@joewinke/jatui 0.36.3 → 0.38.0

package/dist/artifact-blocks/blocks/checklist/schema.js

@@ -0,0 +1,91 @@
+/**
+ * Params schema for the checklist block (the living UAT / test checklist).
+ * Imported by block.ts (def), ChecklistBlock.svelte (props typing) and the
+ * tests — keeps them cycle-free.
+ */
+import { z } from "zod";
+export const CHECKLIST_STATUSES = [
+    "pass",
+    "fail",
+    "blocked",
+    "untested",
+];
+/**
+ * The TEAM status vocabulary (teamMode only, mos-mssz0): the viewer's four
+ * verdicts plus two agent-side progress states a viewer never sets —
+ * `in_progress` (the team is working the row) and `ready` (fixed, ready for
+ * the viewer to retest). A `ready` row is what makes a page "need you" on
+ * /admin/artifacts without any jat task link.
+ */
+const CHECKLIST_TEAM_STATUSES = [
+    ...CHECKLIST_STATUSES,
+    "ready",
+    "in_progress",
+];
+/**
+ * URL policy for test links: https:// or root-relative only.
+ * LOCAL COPY of the shared `urlSchema` the blocks contract points at
+ * (src/lib/artifact-blocks/params.ts, owned by the core blocks task
+ * mos-bqeoa — not landed when this block shipped). When params.ts lands,
+ * switch this field to the shared schema; the policy is identical. Kept
+ * module-private so the dead-exports gate stays clean (phase-1 discipline).
+ */
+const urlSchema = z
+    .string()
+    .max(2048)
+    .refine((s) => /^(https:\/\/|\/(?!\/))/.test(s.trim()), "URL must be https:// or root-relative (/…) — no javascript:, data:, http:// or protocol-relative URLs");
+const rowSchema = z.object({
+    /** Stable id the per-viewer status/note state keys on — keep it stable
+     * across republishes or the viewer's verdicts lose their row. */
+    id: z
+        .string()
+        .regex(/^[a-z0-9][a-z0-9_-]{0,63}$/, "row id must be lowercase a-z0-9_- (max 64)"),
+    title: z.string().min(1, "row title is required").max(200),
+    /** The test URL — where this row is verified (page or the thing itself). */
+    url: urlSchema.optional(),
+    /** Who owns / should verify this row, e.g. an agent or person (max 80). */
+    owner: z.string().max(80).optional(),
+    /** Authored note — what to test, what landed, how it's measured. */
+    note: z.string().max(2000).optional(),
+    /**
+     * Authored status: the row's starting status ("untested" when omitted), and
+     * in teamMode the SHARED/team status column (update it by republishing).
+     * `ready` / `in_progress` are team-only and need teamMode.
+     */
+    status: z.enum(CHECKLIST_TEAM_STATUSES).optional(),
+    /**
+     * teamMode: when the team last marked this row `ready` (ISO timestamp). A
+     * viewer verdict set before it is stale — the row awaits their retest
+     * again. Omitted = any viewer verdict other than untested answers it.
+     */
+    retestSince: z.iso.datetime({ offset: true }).optional(),
+});
+const ROWS_MAX = 200;
+export const checklistSchema = z
+    .object({
+    /** Optional heading above the rows. */
+    title: z.string().max(120).optional(),
+    rows: z
+        .array(rowSchema)
+        .min(1, "at least one row")
+        .max(ROWS_MAX, `at most ${ROWS_MAX} rows`),
+    /**
+     * teamMode — the authored status in params is the TEAM status (what the
+     * agents/republish recorded); the viewer's own status renders beside it as
+     * a private "yours" column. Without it the authored status is just the
+     * starting seed for the viewer's single status column.
+     */
+    teamMode: z.boolean().optional(),
+})
+    .superRefine((v, ctx) => {
+    if (v.teamMode)
+        return;
+    v.rows.forEach((row, i) => {
+        if (row.status === "ready" || row.status === "in_progress")
+            ctx.addIssue({
+                code: "custom",
+                path: ["rows", i, "status"],
+                message: `status "${row.status}" is a team status — set teamMode: true`,
+            });
+    });
+});

