@magicvr/schema-ui-renderer 0.3.2 → 0.3.4

package/components/account-session-toolbar.d.ts

@@ -0,0 +1,2 @@
+import { type CustomComponentProps } from "@magicvr/schema-ui-renderer/renderer/custom-components";
+export declare function AccountSessionToolbar(_props: CustomComponentProps): import("react").JSX.Element;

package/components/activity-export.d.ts

@@ -0,0 +1,2 @@
+import { type CustomComponentProps } from "@magicvr/schema-ui-renderer/renderer/custom-components";
+export declare function ActivityExport({ node }: CustomComponentProps): import("react").JSX.Element;

package/components/cron-preview.d.ts

@@ -0,0 +1,2 @@
+import { type CustomComponentProps } from "@magicvr/schema-ui-renderer/renderer/custom-components";
+export declare function CronPreview(props: CustomComponentProps): import("react").JSX.Element;

package/components/data-permission-scopes.d.ts

@@ -0,0 +1,2 @@
+import { type CustomComponentProps } from "@magicvr/schema-ui-renderer/renderer/custom-components";
+export declare function DataPermissionScopes(_props: CustomComponentProps): import("react").JSX.Element;

package/components/data-table.d.ts

@@ -0,0 +1,43 @@
+import type { ReactNode } from "react";
+export type SortOrder = "asc" | "desc";
+export interface SortState {
+    field: string;
+    order: SortOrder;
+}
+export interface DataTableColumn<T> {
+    key: string;
+    /** Cell content or header node (checkboxes render in headers for selection). */
+    label: ReactNode;
+    sortable?: boolean;
+    /** W4 · GOAL-005: render the string fallback single-line truncated with a
+     *  native title full-text affordance so long values do not crowd out
+     *  sibling columns. Custom render cells are unaffected. Since the
+     *  table-style refresh every string cell truncates by default; this flag
+     *  is kept for schema declarations that opt into the 16rem cap. */
+    truncate?: boolean;
+    /** Column width hint (px number or CSS length). Content-driven auto layout
+     *  otherwise; a column that declares a width skips the default max-width
+     *  cap so it can exceed it (table-layout auto still grows on content). */
+    width?: number | string;
+    /** Minimum column width (px number or CSS length). */
+    minWidth?: number | string;
+    render?: (row: T) => ReactNode;
+}
+export interface DataTableProps<T> {
+    columns: DataTableColumn<T>[];
+    rows: T[];
+    rowKey: (row: T) => string;
+    sort?: SortState;
+    onSortChange?: (sort: SortState | null) => void;
+    loading?: boolean;
+    error?: string | null;
+    emptyMessage?: string;
+    caption?: string;
+    /** Invoked when a data row is clicked (row selection, S4 · GOAL-007). */
+    onRowClick?: (row: T) => void;
+    /** Row key of the currently selected row (highlight), S4 · GOAL-007. */
+    selectedKey?: string;
+    /** W15-F02: retry control shown in the error state. */
+    onRetry?: () => void;
+}
+export declare function DataTable<T>({ columns, rows, rowKey, sort, onSortChange, loading, error, emptyMessage, caption, onRowClick, selectedKey, onRetry, }: DataTableProps<T>): import("react").JSX.Element;

package/components/email-identity.d.ts

@@ -0,0 +1,2 @@
+import { type CustomComponentProps } from "@magicvr/schema-ui-renderer/renderer/custom-components";
+export declare function EmailIdentityCard(_props: CustomComponentProps): import("react").JSX.Element;

package/components/force-password-change.d.ts

@@ -0,0 +1 @@
+export declare function ForcePasswordChange(): import("react").JSX.Element;

package/components/import-template-download.d.ts

@@ -0,0 +1,2 @@
+import { type CustomComponentProps } from "@magicvr/schema-ui-renderer/renderer/custom-components";
+export declare function ImportTemplateDownload(_props: CustomComponentProps): import("react").JSX.Element;

package/components/invite-accept.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Public invitation acceptance surface (workspace-019 R3 · GOAL-004 C4):
+ * mounted at /invite/accept?token=… for unauthenticated visitors. Success
+ * returns WITHOUT tokens — the new user signs in with their chosen password.
+ */
+export declare function InviteAcceptPage(): import("react").JSX.Element;

