@joewinke/jatui 0.37.0 → 0.38.0

package/dist/artifact-blocks/params.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Shared param helpers for artifact blocks (mos-bqeoa, epic mos-m1qrx).
+ *
+ * Block params are UNTRUSTED agent input. Every block schema composes these
+ * helpers instead of hand-rolling its own caps, so the security-relevant
+ * rules (URLs may never carry a scheme the browser can act on, text is
+ * length-capped, colors are theme tokens only) live in ONE place and can be
+ * tested once.
+ *
+ * Rendering rules these helpers exist to support (CONTRACT.md):
+ *   - text is rendered as text — never `{@html}` (except the markdown
+ *     block's sanitized renderer);
+ *   - a resource URL (img/video/frame) is `https://…` or root-relative
+ *     (`/path`) — never `http:`, protocol-relative (`//host`),
+ *     `javascript:`, or any other scheme (`urlSchema`);
+ *   - a navigation link may also be `http://…` (`linkUrlSchema`).
+ */
+import { z } from "zod";
+/**
+ * A URL an agent may publish. Two shapes only:
+ *
+ *   - absolute HTTPS: `https://host/...` — the scheme is pinned to https, so
+ *     an `http://` mixed-content load and every non-web scheme are refused;
+ *   - root-relative: `/path/...` — stays on the host origin the page is
+ *     already served from (never `//host`, which the browser resolves as
+ *     protocol-relative and which would leave the origin).
+ *
+ * Refused by construction: `javascript:`, `data:`, `blob:`, `vbscript:`,
+ * `//cdn.evil`, `http://`, relative paths without a leading slash (they
+ * resolve against the artifact page URL and drift with routing), backslash
+ * tricks (`/\\evil.com` — browsers treat a backslash as a slash, and the
+ * point is to stay on-origin), control characters, and whitespace-padded
+ * strings that a href parser might otherwise trim.
+ */
+export declare const urlSchema: z.ZodString;
+/**
+ * A NAVIGATION link an agent may publish (an `<a href>`, never a resource
+ * load): everything `urlSchema` takes, plus absolute `http://`. A link is
+ * the viewer choosing to go somewhere — the https pin exists to stop
+ * mixed-content LOADS (images, frames, media), which a link never does —
+ * and a jat control plane serves its task links over plain http on the
+ * tailnet (PARAMS-SPEC §1: meta href / primaryAction url are "http(s) or
+ * root-relative"). Every other refusal of urlSchema stands.
+ */
+export declare const linkUrlSchema: z.ZodString;
+/** The link policy as a predicate (the markdown renderer's href check). */
+export declare function isSafeLinkUrl(v: string): boolean;
+/** The resource policy as a predicate (img/video src). */
+export declare function isSafeResourceUrl(v: string): boolean;
+/**
+ * The DaisyUI semantic color tokens a block may tint itself with. A block
+ * receives `tone` and resolves it to classes (`text-${tone}` patterns are
+ * FORBIDDEN — dynamic class names break Tailwind extraction and the
+ * token-only theming rule); a component maps each token to its static
+ * class set instead. Hex/rgba/oklch literals are never accepted: theming is
+ * token-only, and a publish that hardcodes a color breaks every tenant's
+ * skin.
+ */
+export declare const TONE_TOKENS: readonly ["primary", "secondary", "accent", "neutral", "info", "success", "warning", "error"];
+export type ToneToken = (typeof TONE_TOKENS)[number];
+export declare const toneSchema: z.ZodEnum<{
+    error: "error";
+    warning: "warning";
+    info: "info";
+    success: "success";
+    primary: "primary";
+    secondary: "secondary";
+    neutral: "neutral";
+    accent: "accent";
+}>;
+/**
+ * A short line: titles, labels, captions, chip text. 200 matches the
+ * artifact title cap; a block header longer than that is copy nobody reads.
+ */
+export declare const shortTextSchema: z.ZodString;
+/**
+ * Body text / descriptions / markdown-lite paragraphs. 5000 is several
+ * screens of prose; beyond that an agent should be publishing structure
+ * (more blocks), not one enormous paragraph.
+ */
+export declare const longTextSchema: z.ZodString;
+/**
+ * An ISO 8601 date or datetime (`2026-10-08`, `2026-10-08T14:30:00Z` — full
+ * offsets accepted). Validated by parse, not just shape: `2026-02-30` is
+ * refused at publish rather than rendering as "Invalid Date".
+ */
+export declare const isoDateSchema: z.ZodString;
+/**
+ * An optional URL field: absent/empty stays undefined rather than becoming
+ * "" (an empty href renders as a link to the current page).
+ */
+export declare const optionalUrlSchema: z.ZodUnion<[z.ZodOptional<z.ZodString>, z.ZodLiteral<"">]>;
+/**
+ * A list of capped strings for chips/tags/points. Blocks declare their own
+ * max length — a chart's max points is a chart decision — but each string is
+ * still shortText-capped so one element cannot smuggle a paragraph.
+ */
+export declare function shortTextList(max: number): z.ZodArray<z.ZodString>;

