help", "display help");
+}
+async function resolveRequest(command2, options, parse3, readInput = readCoordinatesInput, signal) {
+  const rawRequest = options.request !== void 0 || options.input !== void 0;
+  if (options.request !== void 0 && options.input !== void 0 || rawRequest && hasConvenienceOptions(command2, options)) {
+    throw invalidRequest(command2, "INVALID_VALUE", { path: ["request"] });
+  }
+  if (options.request !== void 0) return parseCoordinatesJsonRequest(command2, options.request);
+  if (options.input !== void 0) {
+    try {
+      const input = await readInput(options.input, signal ?? new AbortController().signal);
+      if (signal?.aborted) throw cancelledRequest(command2);
+      return parseCoordinatesJsonRequest(command2, input);
+    } catch (error) {
+      if (signal?.aborted) throw cancelledRequest(command2);
+      if (error instanceof CoordinatesInputError) throw invalidRequest(command2, error.reason);
+      throw error;
+    }
+  }
+  return parse3(options);
+}
+function hasConvenienceOptions(command2, options) {
+  if (command2 === "search") return options.query !== void 0;
+  if (command2 === "describe") return options.id !== void 0;
+  if (command2 === "operations") {
+    const pair = options;
+    return pair.from !== void 0 || pair.to !== void 0;
+  }
+  const transform = options;
+  return transform.from !== void 0 || transform.to !== void 0 || transform.positions !== void 0;
+}
+function parseRequest(command2, options, request) {
+  return parseCoordinatesRequest(command2, request);
+}
+function parseTransformRequest(options) {
+  let positions;
+  try {
+    positions = options.positions === void 0 ? void 0 : JSON.parse(options.positions);
+  } catch {
+    throw invalidRequest("transform", "INVALID_JSON");
+  }
+  return parseCoordinatesRequest("transform", { from: options.from, to: options.to, positions });
+}
+async function readCoordinatesInput(input, signal) {
+  if (input === "-") return readStandardInput(signal);
+  assertNotAborted(signal);
+  let info;
+  try {
+    info = await lstat2(input);
+  } catch {
+    throw new CoordinatesInputError("INVALID_VALUE");
+  }
+  if (!info.isFile() || info.isSymbolicLink()) throw new CoordinatesInputError("INVALID_VALUE");
+  if (info.size > coordinatesLimits.maximumRequestBytes) {
+    throw new CoordinatesInputError("REQUEST_TOO_LARGE");
+  }
+  const handle = await open3(input, "r");
+  try {
+    let length = 0;
+    const bytes = Buffer.alloc(coordinatesLimits.maximumRequestBytes + 1);
+    while (length < bytes.length) {
+      assertNotAborted(signal);
+      const { bytesRead } = await handle.read(bytes, length, bytes.length - length, length);
+      if (bytesRead === 0) break;
+      length += bytesRead;
+    }
+    assertNotAborted(signal);
+    if (length > coordinatesLimits.maximumRequestBytes) {
+      throw new CoordinatesInputError("REQUEST_TOO_LARGE");
+    }
+    return decodeInput(bytes.subarray(0, length));
+  } finally {
+    await handle.close();
+  }
+}
+async function readStandardInput(signal) {
+  const chunks = [];
+  let length = 0;
+  return new Promise((resolve8, reject) => {
+    const finish = (result) => {
+      process.stdin.removeListener("data", onData);
+      process.stdin.removeListener("end", onEnd);
+      process.stdin.removeListener("error", onError);
+      signal.removeEventListener("abort", onAbort);
+      result();
+    };
+    const onAbort = () => {
+      process.stdin.pause();
+      finish(() => reject(new CoordinatesInputError("INVALID_VALUE")));
+    };
+    const onData = (chunk) => {
+      const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      length += bytes.length;
+      if (length > coordinatesLimits.maximumRequestBytes) {
+        process.stdin.pause();
+        finish(() => reject(new CoordinatesInputError("REQUEST_TOO_LARGE")));
+        return;
+      }
+      chunks.push(bytes);
+    };
+    const onEnd = () => finish(() => resolve8(decodeInput(Buffer.concat(chunks))));
+    const onError = () => finish(() => reject(new CoordinatesInputError("INVALID_VALUE")));
+    if (signal.aborted) {
+      onAbort();
+      return;
+    }
+    process.stdin.on("data", onData);
+    process.stdin.once("end", onEnd);
+    process.stdin.once("error", onError);
+    signal.addEventListener("abort", onAbort, { once: true });
+    process.stdin.resume();
+  });
+}
+function invalidRequest(command2, reason, details = {}) {
+  return new CoordinatesContractError({
+    schemaVersion: 1,