package/components/invite-issue-card.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Invitation issue card (workspace-019): the create operation PLUS one-time
+ * link disclosure for creation and resend. The records list lives on the
+ * schema table of the same page; resend accepts the invite id from the table
+ * (column "id") because the schema engine cannot disclose response bodies.
+ */
+export declare function InviteIssueCard(_props: unknown): import("react").JSX.Element;

package/components/invite-resend-dialog.d.ts

@@ -0,0 +1,9 @@
+import { type CustomComponentProps } from "@magicvr/schema-ui-renderer/renderer/custom-components";
+/**
+ * Resend dialog (workspace-019, protocol modal action): the row-level
+ * "Resend" opens this modal with the triggering invite in context.modalRow
+ * (renderer injects it for modal content). Sending rotates the token via the
+ * admin API and discloses the ONE-TIME link inline — the schema engine cannot
+ * stream response bodies into the page, so the modal is the interaction.
+ */
+export declare function InviteResendDialog(props: CustomComponentProps): import("react").JSX.Element;

package/components/locale-switcher.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Language switcher (S1 · C4) — refactored to a lightweight header
+ * dropdown (2026-08-14, user request):
+ *
+ * - Trigger: pure icon button (lucide Languages), same size/shape as the
+ *   theme toggle and notification bell (size-9 rounded-md ghost).
+ * - Menu: absolutely positioned panel (NO portal — the app root carries
+ *   the `dark` class, so the panel inherits the dark theme variables
+ *   automatically; no Radix/Headless portal scope issue).
+ * - Dark-mode styling via design tokens (shadcn convention): bg-popover
+ *   resolves to ~neutral-900 in dark, border-border to white/10
+ *   (~neutral-800), accent hover to ~neutral-800, popover-foreground to
+ *   ~neutral-200 — exactly the requested palette; light mode stays
+ *   correct automatically.
+ * - Selected item shows a checkmark (lucide Check) on the right.
+ *
+ * Reachable from the Shell and the anonymous login page — no settings
+ * permission required (VP-007 requirement).
+ */
+export interface LocaleSwitcherProps {
+    className?: string;
+}
+export declare function LocaleSwitcher({ className }: LocaleSwitcherProps): import("react").JSX.Element;

package/components/mail-admin-tab.d.ts

@@ -0,0 +1,2 @@
+import { type CustomComponentProps } from "@magicvr/schema-ui-renderer/renderer/custom-components";
+export declare function MailAdminTab(_props: CustomComponentProps): import("react").JSX.Element;

package/components/mfa-manager.d.ts

@@ -0,0 +1,2 @@
+import { type CustomComponentProps } from "@magicvr/schema-ui-renderer/renderer/custom-components";
+export declare function MfaManager(_props: CustomComponentProps): import("react").JSX.Element;

package/components/monitoring-auto-refresh.d.ts

@@ -0,0 +1,2 @@
+import { type CustomComponentProps } from "@magicvr/schema-ui-renderer/renderer/custom-components";
+export declare function MonitoringAutoRefresh(_props: CustomComponentProps): import("react").JSX.Element;

package/components/notification-center.d.ts

@@ -0,0 +1,2 @@
+import { type CustomComponentProps } from "@magicvr/schema-ui-renderer/renderer/custom-components";
+export declare function NotificationCenter({ node, context }: CustomComponentProps): import("react").JSX.Element;

package/components/password-policy-tab.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Password-policy configuration block (workspace-019 R3 · GOAL-004 D-001
+ * §2): the admin.settings tab extension. GET/PATCH /api/settings/password-
+ * policy; the server enforces range validation (8–72 / 0–4 / 0–10).
+ */
+export declare function PasswordPolicyTab(_props: unknown): import("react").JSX.Element;

package/components/qr-code.d.ts

@@ -0,0 +1,16 @@
+export interface QrCodeProps {
+    /** Text to encode (e.g. an otpauth:// URI). Empty → renders nothing. */
+    value: string;
+    /** Rendered size in CSS pixels (the matrix is square). */
+    size?: number;
+    /** Extra class names for the wrapping figure. */
+    className?: string;
+    /** Accessible label. */
+    label?: string;
+}
+/**
+ * Renders the QR module matrix as SVG. Each dark module becomes a 1×1 rect in
+ * a unit viewBox scaled to `size`; a white background rect keeps scanners
+ * happy (quiet zone included via the 4-module default margin of the encoder).
+ */
+export declare function QrCode({ value, size, className, label }: QrCodeProps): import("react").JSX.Element | null;