package/dist/artifact-blocks/blocks/code/CodeBlock.svelte

@@ -0,0 +1,128 @@
+<script lang="ts">
+  /**
+   * code block — highlighted code with filename, line-number gutter,
+   * highlighted lines and a copy button.
+   *
+   * The highlighter (./highlight) is a pure, dependency-free tokenizer that
+   * returns STRUCTURED tokens; every token renders as a plain <span> so
+   * Svelte escapes the text — never {@html} (contract: params are untrusted).
+   * Token colors are DaisyUI semantic classes via a static map.
+   *
+   * The copy button uses jatui's copyText (clipboard API with an
+   * execCommand fallback for plain-HTTP origins) and confirms with a short
+   * "Copied" state. Read-only safe: no per-viewer state is saved, so the
+   * block renders identically on the public share route.
+   */
+  import Icon from "../checklist/Icon.svelte"
+  import { copyText } from "../../../utils/clipboard.js"
+  import type { BlockProps } from "../../types.js"
+  import {
+    highlightLines,
+    languageFromFilename,
+    resolveLanguage,
+    TOKEN_CLASS,
+    type Language,
+  } from "./highlight.js"
+  import { type CodeParams } from "./schema.js"
+
+  let { params }: BlockProps<CodeParams> = $props()
+
+  const lang = $derived<Language>(
+    resolveLanguage(params?.language) === "plain" && params?.filename
+      ? languageFromFilename(params.filename)
+      : resolveLanguage(params?.language),
+  )
+
+  const code = $derived(params?.code ?? "")
+  const lines = $derived(highlightLines(code, lang))
+  const gutterWidth = $derived(String(lines.length).length)
+  const highlighted = $derived(new Set(params?.highlightLines ?? []))
+
+  /** One line row's classes — both branches are static literals (Tailwind
+   * extracts literals; dynamic class names never work). */
+  function rowClass(n: number): string {
+    return highlighted.has(n)
+      ? "flex px-2 bg-primary/8 border-l-2 border-l-primary"
+      : "flex px-2"
+  }
+
+  let copied = $state(false)
+  let copyTimer: ReturnType<typeof setTimeout> | undefined
+
+  async function onCopy() {
+    const ok = await copyText(code)
+    if (!ok) return
+    copied = true
+    if (copyTimer) clearTimeout(copyTimer)
+    copyTimer = setTimeout(() => (copied = false), 2000)
+  }
+</script>
+
+<figure class="artifact-code w-full">
+  <div
+    class="overflow-hidden rounded-box border border-base-content/10 bg-base-200/40"
+  >
+    <!-- header: filename / language chip + copy -->
+    <div
+      class="flex items-center gap-2 border-b border-base-content/10 bg-base-100/60 px-3 py-1.5"
+    >
+      {#if params?.filename}
+        <span
+          class="truncate rounded-field bg-base-content/5 px-2 py-0.5 font-mono text-xs font-medium text-base-content/80"
+        >
+          {params.filename}
+        </span>
+      {/if}
+      <span
+        class="ml-auto shrink-0 text-2xs uppercase tracking-wide text-base-content/45"
+      >
+        {lang === "plain" ? "text" : lang}
+      </span>
+      {#if params?.copy !== false}
+        <button
+          type="button"
+          class="btn btn-ghost btn-xs rounded-field shrink-0 gap-1 text-base-content/70"
+          onclick={onCopy}
+          aria-label="Copy code to clipboard"
+        >
+          {#if copied}
+            <Icon name="check" size={13} aria-hidden="true" />
+            <span aria-live="polite">Copied</span>
+          {:else}
+            <Icon name="copy" size={13} aria-hidden="true" />
+            <span>Copy</span>
+          {/if}
+        </button>
+      {/if}
+    </div>
+
+    <!-- code viewport -->
+    <div
+      class="overflow-auto font-mono text-xs leading-relaxed"
+      style:max-height="{params?.maxHeightPx ?? 420}px"
+    >
+      <pre class="m-0 p-0"><code
+          class="block min-w-max px-1 py-2 text-base-content"
+          >{#each lines as lineTokens, i (i)}
+            <div class={rowClass(i + 1)}>
+              {#if params?.lineNumbers !== false}
+                <span
+                  class="select-none pr-3 text-right text-base-content/35 tabular-nums"
+                  style:min-width="{gutterWidth}ch"
+                  aria-hidden="true">
+                  {i + 1}
+                </span>
+              {/if}
+              <!-- The token spans ARE the text (escaped by Svelte, read once
+                   by screen readers, selectable and copyable as usual). -->
+              <span class="whitespace-pre"
+                >{#each lineTokens as t, k (k)}<span class={TOKEN_CLASS[t.type]}
+                    >{t.text}</span
+                  >{/each}</span
+              >
+            </div>
+          {/each}</code
+        ></pre>
+    </div>
+  </div>
+</figure>