package/dist/artifact-blocks/params.js

@@ -0,0 +1,159 @@
+/**
+ * Shared param helpers for artifact blocks (mos-bqeoa, epic mos-m1qrx).
+ *
+ * Block params are UNTRUSTED agent input. Every block schema composes these
+ * helpers instead of hand-rolling its own caps, so the security-relevant
+ * rules (URLs may never carry a scheme the browser can act on, text is
+ * length-capped, colors are theme tokens only) live in ONE place and can be
+ * tested once.
+ *
+ * Rendering rules these helpers exist to support (CONTRACT.md):
+ *   - text is rendered as text — never `{@html}` (except the markdown
+ *     block's sanitized renderer);
+ *   - a resource URL (img/video/frame) is `https://…` or root-relative
+ *     (`/path`) — never `http:`, protocol-relative (`//host`),
+ *     `javascript:`, or any other scheme (`urlSchema`);
+ *   - a navigation link may also be `http://…` (`linkUrlSchema`).
+ */
+import { z } from "zod";
+// ---------------------------------------------------------------------------
+// URLs
+// ---------------------------------------------------------------------------
+/**
+ * A URL an agent may publish. Two shapes only:
+ *
+ *   - absolute HTTPS: `https://host/...` — the scheme is pinned to https, so
+ *     an `http://` mixed-content load and every non-web scheme are refused;
+ *   - root-relative: `/path/...` — stays on the host origin the page is
+ *     already served from (never `//host`, which the browser resolves as
+ *     protocol-relative and which would leave the origin).
+ *
+ * Refused by construction: `javascript:`, `data:`, `blob:`, `vbscript:`,
+ * `//cdn.evil`, `http://`, relative paths without a leading slash (they
+ * resolve against the artifact page URL and drift with routing), backslash
+ * tricks (`/\\evil.com` — browsers treat a backslash as a slash, and the
+ * point is to stay on-origin), control characters, and whitespace-padded
+ * strings that a href parser might otherwise trim.
+ */
+export const urlSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .max(2048)
+    .refine((v) => /^https:\/\/[^\s/?#]+[^\s]*$/.test(v) ||
+    /^\/(?!\/|\\)[^\s]*$/.test(v) ||
+    /^#[^\s]*$/.test(v), {
+    message: "must be an https:// URL or a root-relative path starting with a single /",
+});
+/**
+ * A NAVIGATION link an agent may publish (an `<a href>`, never a resource
+ * load): everything `urlSchema` takes, plus absolute `http://`. A link is
+ * the viewer choosing to go somewhere — the https pin exists to stop
+ * mixed-content LOADS (images, frames, media), which a link never does —
+ * and a jat control plane serves its task links over plain http on the
+ * tailnet (PARAMS-SPEC §1: meta href / primaryAction url are "http(s) or
+ * root-relative"). Every other refusal of urlSchema stands.
+ */
+export const linkUrlSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .max(2048)
+    .refine((v) => isSafeLinkUrl(v), {
+    message: "must be an http(s):// URL or a root-relative path starting with a single /",
+});
+/** The link policy as a predicate (the markdown renderer's href check). */
+export function isSafeLinkUrl(v) {
+    return (/^https?:\/\/[^\s/?#]+[^\s]*$/i.test(v) ||
+        /^\/(?!\/|\\)[^\s]*$/.test(v) ||
+        /^#[^\s]*$/.test(v));
+}
+/** The resource policy as a predicate (img/video src). */
+export function isSafeResourceUrl(v) {
+    return /^https:\/\/[^\s/?#]+[^\s]*$/i.test(v) || /^\/(?!\/|\\)[^\s]*$/.test(v);
+}
+// ---------------------------------------------------------------------------
+// Tone — an enum of THEME tokens, never a raw color