package/components/theme-toggle.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Theme toggle (S1 · C3) — W8 visual unification (GOAL-009):
+ *
+ * The trigger now matches the neighbouring header icon buttons (language
+ * switcher and notification bell): size-9 rounded-md ghost with
+ * text-muted-foreground + hover:bg-accent — instead of the form-styled
+ * outline Button. The tooltip / aria-label follow the active locale via
+ * the i18n catalog (shell.theme.toggle) — no hardcoded English.
+ */
+export declare function ThemeToggle(): import("react").JSX.Element;

package/components/timezone-switcher.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Timezone switcher (workspace-020 · R2 · C2).
+ *
+ * User-level timezone override next to the language switcher in the header
+ * locale channel (contract GOAL-002 D-001 §4.2): persists via the single
+ * localStorage channel "schema-ui:timezone"; "auto" removes the key.
+ * The option list is the documented common set (contract §6 permits a
+ * verifiable, extendable list); the effective timezone always degrades
+ * safely through the L1–L4 resolver in i18n/timezone.
+ */
+/** Common IANA set offered in the header menu (extendable per contract §6). */
+export declare const TIMEZONE_OPTIONS: readonly string[];
+export interface TimezoneSwitcherProps {
+    className?: string;
+}
+export declare function TimezoneSwitcher({ className }: TimezoneSwitcherProps): import("react").JSX.Element;

package/components/wallet-ensure.d.ts

@@ -0,0 +1,2 @@
+import { type CustomComponentProps } from "@magicvr/schema-ui-renderer/renderer/custom-components";
+export declare function WalletEnsure(_props: CustomComponentProps): import("react").JSX.Element;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magicvr/schema-ui-renderer",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "type": "module",
   "description": "schema-ui-core 包面（renderer）",
   "main": "index.js",
@@ -18,13 +18,6 @@
     "components"
   ],
   "license": "UNLICENSED",
-  "peerDependencies": {
-    "react": "^19.0.0",
-    "react-dom": "^19.0.0",
-    "@magicvr/schema-ui-protocol": "^0.2.1",
-    "@magicvr/schema-ui-lib": "^0.1.1",
-    "@magicvr/schema-ui-ui": "^0.1.1"
-  },
   "publishConfig": {
     "access": "public"
   }

package/renderer/confirm.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Confirm dialog for row actions that declare a `confirm` string (S4 · GOAL-007).
+ *
+ * One-time renderer completion allowed by I-007-003 §9.5 (`confirm*.tsx`). The
+ * message text comes from the schema row action entry (`table.props.actions[].
+ * confirm` / `confirmKey`), so the dialog stays fixture-driven; cancelling
+ * mirrors the frozen `executeAction` CONFIRM_CANCELLED path and never issues
+ * a request.
+ *
+ * W14 F-12 (GOAL-018): keyboard/accessibility — initial focus on Cancel, ESC
+ * cancels, and Tab is trapped inside the dialog.
+ */
+export declare function ConfirmDialog({ message, onConfirm, onCancel, }: {
+    message: string;
+    onConfirm: () => void;
+    onCancel: () => void;
+}): import("react").JSX.Element;

package/renderer/custom-components.d.ts

@@ -0,0 +1,14 @@
+import type { ComponentType } from "react";
+import type { RenderCustomNode, RenderNode } from "@magicvr/schema-ui-renderer/renderer/render.types";
+export interface CustomComponentProps {
+    node: RenderCustomNode;
+    context: Record<string, unknown>;
+    /** Children declared under the custom node (rarely used). */
+    children?: RenderNode[];
+}
+/** Registers a custom node component (idempotent; later registrations win). */
+export declare function registerCustomComponent(key: string, component: ComponentType<CustomComponentProps>): void;
+/** Returns the registered component for a key, or null when unregistered. */
+export declare function getCustomComponent(key: string): ComponentType<CustomComponentProps> | null;
+/** Test-only: clears the registry. */
+export declare function resetCustomComponentsForTests(): void;