+    ok: false,
+    command: command2,
+    releaseId: null,
+    provenance: null,
+    warnings: [],
+    usage: null,
+    error: { code: "COORDINATES_INVALID_REQUEST", reason, details, phase: "input" }
+  });
+}
+function cancelledRequest(command2) {
+  return new CoordinatesContractError({
+    schemaVersion: 1,
+    ok: false,
+    command: command2,
+    releaseId: null,
+    provenance: null,
+    warnings: [],
+    usage: null,
+    error: { code: "COORDINATES_CANCELLED", reason: "CANCELLED", details: {}, phase: "input" }
+  });
+}
+function printDocument(document) {
+  process.stdout.write(`${JSON.stringify(document)}
+`);
+}
+function printFailure(error, command2) {
+  const document = serializeCoordinatesFailure(error, command2) ?? (command2 ? invalidRequest(command2, "INVALID_VALUE").toJSON() : setupFailureDocument());
+  process.stderr.write(`${JSON.stringify(document)}
+`);
+  process.exitCode = 1;
+}
+function printSetupFailure(error) {
+  process.stderr.write(
+    `${JSON.stringify(serializeSetupFailure(error) ?? setupFailureDocument())}
+`
+  );
+  process.exitCode = 1;
+}
+function serializeCoordinatesFailure(error, command2) {
+  if (!(error instanceof CoordinatesContractError)) return void 0;
+  const parsed = coordinatesFailureSchema.safeParse(error.toJSON());
+  if (!parsed.success) return void 0;
+  const failure = parsed.data;
+  return new CoordinatesContractError({
+    ...failure,
+    command: failure.command ?? command2 ?? null
+  }).toJSON();
+}
+function serializeSetupFailure(error) {
+  if (!(error instanceof CoordinatesSetupError)) return void 0;
+  const codes = /* @__PURE__ */ new Set([
+    "COORDINATES_SETUP_INVALID_REQUEST",
+    "COORDINATES_SETUP_RELEASE_UNAVAILABLE",
+    "COORDINATES_SETUP_MANIFEST_INVALID",
+    "COORDINATES_SETUP_ARTIFACT_UNAVAILABLE",
+    "COORDINATES_SETUP_INTEGRITY_FAILED",
+    "COORDINATES_SETUP_INSTALLATION_FAILED",
+    "COORDINATES_SETUP_CANCELLED",
+    "COORDINATES_SETUP_TIMEOUT"
+  ]);
+  if (!codes.has(error.code)) return void 0;
+  return new CoordinatesSetupError(error.code, error.releaseId, error.assetId).toJSON();
+}
+function setupFailureDocument() {
+  return new CoordinatesSetupError("COORDINATES_SETUP_INVALID_REQUEST").toJSON();
+}
+function printHelp(command2, json, printJson) {
+  if (json) {
+    printJson();
+    return;
+  }
+  command2.outputHelp();
+}
+function isRemoteLocation(input) {
+  return /^[A-Za-z][A-Za-z0-9+.-]*:\/\//u.test(input);
+}
+function assertNotAborted(signal) {
+  if (signal.aborted) throw new CoordinatesInputError("INVALID_VALUE");
+}
+function decodeInput(bytes) {
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    throw new CoordinatesInputError("INVALID_VALUE");
+  }
+}
+
 // src/deploy-source.ts
 var overrideFields = [
   ["TILEFLOW_DEPLOY_REPOSITORY", "repository", 255],
@@ -2018,7 +2367,10 @@ async function validateAccountSession(session, options = {}) {
     options
   );
   if (!response.ok) {
-    return { error: `Account session validation failed (${response.status}).`, ok: false };
+    return {
+      error: response.status === 401 ? rejectedAccountSessionMessage : `Account session validation failed (${response.status}).`,
+      ok: false
+    };
   }
   const body = asRecord(response.body);
   const account = asRecord(body.account);
@@ -2110,7 +2462,10 @@ async function requestProjectCapability(session, project, scopes, options = {})
     };
   }
   if (!response.ok) {
-    return { error: `Project capability request failed (${response.status}).`, ok: false };
+    return {
+      error: response.status === 401 ? rejectedAccountSessionMessage : `Project capability request failed (${response.status}).`,
+      ok: false
+    };
   }
   const body = asRecord(response.body);
   if (!response.json || typeof body.capability !== "string" || !body.capability.startsWith("tf_cap_") || body.capability.length > 8192 || body.reference !== project || !validIsoDate(body.expiresAt) || !Array.isArray(body.scopes) || body.scopes.join("\0") !== [...scopes].sort().join("\0")) {
@@ -3661,7 +4016,7 @@ async function accountRequest(session, path, init) {
   }
   return response.ok ? { body: response.body, ok: true, status: response.status } : {
     body: response.body,
-    error: `Request failed (${response.status}).`,
+    error: response.status === 401 ? rejectedAccountSessionMessage : `Request failed (${response.status}).`,
     ok: false,
     status: response.status
   };
@@ -3745,7 +4100,7 @@ import { z as z6 } from "zod";
 