+// ---------------------------------------------------------------------------
+/**
+ * The DaisyUI semantic color tokens a block may tint itself with. A block
+ * receives `tone` and resolves it to classes (`text-${tone}` patterns are
+ * FORBIDDEN — dynamic class names break Tailwind extraction and the
+ * token-only theming rule); a component maps each token to its static
+ * class set instead. Hex/rgba/oklch literals are never accepted: theming is
+ * token-only, and a publish that hardcodes a color breaks every tenant's
+ * skin.
+ */
+export const TONE_TOKENS = [
+    "primary",
+    "secondary",
+    "accent",
+    "neutral",
+    "info",
+    "success",
+    "warning",
+    "error",
+];
+export const toneSchema = z.enum(TONE_TOKENS);
+// ---------------------------------------------------------------------------
+// Text caps
+// ---------------------------------------------------------------------------
+/**
+ * A short line: titles, labels, captions, chip text. 200 matches the
+ * artifact title cap; a block header longer than that is copy nobody reads.
+ */
+export const shortTextSchema = z.string().max(200);
+/**
+ * Body text / descriptions / markdown-lite paragraphs. 5000 is several
+ * screens of prose; beyond that an agent should be publishing structure
+ * (more blocks), not one enormous paragraph.
+ */
+export const longTextSchema = z.string().max(5000);
+// ---------------------------------------------------------------------------
+// Dates
+// ---------------------------------------------------------------------------
+/**
+ * An ISO 8601 date or datetime (`2026-10-08`, `2026-10-08T14:30:00Z` — full
+ * offsets accepted). Validated by parse, not just shape: `2026-02-30` is
+ * refused at publish rather than rendering as "Invalid Date".
+ */
+export const isoDateSchema = z
+    .string()
+    .min(4)
+    .max(64)
+    .refine((v) => {
+    // Date.parse is LENIENT: "2026-02-30" parses (it rolls over to March).
+    // Require the ISO shape, reject impossible calendar dates explicitly,
+    // then let the parser reject the rest (offsets, hours).
+    const m = v.match(/^(\d{4})-(\d{2})-(\d{2})(?:[T ](\d{2}):(\d{2})(?::(\d{2})(?:\.\d+)?)?(Z|[+-]\d{2}:?\d{2})?)?$/);
+    if (!m)
+        return false;
+    const [, y, mo, d, hh, mm, ss] = m;
+    const month = Number(mo);
+    if (month < 1 || month > 12)
+        return false;
+    const daysInMonth = new Date(Date.UTC(Number(y), month, 0)).getUTCDate();
+    if (Number(d) < 1 || Number(d) > daysInMonth)
+        return false;
+    if (hh !== undefined && (Number(hh) > 23 || Number(mm) > 59))
+        return false;
+    if (ss !== undefined && Number(ss) > 60)
+        return false; // leap second
+    return !Number.isNaN(Date.parse(v));
+}, { message: "must be an ISO 8601 date or datetime" });
+// ---------------------------------------------------------------------------
+// Composed helpers blocks reach for
+// ---------------------------------------------------------------------------
+/**
+ * An optional URL field: absent/empty stays undefined rather than becoming
+ * "" (an empty href renders as a link to the current page).
+ */
+export const optionalUrlSchema = urlSchema.optional().or(z.literal(""));
+/**
+ * A list of capped strings for chips/tags/points. Blocks declare their own
+ * max length — a chart's max points is a chart decision — but each string is
+ * still shortText-capped so one element cannot smuggle a paragraph.
+ */
+export function shortTextList(max) {
+    return z.array(shortTextSchema).max(max);
+}