package/renderer/form-controls.d.ts

@@ -0,0 +1,45 @@
+import { type ReactNode } from "react";
+import { type MessageParams } from "@magicvr/schema-ui-lib/i18n/catalog";
+import type { UploadableFile } from "@magicvr/schema-ui-protocol/conformance/upload-orchestration";
+import { type FormControlField } from "@magicvr/schema-ui-renderer/renderer/form-controls.types";
+export interface FormControlsProps {
+    fields: FormControlField[];
+    values: Record<string, unknown>;
+    onChange: (id: string, value: unknown) => void;
+    disabled?: boolean;
+    /** Per-field disabled override (R5 renderer reaction state). */
+    fieldDisabled?: (id: string) => boolean;
+    idPrefix?: string;
+    /** Upload control transport (ADR-0012): validates + uploads + returns the field value. */
+    onUpload?: (field: FormControlField, files: UploadableFile[]) => Promise<unknown>;
+    /** GOAL-014 D-002 §4: inline field errors keyed by field id (submit-time
+     * validation + server fieldErrors echo). */
+    fieldErrors?: Record<string, string>;
+    /** GOAL-014 D-002 §4: column count (default 1 = single-column layout).
+     * >1 enables a responsive grid; the mobile layout stays single-column. */
+    columns?: number;
+    /** W11 · U-01/U-02: auth-aware transport for dynamic option sources
+     * (optionsSource); defaults to globalThis.fetch. */
+    fetcher?: typeof fetch;
+    /**
+     * A-003 (GOAL-013 audit response): search-mode presentation — compact
+     * responsive auto-grid (1..5 columns), keyword input with search prefix
+     * icon + clear affordance. Search schemas keep their exact JSON shape.
+     */
+    searchMode?: boolean;
+    /** A-003: action cluster (Reset button) rendered inside the
+     * search-mode grid so it aligns with the field row. */
+    actionSlot?: ReactNode;
+    /**
+     * A-003 (user pairing rule): one search button rendered side-by-side with
+     * EVERY keyword input field in search mode — as many buttons as there are
+     * text inputs, each pair adjacent in the same grid cell.
+     */
+    searchButtonSlot?: ReactNode;
+}
+export type FieldTranslator = (key: string, params?: MessageParams, literalFallback?: string) => string;
+export declare function optionList(field: FormControlField, t: FieldTranslator): Array<{
+    value: string;
+    label: string;
+}>;
+export declare function FormControls({ fields, values, onChange, disabled, fieldDisabled, idPrefix, onUpload, fieldErrors, columns, fetcher, searchMode: searchModeProp, actionSlot, searchButtonSlot, }: FormControlsProps): import("react").JSX.Element;