 // src/tileset-upload.ts
 import { createHash } from "crypto";
-import { open as open3, stat } from "fs/promises";
+import { open as open4, stat } from "fs/promises";
 import { z as z5 } from "zod";
 import { serializeCanonicalJson as serializeCanonicalJson2 } from "@tileflow/core";
 var teamTilesetPartSize = 16777216;
@@ -3809,7 +4164,7 @@ async function inspectNodeTeamTilesetArchive(path) {
   return checkedIdentity(value.dev, value.ino, value.mtimeNs, value.size);
 }
 async function openNodeTeamTilesetArchive(path, expectedIdentity) {
-  const handle = await open3(path, "r");
+  const handle = await open4(path, "r");
   const identity = async () => {
     let pathStat;
     let handleStat;
@@ -4824,7 +5179,7 @@ var tilesetPurgeResponseSchema = z6.object({
 }).strict();
 
 // src/visual-command.ts
-import { lstat as lstat3, readFile as readFile6 } from "fs/promises";
+import { lstat as lstat4, readFile as readFile6 } from "fs/promises";
 import { dirname as dirname9, isAbsolute as isAbsolute3, parse as parse2, relative as relative4, resolve as resolve6, sep as sep4 } from "path";
 import {
   analyzeTileflowCaptureReference,
@@ -4843,7 +5198,7 @@ import { compareCodeUnits as compareCodeUnits8 } from "@tileflow/core";
 
 // src/visual-compare-command.ts
 import { createHash as createHash3 } from "crypto";
-import { lstat as lstat2, readFile as readFile5, realpath } from "fs/promises";
+import { lstat as lstat3, readFile as readFile5, realpath } from "fs/promises";
 import { basename as basename3, dirname as dirname8, extname, isAbsolute as isAbsolute2, parse, relative as relative3, resolve as resolve5, sep as sep3 } from "path";
 import {
   compareTileflowCapturesForReview,
@@ -5793,7 +6148,7 @@ async function readVisualCompareInventory(assetDirectory, inventoryPath, boundar
   await assertNoSymlinkComponents(dirname8(inventoryPath), boundary);
   let info;
   try {
-    info = await lstat2(inventoryPath);
+    info = await lstat3(inventoryPath);
   } catch (error) {
     if (isMissingFile4(error)) return [];
     throw error;
@@ -5817,7 +6172,7 @@ async function readVisualCompareInventory(assetDirectory, inventoryPath, boundar
     await assertNoSymlinkComponents(dirname8(path), boundary);
     let assetInfo;
     try {
-      assetInfo = await lstat2(path);
+      assetInfo = await lstat3(path);
     } catch (error) {
       if (isMissingFile4(error)) continue;
       throw error;
@@ -5979,7 +6334,7 @@ function pathsOverlap(left, right) {
 }
 async function assertDirectoryIfPresent(path) {
   try {
-    const info = await lstat2(path);
+    const info = await lstat3(path);
     if (info.isSymbolicLink() || !info.isDirectory()) {
       throw new Error("Visual compare asset path must be a non-symlink directory.");
     }
@@ -5989,7 +6344,7 @@ async function assertDirectoryIfPresent(path) {
 }
 async function pathExists(path) {
   try {
-    await lstat2(path);
+    await lstat3(path);
     return true;
   } catch (error) {
     if (isMissingFile4(error)) return false;
@@ -6343,7 +6698,7 @@ async function readOptionalArtifact(path, boundary, maximumBytes) {
   await assertNoSymlinkComponents(dirname9(path), boundary);
   let info;
   try {
-    info = await lstat3(path);
+    info = await lstat4(path);
   } catch (error) {
     if (isMissingFile5(error)) return void 0;
     throw error;
@@ -6363,7 +6718,7 @@ async function readOptionalArtifact(path, boundary, maximumBytes) {
 async function readVisualReference(path) {
   let info;
   try {
-    info = await lstat3(path);
+    info = await lstat4(path);
   } catch (error) {
     throw new TileflowCaptureError2("BASELINE_INVALID", "The visual reference PNG cannot be read.", {
       cause: error
@@ -6399,7 +6754,7 @@ async function resolveVisualDirectory(cwd, value, kind) {
   const boundary = isInside2(cwd, path) ? cwd : path;
   await assertNoSymlinkComponents(path, boundary);
   try {
-    const info = await lstat3(path);
+    const info = await lstat4(path);
     if (info.isSymbolicLink() || !info.isDirectory()) {
       throw new Error(`Visual ${kind} path must be a non-symlink directory.`);
     }
@@ -7341,6 +7696,7 @@ registerConfigInspectCommand(inspectCommand, { defaultConfigPath });
 registerFeatureInspectCommand(inspectCommand, { defaultConfigPath });
 registerAiCommands(program, { defaultApiUrl, defaultConfigPath });
 registerCaptureCommands(program, { defaultConfigPath });
+registerCoordinatesCommands(program, { createLocalCoordinates, setupCoordinates });
 registerVisualCommands(program, {
   defaultConfigPath,
   openReport: (path) => openBrowser(path, true)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tileflow",
-  "version": "0.1.0-alpha.1",
+  "version": "0.1.0-alpha.3",
   "license": "Apache-2.0",
   "description": "CLI-only tools for Tileflow config, capture, visual testing, and deploy.",
   "type": "module",
@@ -25,10 +25,7 @@
   },
   "files": [
     "dist",
-    "LICENSE",
-    "NOTICE",
-    "GENERATED_OUTPUT_LICENSE.md",
-    "TRADEMARKS.md"
+    "LICENSE"
   ],
   "bin": {
     "tileflow": "./dist/index.js"
@@ -38,12 +35,14 @@
   },
   "dependencies": {
     "@hono/node-server": "2.0.10",
-    "@tileflow/capture": ">=0.1.0-alpha.20 <0.1.0-beta.0",
-    "@tileflow/core": ">=0.1.0-alpha.23 <0.1.0-beta.0",
-    "@tileflow/dev": ">=0.1.0-alpha.21 <0.1.0-beta.0",
-    "@tileflow/maps": ">=0.1.0-alpha.1 <0.1.0-beta.0",
-    "hono": "4.12.34",
+    "@tileflow/capture": ">=0.1.0-alpha.21 <0.1.0-beta.0",
+    "@tileflow/coordinates": ">=0.1.0-alpha.0 <0.1.0-beta.0",
+    "@tileflow/coordinates-runtime": ">=0.1.0-alpha.0 <0.1.0-beta.0",
+    "@tileflow/core": ">=0.1.0-alpha.24 <0.1.0-beta.0",
+    "@tileflow/dev": ">=0.1.0-alpha.22 <0.1.0-beta.0",
+    "@tileflow/maps": ">=0.1.0-alpha.2 <0.1.0-beta.0",
     "commander": "^15.0.0",
+    "hono": "4.13.5",
     "picocolors": "^1.1.1",
     "zod": "^4.4.3"
   },