package/dist/artifact-blocks/blocks/code/CodeBlock.svelte.d.ts

@@ -0,0 +1,12 @@
+import type { BlockProps } from "../../types.js";
+declare const CodeBlock: import("svelte").Component<BlockProps<{
+    code: string;
+    lineNumbers: boolean;
+    copy: boolean;
+    maxHeightPx: number;
+    filename?: string | undefined;
+    language?: "html" | "plain" | "typescript" | "javascript" | "json" | "bash" | "yaml" | "css" | "python" | "sql" | "diff" | undefined;
+    highlightLines?: number[] | undefined;
+}>, {}, "">;
+type CodeBlock = ReturnType<typeof CodeBlock>;
+export default CodeBlock;

package/dist/artifact-blocks/blocks/code/block.d.ts

@@ -0,0 +1,8 @@
+/**
+ * code block — highlighted code with filename, line numbers, highlighted
+ * lines and a copy button.
+ */
+import type { ArtifactBlockDef } from "../../types.js";
+import { type CodeParams } from "./schema.js";
+declare const def: ArtifactBlockDef<CodeParams>;
+export default def;

package/dist/artifact-blocks/blocks/code/block.js

@@ -0,0 +1,31 @@
+import CodeBlock from "./CodeBlock.svelte";
+import { codeSchema } from "./schema.js";
+const EXAMPLE_CODE = `import { describe, expect, it } from "vitest"
+import { mount } from "svelte"
+import CodeBlock from "./CodeBlock.svelte"
+
+describe("code block", () => {
+  it("renders every line", async () => {
+    const lines = highlightLines("const n = 42", "typescript")
+    expect(lines).toHaveLength(1)
+    expect(lines[0][0].type).toBe("keyword")
+  })
+})`;
+const EXAMPLE = {
+    filename: "CodeBlock.client.test.ts",
+    language: "typescript",
+    code: EXAMPLE_CODE,
+    lineNumbers: true,
+    highlightLines: [6],
+    copy: true,
+    maxHeightPx: 420,
+};
+const def = {
+    type: "code",
+    title: "Code",
+    description: "Highlighted code with a filename label, a line-number gutter, spotlighted lines and a copy button. Params: code (required, up to 50,000 chars — rendered escaped as text, never evaluated), filename (also picks the language from the extension), language (typescript|javascript|json|bash|yaml|html|css|python|sql|diff|plain — inferred from the filename when omitted, unknown values fall back to plain), lineNumbers (default true), highlightLines (up to 50 one-based line numbers to spotlight), copy (default true), maxHeightPx (scroll viewport, default 420). The highlighter is a small token map, not a language server — good for review snippets and config, not for whole compilable programs. Tip: one logical snippet per block; put the takeaway in a markdown block before it and point highlightLines at the lines that matter.",
+    schema: codeSchema,
+    component: CodeBlock,
+    example: EXAMPLE,
+};
+export default def;