package/renderer/form-controls.types.d.ts

@@ -0,0 +1,135 @@
+/**
+ * D-FORM form control surface (frozen §5 whitelist + I-PROTO-FULL-001 full
+ * registry surface).
+ *
+ * Wire rules from schema-ui-docs@2.7.0 (fixed commit ca9e5fe…):
+ *  - base: input → string, select (single) → string, inputNumber → number,
+ *    datePicker → ISO 8601 string, dateRangePicker → {start,end} pair bound
+ *    to startField/endField (registry props; no single-field wire)
+ *  - 2.6 (capability form.controls.extended): textarea → string, switch → boolean,
+ *    checkbox → boolean, radio → single string, select.mode=multiple → string[]
+ *  - 2.7 (capability form.controls.advanced): cascader → path string[],
+ *    checkboxGroup → value string[], richText → markdown string, password → string
+ *  - 2.7 props.defaultValue must match the field's wire type
+ *
+ * The schema-driven page gate (meta.protocolVersion + requiredCapabilities) is
+ * enforced by checkFormCapabilities; the Renderer-level page gate lands in 2c.
+ */
+export type FormControlType = "input" | "select" | "inputNumber" | "datePicker" | "dateRangePicker" | "textarea" | "switch" | "checkbox" | "radio" | "cascader" | "checkboxGroup" | "richText" | "password" | "upload";
+export declare const FORM_CONTROLS_EXTENDED_CAPABILITY = "form.controls.extended";
+export declare const FORM_CONTROLS_ADVANCED_CAPABILITY = "form.controls.advanced";
+/** ADR-0021: `form.props.recordSource` prefill GET (registry since 2.1). */
+export declare const FORM_RECORD_LOAD_CAPABILITY = "form.record.load";
+/** ADR-0040 (since 2.9): `readOnly` field declaration (value still projects). */
+export declare const FORM_CONTROLS_READONLY_CAPABILITY = "form.controls.readonly";
+export type WireKind = "string" | "boolean" | "string-array" | "number" | "date-range";
+export interface FormOption {
+    value: string;
+    label?: string;
+    /** S2 (VP-007): i18n key resolved before `label` (upstream registry field). */
+    labelKey?: string;
+}
+export interface DateRangeValue {
+    start: string;
+    end: string;
+}
+export interface FormControlField {
+    id: string;
+    label?: string;
+    /** S2 (VP-007): i18n key resolved before `label` (missing-key observable). */
+    labelKey?: string;
+    placeholder?: string;
+    /** S2 (VP-007): i18n key resolved before `placeholder` (local doc convention). */
+    placeholderKey?: string;
+    type: FormControlType;
+    /** select only: single (default) or multiple. */
+    mode?: "single" | "multiple";
+    options?: FormOption[];
+    /**
+     * W11 · U-01/U-02 — dynamic option source, aligned with the upstream
+     * registry shape (component-registry.json, since 0.2): an object with a
+     * required single-slash same-origin url plus the response item fields used
+     * for value/label. The response is {items:[...]} (or a bare array); while
+     * the source loads, static options (if any) remain the fallback; an invalid
+     * source or failed fetch fails closed to an empty option set.
+     */
+    optionsSource?: {
+        url: string;
+        /** Optional scalar query params appended to url (e.g. pageSize). */
+        params?: Record<string, string | number | boolean | null>;
+        labelField: string;
+        valueField: string;
+    };
+    defaultValue?: unknown;
+    /** dateRangePicker only: the two bound output fields (registry props). */
+    startField?: string;
+    endField?: string;
+    /** inputNumber constraints (registry props, since 0.2.1). */
+    min?: number;
+    max?: number;
+    step?: number;
+    precision?: number;
+    /** GOAL-014 D-002 §3: field-level validation constraints (optional). */
+    required?: boolean;
+    /** ADR-0040 (since 2.9): read-only field — user cannot edit, value still
+     * participates in values and the submit projection (bodyMapping);
+     * recordSource backfill and reactions keep writing. Requires protocol
+     * >= 2.9 and form.controls.readonly. */
+    readOnly?: boolean;
+    /** Regex pattern for string-typed fields (submit-time validation). */
+    pattern?: string;
+    /** String length bounds for input/textarea. */
+    minLength?: number;
+    maxLength?: number;
+    /** datePicker display format (display-only; data stays ISO 8601). */
+    format?: string;
+    /** upload only: direct-URL mode (registry oneOf with actionRef). */
+    action?: string;
+    /** upload only: references a top-level type=upload action (requires actions.upload). */
+    actionRef?: string;
+    /**
+     * W17: optional Host-local addon rendered under this field. The value is a
+     * registered custom-component key (e.g. cron-preview). Not a protocol
+     * control type.
+     */
+    afterComponent?: string;
+    /** upload constraints (direct-URL mode only; actionRef mode reads the action). */
+    accept?: string;
+    maxSize?: number;
+    multiple?: boolean;
+}
+export interface FormControlMeta {
+    protocolVersion: string;
+    requiredCapabilities: string[];
+}
+export interface FormControlGateError {
+    code: string;
+    path: string;
+    message: string;
+}
+export declare function isWhitelistedFormControl(type: string): type is FormControlType;
+export declare function wireKindOf(field: FormControlField): WireKind;
+/** Coerces a raw control value to its wire kind; defaultValue applies when raw is empty. */
+export declare function coerceFieldValue(field: FormControlField, raw: unknown): unknown;
+/** Fails closed when defaultValue does not match the field's wire type. */
+export declare function validateDefaultValue(field: FormControlField): FormControlGateError | null;
+/** Gates a control set against page meta (P-005 / frozen capability rules). */
+export declare function checkFormCapabilities(meta: FormControlMeta, fields: FormControlField[]): FormControlGateError[];
+/** Validates an arbitrary page-meta value without assuming record types. */
+export declare function checkFormCapabilitiesRaw(metaValue: unknown, fields: FormControlField[]): FormControlGateError[];
+/** One submit-time field validation failure (GOAL-014 D-002 §3). */
+export interface FieldValidationError {
+    field: string;
+    code: "REQUIRED" | "PATTERN" | "MIN_LENGTH" | "MAX_LENGTH" | "MIN_VALUE" | "MAX_VALUE";
+    /** Stable i18n key (form.validation.*); message is the en fallback. */
+    messageKey: string;
+    message: string;
+}
+/**
+ * Validates form values against each field's declared constraints (GOAL-014
+ * D-002 §3.1). Pure function: returns all failures (not just the first) so
+ * the host can inline every field error. Boolean fields (switch/checkbox)
+ * never fail REQUIRED — their wire kind is boolean and the toggle has an
+ * explicit state.
+ */
+export declare function validateFieldValues(fields: FormControlField[], values: Record<string, unknown>): FieldValidationError[];