package/dist/artifact-blocks/registry.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The block catalog (jatui-vsuzi). MOS discovered `blocks/<type>/block.ts`
+ * with `import.meta.glob`; a published library cannot glob its consumer's
+ * folders, so jatui keeps an EXPLICIT registry:
+ *
+ *   - the blocks jatui ships are listed once in `builtins.ts` and are in the
+ *     catalog from this module's first import;
+ *   - a host adds its own (or replaces one, deliberately) with
+ *     `registerBlocks(def, …)`.
+ *
+ * A def's `type` must be kebab-case and unique; registering a second def
+ * under a taken type throws unless `{ replace: true }` says so — two blocks
+ * silently fighting over one name is how a page renders the wrong widget.
+ */
+import type { ArtifactBlockDef, BlocksSpec, BlockValidationError } from "./types";
+/**
+ * Register one or more block defs. Throws on a malformed type or a
+ * duplicate (unless `replace`). Returns an unregister function for tests
+ * and hot reload.
+ */
+export declare function registerBlocks(input: ArtifactBlockDef<any> | ArtifactBlockDef<any>[], opts?: {
+    replace?: boolean;
+}): () => void;
+export declare function blockDef(type: string): ArtifactBlockDef | undefined;
+export declare function allBlockDefs(): ArtifactBlockDef[];
+/** Validate a whole spec. Returns [] when every block is known and valid. */
+export declare function validateBlocksSpec(spec: BlocksSpec): BlockValidationError[];

package/dist/artifact-blocks/registry.js

@@ -0,0 +1,83 @@
+import { blockLinkErrors } from "./contractBlocks";
+import { BUILTIN_BLOCKS } from "./builtins.js";
+// Module-level, one catalog per JS realm (SSR and the browser each build
+// their own from the same builtins + host registrations). Built LAZILY, on
+// the first call: a block that imports the registry (program validates its
+// nested visual through blockDef) sits inside builtins.ts's own import
+// graph, so when builtins.ts is the entry this module evaluates before
+// BUILTIN_BLOCKS exists. By the first call every barrel has loaded.
+let defs = null;
+const catalog = () => (defs ??= new Map(BUILTIN_BLOCKS.map((d) => [d.type, d])));
+const TYPE_RE = /^[a-z][a-z0-9-]{0,47}$/;
+/**
+ * Register one or more block defs. Throws on a malformed type or a
+ * duplicate (unless `replace`). Returns an unregister function for tests
+ * and hot reload.
+ */
+export function registerBlocks(input, opts = {}) {
+    const list = Array.isArray(input) ? input : [input];
+    const cat = catalog();
+    for (const def of list) {
+        if (!def || typeof def.type !== "string" || !TYPE_RE.test(def.type))
+            throw new Error(`artifact block: type "${def?.type}" must be kebab-case (a-z0-9-)`);
+        if (cat.has(def.type) && cat.get(def.type) !== def && !opts.replace)
+            throw new Error(`artifact block "${def.type}" is already registered (pass { replace: true } to override it)`);
+    }
+    for (const def of list)
+        cat.set(def.type, def);
+    return () => {
+        for (const def of list)
+            if (cat.get(def.type) === def)
+                cat.delete(def.type);
+    };
+}
+export function blockDef(type) {
+    return catalog().get(type);
+}
+export function allBlockDefs() {
+    return [...catalog().values()].sort((a, b) => a.type.localeCompare(b.type));
+}
+const BLOCK_ID_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+/** Validate a whole spec. Returns [] when every block is known and valid. */
+export function validateBlocksSpec(spec) {
+    const errors = [];
+    const seen = new Set();
+    for (const b of spec.blocks ?? []) {
+        const def = catalog().get(b.type);
+        if (!BLOCK_ID_RE.test(b.id ?? ""))
+            errors.push({
+                blockId: String(b.id),
+                type: b.type,
+                path: "id",
+                message: "id must be lowercase a-z0-9_- (max 64)",
+            });
+        else if (seen.has(b.id))
+            errors.push({
+                blockId: b.id,
+                type: b.type,
+                path: "id",
+                message: "duplicate block id",
+            });
+        seen.add(b.id);
+        errors.push(...blockLinkErrors(b));
+        if (!def) {
+            errors.push({
+                blockId: b.id,
+                type: b.type,
+                path: "type",
+                message: `unknown block type (known: ${[...catalog().keys()].sort().join(", ")})`,
+            });
+            continue;
+        }
+        const r = def.schema.safeParse(b.params);
+        if (!r.success)
+            for (const issue of r.error.issues)
+                errors.push({
+                    blockId: b.id,
+                    type: b.type,
+                    path: issue.path.join("."),
+                    message: issue.message,
+                });
+    }
+    return errors;
+}