package/dist/artifact-blocks/blocks/code/highlight.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Code block — a small, dependency-free, token-only syntax highlighter.
+ *
+ * Why hand-rolled: the repo has no highlighter dependency (no shiki/prism),
+ * and block params are UNTRUSTED input (CONTRACT.md) — the only sanctioned
+ * {@html} path is the markdown block's sanitized renderer. So this tokenizer
+ * returns STRUCTURED tokens ({ text, type }) and CodeBlock.svelte renders
+ * each as a plain <span> — Svelte escapes everything, nothing is ever
+ * interpreted. Colors are DaisyUI semantic classes only (token-only rule);
+ * the mapping is a static table (no dynamic class names).
+ *
+ * It is deliberately modest: a handful of languages with regex rules and a
+ * keyword set each, plus a plain fallback. The goal is readable code on a
+ * review page — not a language server.
+ */
+export type TokenType = "plain" | "comment" | "string" | "number" | "keyword" | "literal" | "tag" | "attr" | "heading" | "add" | "del" | "punct";
+/** Static class map — Tailwind extracts these literals; never build one. */
+export declare const TOKEN_CLASS: Record<TokenType, string>;
+/** Curated set. `plain` is the fallback everything falls back to. */
+export declare const LANGUAGES: readonly ["typescript", "javascript", "json", "bash", "yaml", "html", "css", "python", "sql", "diff", "plain"];
+export type Language = (typeof LANGUAGES)[number];
+/** Filename → language (used when params omit an explicit language). */
+export declare function languageFromFilename(filename: string | undefined): Language;
+/** A param value (`"ts"`, `"Typescript"`, `"text/plain"`) → a known language. */
+export declare function resolveLanguage(value: string | undefined): Language;
+export interface Token {
+    text: string;
+    type: TokenType;
+}
+/**
+ * Tokenize `code` into lines of tokens. Never throws: on any internal error
+ * it degrades to plain text — a broken highlight must never break the page.
+ */
+export declare function highlightLines(code: string, language: Language): Token[][];