package/renderer/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @magicvr/schema-ui-renderer 聚合导出（试点 v0.1.0 · GOAL-004 S3 · 粗粒度单包）。
+ *
+ * 渲染闭环：RenderPage（schema 文档 → DOM）+ I18nProvider（i18n 运行时面）
+ * + 扩展接缝（registerCustomComponent）+ 核心类型。
+ * 内部 bundle 面（components/i18n/lib/protocol）不导出为包级 API。
+ */
+export { RenderPage, useSchemaCrud, SchemaCrudContext, type RendererComponentProps, type SchemaCrudFeedback, type SchemaCrudConfirm, type TableSelection, type ActionResult, type SchemaCrudValue, type RunRequestOptions, } from "./render.js";
+export { registerCustomComponent } from "./custom-components.js";
+export type * from "./render.types.js";
+export { I18nProvider, useI18n, getActiveLocale, setActiveLocale, applyLocaleToDocument, type I18nProviderProps, type I18nState, } from "@magicvr/schema-ui-lib/i18n/runtime";
+export { resolveTextProp, type MessageParams } from "@magicvr/schema-ui-lib/i18n/catalog";
+export type { Locale, LocalePreference } from "@magicvr/schema-ui-lib/i18n/locale";

package/renderer/modal.d.ts

@@ -0,0 +1,6 @@
+import { type ReactNode } from "react";
+export declare function ModalHost({ title, onClose, children, }: {
+    title?: string;
+    onClose: () => void;
+    children: ReactNode;
+}): import("react").JSX.Element;

package/renderer/permissions.d.ts

@@ -0,0 +1,53 @@
+import { type NavigationContext } from "@magicvr/schema-ui-protocol/app-manifest";
+/**
+ * R4 D-PERM permission evaluation engine (ADR-0023, frozen by GOAL-006 D-004).
+ *
+ * Coverage scope: the minimal renderer subset exercised by the frozen
+ * permissions-inheritance fixtures — permissionCascade / permissionIntent
+ * validation (fail-closed error codes) and effectivePermission evaluation for
+ * the approved target kinds (formField / formSubmit / rowAction /
+ * toolbarTrigger / actionButton). Execution-time gating (visibleWhen →
+ * permission → disabled/requiresSelection → confirm → action) is modeled for
+ * rowAction / toolbarTrigger / actionButton / default form submit.
+ */
+export type PermissionKey = "view" | "edit" | "delete";
+export type L2ErrorCode = "PROTOCOL_VERSION_TOO_LOW" | "CAPABILITY_REQUIRED" | "PERMISSION_CASCADE_TYPE_INVALID" | "PERMISSION_CASCADE_KEYS_INVALID" | "PERMISSION_CASCADE_SOURCE_MISSING" | "PERMISSION_INTENT_FORBIDDEN" | "PERMISSION_INTENT_INVALID";
+export interface L2Error {
+    code: L2ErrorCode;
+    path: string;
+}
+export interface PermissionTarget {
+    targetId: string;
+    kind: "formField" | "formSubmit" | "rowAction" | "toolbarTrigger" | "actionButton" | "column";
+    key: PermissionKey;
+    cascadeApplied: boolean;
+    cascadedBy: string[];
+    effectivePermission: boolean;
+}
+export interface ExecutionRequest {
+    targetId: string;
+    visible: boolean;
+    confirm?: boolean;
+    confirmed?: boolean;
+    disabled?: boolean;
+    requiresSelection?: boolean;
+}
+export interface ExecutionResult {
+    outcome: "EXECUTED" | "BLOCKED" | "CONFIRM_CANCELLED";
+    reason?: "NOT_VISIBLE" | "PERMISSION_DENIED" | "DISABLED";
+    events: Array<{
+        type: "confirmShown" | "actionExecuted";
+    }>;
+}
+type JsonRecord = Record<string, unknown>;
+/** Validates the permission fields of a page; returns all L2 errors. */
+export declare function validatePermissions(page: JsonRecord): L2Error[];
+/**
+ * Evaluates the effective permission of every approved target in the page
+ * against the frozen $context snapshot. Targets in modal content and
+ * navigated pages start new roots (ADR-0023 D2a).
+ */
+export declare function evaluatePermissionTargets(page: JsonRecord, context: NavigationContext): PermissionTarget[];
+/** Gates an action: visible → permission → disabled/requiresSelection → confirm. */
+export declare function executeAction(page: JsonRecord, request: ExecutionRequest, context: NavigationContext): ExecutionResult;
+export {};