package/dist/artifact-blocks/review/BlockIcon.svelte

@@ -0,0 +1,99 @@
+<script lang="ts" module>
+  /**
+   * The glyphs the review / interactive blocks draw (lucide paths, ISC),
+   * inline so jatui carries no icon-library dependency — MOS imported these
+   * from lucide-svelte. Same props as a lucide component (`size`,
+   * `stroke-width`, `class`), so a port is a rename.
+   */
+  export type BlockIconName =
+    | "check"
+    | "circle"
+    | "circle-check"
+    | "circle-help"
+    | "circle-alert"
+    | "info"
+    | "triangle-alert"
+    | "clock"
+    | "loader-circle"
+    | "send"
+    | "sticky-note"
+    | "circle-dot-dashed"
+    | "rotate-ccw"
+    | "external-link"
+</script>
+
+<script lang="ts">
+  let {
+    name,
+    size = 16,
+    "stroke-width": strokeWidth = 2,
+    class: cls = "",
+    "aria-hidden": ariaHidden = "true",
+  }: {
+    name: BlockIconName
+    size?: number
+    "stroke-width"?: number
+    class?: string
+    "aria-hidden"?: "true" | "false" | boolean
+  } = $props()
+</script>
+
+<svg
+  width={size}
+  height={size}
+  viewBox="0 0 24 24"
+  fill="none"
+  stroke="currentColor"
+  stroke-width={strokeWidth}
+  stroke-linecap="round"
+  stroke-linejoin="round"
+  class={cls}
+  aria-hidden={ariaHidden}
+  focusable="false"
+>
+  {#if name === "check"}
+    <path d="M20 6 9 17l-5-5" />
+  {:else if name === "circle"}
+    <circle cx="12" cy="12" r="10" />
+  {:else if name === "circle-check"}
+    <circle cx="12" cy="12" r="10" /><path d="m9 12 2 2 4-4" />
+  {:else if name === "circle-help"}
+    <circle cx="12" cy="12" r="10" /><path d="M9.09 9a3 3 0 0 1 5.83 1c0 2-3 3-3 3" /><path
+      d="M12 17h.01"
+    />
+  {:else if name === "circle-alert"}
+    <circle cx="12" cy="12" r="10" /><path d="M12 8v4" /><path d="M12 16h.01" />
+  {:else if name === "info"}
+    <circle cx="12" cy="12" r="10" /><path d="M12 16v-4" /><path d="M12 8h.01" />
+  {:else if name === "triangle-alert"}
+    <path
+      d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3"
+    /><path d="M12 9v4" /><path d="M12 17h.01" />
+  {:else if name === "clock"}
+    <circle cx="12" cy="12" r="10" /><path d="M12 6v6l4 2" />
+  {:else if name === "loader-circle"}
+    <path d="M21 12a9 9 0 1 1-6.219-8.56" />
+  {:else if name === "send"}
+    <path
+      d="M14.536 21.686a.5.5 0 0 0 .937-.024l6.5-19a.496.496 0 0 0-.635-.635l-19 6.5a.5.5 0 0 0-.024.937l7.93 3.18a2 2 0 0 1 1.112 1.11z"
+    /><path d="m21.854 2.147-10.94 10.939" />
+  {:else if name === "sticky-note"}
+    <path d="M16 3H5a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2V8Z" /><path
+      d="M15 3v4a2 2 0 0 0 2 2h4"
+    />
+  {:else if name === "circle-dot-dashed"}
+    <path d="M10.1 2.18a9.93 9.93 0 0 1 3.8 0" /><path d="M17.6 3.71a9.95 9.95 0 0 1 2.69 2.7" /><path
+      d="M21.82 10.1a9.93 9.93 0 0 1 0 3.8"
+    /><path d="M20.29 17.6a9.95 9.95 0 0 1-2.7 2.69" /><path
+      d="M13.9 21.82a9.94 9.94 0 0 1-3.8 0"
+    /><path d="M6.4 20.29a9.95 9.95 0 0 1-2.69-2.7" /><path
+      d="M2.18 13.9a9.93 9.93 0 0 1 0-3.8"
+    /><path d="M3.71 6.4a9.95 9.95 0 0 1 2.7-2.69" /><circle cx="12" cy="12" r="1" />
+  {:else if name === "rotate-ccw"}
+    <path d="M3 12a9 9 0 1 0 9-9 9.75 9.75 0 0 0-6.74 2.74L3 8" /><path d="M3 3v5h5" />
+  {:else}
+    <path d="M15 3h6v6" /><path d="M10 14 21 3" /><path
+      d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"
+    />
+  {/if}
+</svg>