package/dist/artifact-blocks/blocks/code/highlight.js

@@ -0,0 +1,280 @@
+/**
+ * Code block — a small, dependency-free, token-only syntax highlighter.
+ *
+ * Why hand-rolled: the repo has no highlighter dependency (no shiki/prism),
+ * and block params are UNTRUSTED input (CONTRACT.md) — the only sanctioned
+ * {@html} path is the markdown block's sanitized renderer. So this tokenizer
+ * returns STRUCTURED tokens ({ text, type }) and CodeBlock.svelte renders
+ * each as a plain <span> — Svelte escapes everything, nothing is ever
+ * interpreted. Colors are DaisyUI semantic classes only (token-only rule);
+ * the mapping is a static table (no dynamic class names).
+ *
+ * It is deliberately modest: a handful of languages with regex rules and a
+ * keyword set each, plus a plain fallback. The goal is readable code on a
+ * review page — not a language server.
+ */
+/** Static class map — Tailwind extracts these literals; never build one. */
+export const TOKEN_CLASS = {
+    plain: "",
+    comment: "text-base-content/45 italic",
+    string: "text-success",
+    number: "text-info",
+    keyword: "text-primary font-medium",
+    literal: "text-secondary",
+    tag: "text-error",
+    attr: "text-accent",
+    heading: "text-primary font-semibold",
+    add: "text-success",
+    del: "text-error",
+    punct: "text-base-content/60",
+};
+// ── Languages ───────────────────────────────────────────────────────────────
+/** Curated set. `plain` is the fallback everything falls back to. */
+export const LANGUAGES = [
+    "typescript",
+    "javascript",
+    "json",
+    "bash",
+    "yaml",
+    "html",
+    "css",
+    "python",
+    "sql",
+    "diff",
+    "plain",
+];
+const ALIASES = {
+    ts: "typescript",
+    tsx: "typescript",
+    js: "javascript",
+    jsx: "javascript",
+    mjs: "javascript",
+    cjs: "javascript",
+    json: "json",
+    jsonc: "json",
+    sh: "bash",
+    shell: "bash",
+    zsh: "bash",
+    console: "bash",
+    yml: "yaml",
+    yaml: "yaml",
+    html: "html",
+    xml: "html",
+    svelte: "html",
+    vue: "html",
+    css: "css",
+    scss: "css",
+    py: "python",
+    python: "python",
+    sql: "sql",
+    diff: "diff",
+    patch: "diff",
+    text: "plain",
+    txt: "plain",
+    md: "plain",
+};
+/** Filename → language (used when params omit an explicit language). */
+export function languageFromFilename(filename) {
+    if (!filename)
+        return "plain";
+    const m = /\.([a-z0-9]+)$/i.exec(filename.trim());
+    if (!m)
+        return "plain";
+    return ALIASES[m[1].toLowerCase()] ?? "plain";
+}
+/** A param value (`"ts"`, `"Typescript"`, `"text/plain"`) → a known language. */
+export function resolveLanguage(value) {
+    if (!value)
+        return "plain";
+    const v = value.trim().toLowerCase();
+    if (LANGUAGES.includes(v))
+        return v;
+    if (ALIASES[v])
+        return ALIASES[v];
+    const base = v.split(/[/+.-]/)[0];
+    if (base && LANGUAGES.includes(base))
+        return base;
+    if (base && ALIASES[base])
+        return ALIASES[base];
+    return "plain";
+}
+const KEYWORDS = {
+    typescript: new Set("abstract any as asserts async await boolean break case catch class const continue debugger declare default delete do else enum export extends false finally for from function get if implements import in infer instanceof interface is keyof let namespace never new null number of object operator override package private protected public readonly return satisfies set static string super switch symbol this throw true try type typeof undefined union unique unknown var void while with yield".split(" ")),
+    javascript: new Set("async await break case catch class const continue debugger default delete do else export extends false finally for from function if import in instanceof let new null of return static super switch this throw true try typeof undefined var void while with yield".split(" ")),
+    json: new Set(["true", "false", "null"]),
+    bash: new Set("if then else elif fi for while until do done case esac function in select time coproc return exit break continue local readonly declare typeset export unset shift eval trap source alias set".split(" ")),
+    python: new Set("and as assert async await break class continue def del elif else except False finally for from global if import in is lambda None nonlocal not or pass raise return True try while with yield match case".split(" ")),
+    sql: new Set("SELECT FROM WHERE INSERT INTO VALUES UPDATE SET DELETE CREATE TABLE ALTER DROP JOIN LEFT RIGHT INNER OUTER ON GROUP BY ORDER HAVING LIMIT OFFSET AS AND OR NOT NULL PRIMARY KEY FOREIGN REFERENCES UNIQUE INDEX VIEW UNION ALL DISTINCT COUNT SUM AVG MIN MAX CASE WHEN THEN ELSE END".split(" ")),
+};
+function wordRules(lang) {
+    const kws = KEYWORDS[lang];
+    return kws
+        ? [
+            {
+                type: "keyword",
+                re: new RegExp(`\\b(?:${[...kws]
+                    .map((k) => k.replace(/[$]/g, "\\$"))
+                    .sort((a, b) => b.length - a.length)
+                    .join("|")})\\b`, "y"),
+            },
+        ]
+        : [];
+}
+const NUMBER_RE = /\b\d[\d_]*(?:\.\d+)?(?:[eE][+-]?\d+)?\b/y;
+const LINE_COMMENT_RE = /(?:\/\/|#(?!\[)|--)[^\n]*/y;
+const BLOCK_COMMENT_RE = /\/\*[\s\S]*?(?:\*\/|$)/y;
+const TEMPLATE_RE = /`(?:\\[\s\S]|[^`\\])*`?/y;
+const SQ_RE = /'(?:\\[\s\S]|[^'\\\n])*'?/y;
+const DQ_RE = /"(?:\\[\s\S]|[^"\\\n])*"?/y;
+function stringRules() {
+    return [