package/GENERATED_OUTPUT_LICENSE.md

@@ -1,21 +0,0 @@
-# Tileflow generated-output grant
-
-In addition to the rights granted by the Apache License, Version 2.0, Tileflow.dev contributors
-grant recipients a perpetual, worldwide, non-exclusive, no-charge, royalty-free right to use,
-reproduce, modify, display, perform, distribute, sublicense, and commercialize the Tileflow-owned
-parts of output generated by this SDK.
-
-Covered output includes compiled map styles, manifests, receipts, sprites, glyph artifacts, static
-render descriptions, and other build artifacts produced from Tileflow maps or application maps.
-Original Tileflow map definitions, icons, and patterns distributed by `@tileflow/maps` may likewise
-be used, modified, embedded, deployed, and redistributed as part of personal or commercial maps and
-applications.
-
-This grant does not relicense third-party software, fonts, icons, map data, datasets, imagery, or
-other input material. Their licenses, attribution requirements, notices, and use restrictions
-continue to apply to the relevant source and generated output. You are responsible for having the
-rights necessary to process and distribute your own inputs.
-
-This grant does not provide access to Tileflow hosted services or grant rights in Tileflow names,
-logos, or marks. The SDK and generated output are provided without warranties or conditions beyond
-those required by applicable law.

package/NOTICE

@@ -1,9 +0,0 @@
-Tileflow SDK
-Copyright 2026 Tileflow.dev contributors
-
-This product includes software and original map artwork developed by Tileflow.dev contributors.
-
-Third-party materials distributed with a package remain subject to their own license and notice
-files. See THIRD_PARTY_NOTICES.md and asset-adjacent license files where present.
-
-The Tileflow names and marks are not licensed under the Apache License 2.0. See TRADEMARKS.md.

package/TRADEMARKS.md

@@ -1,10 +0,0 @@
-# Tileflow trademarks
-
-The Apache License, Version 2.0, and the Tileflow generated-output grant do not grant permission to
-use the Tileflow name, `tileflow.dev`, logos, service marks, product names, or other Tileflow brand
-features except for reasonable and customary use that truthfully describes the origin of the SDK or
-compatibility with Tileflow, and for reproducing required notices.
-
-You may not use Tileflow brand features in a way that suggests sponsorship, endorsement, or an
-official Tileflow product when none exists. Third-party names and marks remain the property of their
-respective owners.