package/dist/artifact-blocks/review/BlockIcon.svelte.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The glyphs the review / interactive blocks draw (lucide paths, ISC),
+ * inline so jatui carries no icon-library dependency — MOS imported these
+ * from lucide-svelte. Same props as a lucide component (`size`,
+ * `stroke-width`, `class`), so a port is a rename.
+ */
+export type BlockIconName = "check" | "circle" | "circle-check" | "circle-help" | "circle-alert" | "info" | "triangle-alert" | "clock" | "loader-circle" | "send" | "sticky-note" | "circle-dot-dashed" | "rotate-ccw" | "external-link";
+type $$ComponentProps = {
+    name: BlockIconName;
+    size?: number;
+    "stroke-width"?: number;
+    class?: string;
+    "aria-hidden"?: "true" | "false" | boolean;
+};
+declare const BlockIcon: import("svelte").Component<$$ComponentProps, {}, "">;
+type BlockIcon = ReturnType<typeof BlockIcon>;
+export default BlockIcon;

package/dist/artifact-blocks/review/BulkRejectForm.svelte

@@ -0,0 +1,94 @@
+<script lang="ts">
+  /**
+   * BulkRejectForm — the confirm for a bulk Reject (mos-u8i35), inline in
+   * the block (diff-review, media-picker). A reject normally carries a
+   * reason, so instead of N notes the reviewer writes ONE: "Why? Applies to
+   * all N". It joins each item's own draft note, and every item can still
+   * get its own note after.
+   *
+   * Enter rejects (Shift+Enter is a new line); Esc or Cancel backs out.
+   */
+  import { onMount } from "svelte"
+
+  let {
+    count,
+    noun,
+    onConfirm,
+    onCancel,
+  }: {
+    /** How many items the reject will decide. */
+    count: number
+    /** Singular noun: "line", "item". */
+    noun: string
+    onConfirm: (note: string) => void
+    onCancel: () => void
+  } = $props()
+
+  let note = $state("")
+  let textarea = $state<HTMLTextAreaElement | null>(null)
+  const what = $derived(count === 1 ? `1 ${noun}` : `${count} ${noun}s`)
+  const ready = $derived(note.trim().length > 0)
+
+  onMount(() => textarea?.focus())
+
+  function submit() {
+    if (ready) onConfirm(note.trim())
+  }
+
+  function onKeydown(e: KeyboardEvent) {
+    if (e.isComposing) return
+    if (e.key === "Escape") {
+      e.preventDefault()
+      e.stopPropagation()
+      onCancel()
+    } else if (e.key === "Enter" && !e.shiftKey) {
+      e.preventDefault()
+      submit()
+    }
+  }
+</script>
+
+<form
+  class="mx-4 mt-3 flex flex-col gap-2 rounded-field border border-error/40 bg-error/5 px-3 py-2.5 text-sm sm:mx-5"
+  aria-label="Reject {what}"
+  data-bulk-reject-form
+  onsubmit={(e) => {
+    e.preventDefault()
+    submit()
+  }}
+>
+  <p class="font-medium">Reject {what}?</p>
+  <label class="flex flex-col gap-1">
+    <span class="text-xs text-base-content/80">
+      Why? This note applies to all {what}. You can add a note to any one after.
