Consume the fragment contract from @sphere-pub/node instead of vendoring it

README.md

@@ -114,9 +114,14 @@ and no native dependencies.
 
 ## The fragment contract
 
-The fragment schema and the Node response types are vendored from the
-`sphere-node` repository into `src/contract/`. That repository is the source of
-truth for the contract; this plugin consumes it and does not redefine it.
+The fragment schema and the Node response types come from the
+[`@sphere-pub/node`](https://github.com/marianoviola/sphere-node) package: the
+schema at `@sphere-pub/node/spec/fragment.schema.json` and the types at
+`@sphere-pub/node/contract`. It is a build-time dependency only — the schema is
+bundled into `server/index.js`, and nothing from the node runs inside the
+plugin. That package is the source of truth for the contract; this plugin
+consumes it and does not redefine it (a test fails if a vendored copy
+reappears under `src/contract/`).
 
 ## License
 

package.json

@@ -22,6 +22,7 @@
   },
   "devDependencies": {
     "@anthropic-ai/mcpb": "^1.0.0",
+    "@sphere-pub/node": "^1.1.0",
     "@types/node": "^22.10.0",
     "esbuild": "^0.24.0",
     "sharp": "^0.33.0",

src/core/fragmentIo.ts

@@ -4,7 +4,7 @@
 
 import { readFile, readdir, stat } from "node:fs/promises";
 import { join, basename } from "node:path";
-import type { FragmentManifest } from "../contract/node-api";
+import type { FragmentManifest } from "@sphere-pub/node/contract";
 
 export interface LoadedFragment {
   /** Directory that holds sphere.json. */

src/core/prepare.ts

@@ -4,7 +4,7 @@
 
 import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
-import type { AccessPolicy, FragmentManifest, RelationEdge, SourceRef } from "../contract/node-api";
+import type { AccessPolicy, FragmentManifest, RelationEdge, SourceRef } from "@sphere-pub/node/contract";
 import { validateManifest, type ValidationResult } from "./validate";
 
 export interface PrepareInput {

src/core/readiness.ts

@@ -3,7 +3,7 @@
 // with a severity and a one-line suggestion. Operates on the manifest plus the
 // optional content.md text. No network.
 
-import type { FragmentManifest } from "../contract/node-api";
+import type { FragmentManifest } from "@sphere-pub/node/contract";
 
 export type Severity = "info" | "low" | "medium" | "high";
 

src/core/validate.ts

@@ -1,10 +1,11 @@
-// Structural validation of a fragment manifest against the vendored schema.
+// Structural validation of a fragment manifest against the contract schema
+// shipped by @sphere-pub/node (the source of truth; nothing is vendored here).
 // Pass/fail plus a flat list of structural errors. Hard errors only; advisory
 // gaps live in readiness.ts.
 
-import schema from "../contract/fragment.schema.json";
+import schema from "@sphere-pub/node/spec/fragment.schema.json";
 import { validate as validateAgainstSchema, type JsonSchema } from "./schema";
-import type { FragmentManifest } from "../contract/node-api";
+import type { FragmentManifest } from "@sphere-pub/node/contract";
 
 export interface ValidationResult {
   ok: boolean;

tests/contract.test.ts

@@ -0,0 +1,20 @@
+import { describe, it, expect } from "vitest";
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import schema from "@sphere-pub/node/spec/fragment.schema.json";
+
+// The fragment contract has exactly one home, the @sphere-pub/node package.
+// This plugin used to vendor a copy under src/contract/; these tests keep it
+// from coming back and make sure the schema in the bundle is the package's.
+describe("fragment contract", () => {
+  it("is not vendored in this repository", () => {
+    const vendored = fileURLToPath(new URL("../src/contract", import.meta.url));
+    expect(existsSync(vendored)).toBe(false);
+  });
+
+  it("comes from @sphere-pub/node", () => {
+    expect(schema.$id).toBe("https://sphere.pub/spec/fragment.schema.json");
+    expect(schema.title).toBe("Sphere Fragment Manifest");
+    expect(schema.required).toEqual(["id", "title", "license", "access"]);
+  });
+});