+        { type: "string", re: TEMPLATE_RE },
+        { type: "string", re: DQ_RE },
+        { type: "string", re: SQ_RE },
+    ];
+}
+/** Per-language rule lists, tried in order at each scan position. */
+function rulesFor(lang) {
+    switch (lang) {
+        case "typescript":
+        case "javascript":
+            return [
+                { type: "comment", re: BLOCK_COMMENT_RE },
+                { type: "comment", re: /\/\/[^\n]*/y },
+                ...stringRules(),
+                { type: "number", re: NUMBER_RE },
+                ...wordRules(lang),
+            ];
+        case "json":
+            return [
+                { type: "comment", re: /\/\/[^\n]*/y },
+                ...stringRules(),
+                { type: "number", re: NUMBER_RE },
+                ...wordRules(lang),
+            ];
+        case "bash":
+            return [
+                { type: "comment", re: /#[^\n]*/y },
+                ...stringRules(),
+                { type: "number", re: /\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*|\b\d+\b/y },
+                ...wordRules(lang),
+            ];
+        case "yaml":
+            return [
+                { type: "comment", re: /#[^\n]*/y },
+                ...stringRules(),
+                { type: "heading", re: /^[ \t]*(?:- )?[A-Za-z_][\w.-]*(?=:)/y },
+                { type: "number", re: /\b\d[\d_]*(?:\.\d+)?\b/y },
+                {
+                    type: "literal",
+                    re: /\b(?:true|false|null|yes|no|on|off|True|False|None)\b/y,
+                },
+            ];
+        case "html":
+            return [
+                { type: "comment", re: /<!--[\s\S]*?(?:-->|$)/y },
+                { type: "tag", re: /<\/?[A-Za-z][\w:-]*|\/?>/y },
+                { type: "attr", re: /[A-Za-z_:][\w:.-]*(?==)/y },
+                ...stringRules(),
+            ];
+        case "css":
+            return [
+                { type: "comment", re: /\/\*[\s\S]*?(?:\*\/|$)/y },
+                ...stringRules(),
+                { type: "keyword", re: /@[\w-]+/y },
+                {
+                    type: "attr",
+                    re: /[A-Za-z-]+(?=\s*:)/y,
+                },
+                {
+                    type: "number",
+                    re: /#[0-9a-fA-F]{3,8}\b|\b\d+(?:\.\d+)?(?:%|px|rem|em|vh|vw|s|ms|deg|fr)?\b/y,
+                },
+                { type: "tag", re: /[.#][\w-]+/y },
+            ];
+        case "python":
+            return [
+                { type: "comment", re: /#[^\n]*/y },
+                ...stringRules(),
+                { type: "number", re: NUMBER_RE },
+                ...wordRules(lang),
+            ];
+        case "sql":
+            return [
+                { type: "comment", re: LINE_COMMENT_RE },
+                ...stringRules(),
+                { type: "number", re: NUMBER_RE },
+                ...wordRules(lang),
+            ];
+        case "diff":
+            return [
+                { type: "heading", re: /^(?:@@[^\n]*@@|diff [^\n]*|index [^\n]*)$/my },
+                { type: "del", re: /^-.*$/my },
+                { type: "add", re: /^\+.*$/my },
+                { type: "heading", re: /^(?:---|\+\+\+) [^\n]*/my },
+            ];
+        case "plain":
+        default:
+            return [];
+    }
+}
+/**
+ * Tokenize `code` into lines of tokens. Never throws: on any internal error
+ * it degrades to plain text — a broken highlight must never break the page.
+ */
+export function highlightLines(code, language) {
+    const lines = code.split("\n");
+    const rules = rulesFor(language);
+    const out = [];
+    try {
+        if (rules.length === 0) {
+            for (const line of lines)
+                out.push([{ text: line, type: "plain" }]);
+            return out;
+        }
+        for (const line of lines) {
+            const tokens = [];
+            let i = 0;
+            let buffer = "";
+            const flush = () => {
+                if (buffer) {
+                    tokens.push({ text: buffer, type: "plain" });
+                    buffer = "";
+                }
+            };
+            while (i < line.length) {
+                let matched = false;
+                for (const rule of rules) {
+                    rule.re.lastIndex = i;
+                    const m = rule.re.exec(line);
+                    if (m && m.index === i && m[0].length > 0) {
+                        // Multiline-flagged rules (diff/yaml) match whole lines; when
+                        // they were applied mid-line we still consume to end of line.
+                        let text = m[0];
+                        if (text.includes("\n"))
+                            text = text.replace(/\n[\s\S]*$/, "");
+                        if (text.length === 0)
+                            continue;
+                        flush();
+                        tokens.push({ text, type: rule.type });
+                        i += text.length;
+                        matched = true;
+                        break;
+                    }
+                }
+                if (!matched) {
+                    buffer += line[i];
+                    i += 1;
+                }
+            }
+            flush();
+            if (tokens.length === 0)
+                tokens.push({ text: "", type: "plain" });
+            out.push(tokens);
+        }
+        return out;
+    }
+    catch {
+        return lines.map((l) => [{ text: l, type: "plain" }]);
+    }
+}