+    </span>
+    <textarea
+      bind:this={textarea}
+      bind:value={note}
+      class="textarea textarea-sm min-h-16 w-full resize-y rounded-field border-base-content/15 bg-base-100 text-sm"
+      rows="2"
+      maxlength={2000}
+      required
+      onkeydown={onKeydown}
+    ></textarea>
+  </label>
+  <div class="flex flex-wrap items-center gap-2">
+    <span class="text-xs text-base-content/70"
+      >{noun[0].toUpperCase()}{noun.slice(1)}s you already decided stay as they
+      are.</span
+    >
+    <button
+      type="button"
+      class="btn btn-ghost btn-xs ml-auto rounded-field"
+      onclick={onCancel}>Cancel</button
+    >
+    <button
+      type="submit"
+      class="btn btn-error btn-xs rounded-field"
+      disabled={!ready}
+      data-bulk-reject-confirm
+    >
+      Reject {what}
+    </button>
+  </div>
+</form>

package/dist/artifact-blocks/review/BulkRejectForm.svelte.d.ts

@@ -0,0 +1,11 @@
+type $$ComponentProps = {
+    /** How many items the reject will decide. */
+    count: number;
+    /** Singular noun: "line", "item". */
+    noun: string;
+    onConfirm: (note: string) => void;
+    onCancel: () => void;
+};
+declare const BulkRejectForm: import("svelte").Component<$$ComponentProps, {}, "">;
+type BulkRejectForm = ReturnType<typeof BulkRejectForm>;
+export default BulkRejectForm;

package/dist/artifact-blocks/review/BulkUndoBar.svelte

@@ -0,0 +1,40 @@
+<script lang="ts">
+  /**
+   * BulkUndoBar — "Accepted 12 lines. [Undo] [✕]" after a bulk verdict
+   * (mos-nv4eb, mos-u8i35). Tone follows the verdict the bulk cast. Undo
+   * reverts the bulk only; anything flipped after it stays flipped.
+   */
+  let {
+    message,
+    tone,
+    onUndo,
+    onDismiss,
+  }: {
+    message: string
+    tone: "success" | "error"
+    onUndo: () => void
+    onDismiss: () => void
+  } = $props()
+</script>
+
+<div
+  class="mx-4 mt-3 flex items-center gap-2 rounded-field border px-3 py-2 text-sm sm:mx-5 {tone ===
+  'error'
+    ? 'border-error/40 bg-error/10'
+    : 'border-success/40 bg-success/10'}"
+  role="status"
+  data-bulk-undo
+>
+  <span>{message}</span>
+  <button
+    type="button"
+    class="btn btn-xs ml-auto rounded-field"
+    onclick={onUndo}>Undo</button
+  >
+  <button
+    type="button"
+    class="btn btn-ghost btn-xs rounded-field"
+    aria-label="Dismiss"
+    onclick={onDismiss}>✕</button
+  >
+</div>

package/dist/artifact-blocks/review/BulkUndoBar.svelte.d.ts

@@ -0,0 +1,9 @@
+type $$ComponentProps = {
+    message: string;
+    tone: "success" | "error";
+    onUndo: () => void;
+    onDismiss: () => void;
+};
+declare const BulkUndoBar: import("svelte").Component<$$ComponentProps, {}, "">;
+type BulkUndoBar = ReturnType<typeof BulkUndoBar>;
+export default BulkUndoBar;