package/dist/artifact-blocks/blocks/code/schema.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Params schema for the code block (highlighted code with filename, line
+ * numbers, highlighted lines and a copy button). Imported by block.ts (def),
+ * CodeBlock.svelte (props typing) and the tests — keeps them cycle-free.
+ *
+ * Untrusted input rules (CONTRACT.md): `code` is length-capped and rendered
+ * as TEXT in <span>s — never {@html} (the highlighter returns structured
+ * tokens, Svelte escapes every character).
+ */
+import { z } from "zod";
+export declare const codeSchema: z.ZodObject<{
+    code: z.ZodString;
+    filename: z.ZodOptional<z.ZodString>;
+    language: z.ZodOptional<z.ZodEnum<{
+        html: "html";
+        plain: "plain";
+        typescript: "typescript";
+        javascript: "javascript";
+        json: "json";
+        bash: "bash";
+        yaml: "yaml";
+        css: "css";
+        python: "python";
+        sql: "sql";
+        diff: "diff";
+    }>>;
+    lineNumbers: z.ZodDefault<z.ZodBoolean>;
+    highlightLines: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+    copy: z.ZodDefault<z.ZodBoolean>;
+    maxHeightPx: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>;
+export type CodeParams = z.infer<typeof codeSchema>;

package/dist/artifact-blocks/blocks/code/schema.js

@@ -0,0 +1,39 @@
+/**
+ * Params schema for the code block (highlighted code with filename, line
+ * numbers, highlighted lines and a copy button). Imported by block.ts (def),
+ * CodeBlock.svelte (props typing) and the tests — keeps them cycle-free.
+ *
+ * Untrusted input rules (CONTRACT.md): `code` is length-capped and rendered
+ * as TEXT in <span>s — never {@html} (the highlighter returns structured
+ * tokens, Svelte escapes every character).
+ */
+import { z } from "zod";
+import { LANGUAGES } from "./highlight.js";
+/** 50k chars ≈ ~1.6k lines, inside the ~256KB per-block params budget. */
+const CODE_MAX_CHARS = 50_000;
+const MAX_HIGHLIGHT_LINES = 50;
+export const codeSchema = z.object({
+    /** The code itself. Rendered verbatim, escaped. */
+    code: z
+        .string()
+        .min(1, "code is required")
+        .max(CODE_MAX_CHARS, `keep code under ${CODE_MAX_CHARS} characters`),
+    /** Optional file label in the header (also picks the language). */
+    filename: z.string().max(200).optional(),
+    /**
+     * Language for the highlighter. When omitted it is inferred from the
+     * filename's extension; unknown values fall back to plain text.
+     */
+    language: z.enum(LANGUAGES).optional(),
+    /** Show the line-number gutter (default true). */
+    lineNumbers: z.boolean().default(true),
+    /** 1-based line numbers to spotlight (max 50). Out-of-range is ignored. */
+    highlightLines: z
+        .array(z.number().int().min(1).max(1_000_000))
+        .max(MAX_HIGHLIGHT_LINES)
+        .optional(),
+    /** Offer the copy button (default true). */
+    copy: z.boolean().default(true),
+    /** Scroll viewport height in px (default 420, max 2000). */
+    maxHeightPx: z.number().int().min(120).max(2000).default(420),
+});