package/renderer/reaction-engine.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Multi-round snapshot reaction engine (schema-ui-docs@2.7.0 · 02-reaction-expression.md §14).
+ *
+ * Implements the upstream conformance contract (`conformance/fixtures/reactions/cases.json`):
+ *   Snapshot → Evaluate → Commit → Next tick, with:
+ *   - per-field reactions [{ when, fulfill, otherwise }] (value/visible/required/disabled)
+ *   - observers evaluated against every round snapshot
+ *   - baselines + resetMissingOtherwise (condition false without otherwise → restore baseline;
+ *     explicit writes win over implicit baseline restores)
+ *   - externalUpdates applied between rounds
+ *   - deep-equal change detection (no commit / no next round on no-op writes)
+ *   - loop protection (REACTION_LOOP_LIMIT after maxRounds, default 10)
+ *   - MULTIPLE_VALUE_WRITES warnings (last write wins, deterministic order)
+ */
+export interface ReactionRuleInput {
+    when: string;
+    fulfill?: Record<string, unknown>;
+    otherwise?: Record<string, unknown>;
+}
+export interface FieldReactionInput {
+    field: string;
+    reactions: ReactionRuleInput[];
+}
+export interface ReactionObserverInput {
+    id: string;
+    when: string;
+}
+export interface ExternalUpdateInput {
+    afterRound: number;
+    values: Record<string, unknown>;
+}
+export interface ReactionEngineInput {
+    initialValues: Record<string, unknown>;
+    fields?: FieldReactionInput[];
+    observers?: ReactionObserverInput[];
+    baselines?: Record<string, unknown>;
+    resetMissingOtherwise?: boolean;
+    externalUpdates?: ExternalUpdateInput[];
+    maxRounds?: number;
+}
+export interface ReactionRound {
+    round: number;
+    snapshot: Record<string, unknown>;
+    observations: Record<string, boolean>;
+    commits: Array<{
+        field: string;
+        value: unknown;
+    }>;
+}
+export interface MultipleValueWritesWarning {
+    code: "MULTIPLE_VALUE_WRITES";
+    field: string;
+    count: number;
+}
+export interface ReactionEngineOk {
+    ok: true;
+    values: Record<string, unknown>;
+    rounds: ReactionRound[];
+    warnings: MultipleValueWritesWarning[];
+}
+export interface ReactionEngineLoopError {
+    ok: false;
+    code: "REACTION_LOOP_LIMIT";
+    maxRounds: number;
+    values: Record<string, unknown>;
+    roundCount: number;
+    dependencyFields: string[];
+}
+export type ReactionEngineResult = ReactionEngineOk | ReactionEngineLoopError;
+/** Per-field control state after convergence (renderer integration). */
+export interface ReactionFieldState {
+    visible?: boolean;
+    required?: boolean;
+    disabled?: boolean;
+}
+export interface ReactionEngineDetailed {
+    result: ReactionEngineResult;
+    fieldStates: Record<string, ReactionFieldState>;
+}
+export declare const DEFAULT_MAX_ROUNDS = 10;
+/**
+ * Runs the multi-round engine.
+ *
+ * A field's committed `value` only lands in `commits` when it deep-differs
+ * from the snapshot value; a no-op write neither commits nor schedules the
+ * next round. Rounds stop when no committed field is a dependency of any
+ * expression (reaction when or observer when).
+ */
+export declare function runReactionEngine(input: ReactionEngineInput): ReactionEngineResult;
+/** Engine + per-field control state (visible/required/disabled/value) from
+ * the final round — used by the Renderer's form integration. */
+export declare function runReactionEngineDetailed(input: ReactionEngineInput): ReactionEngineDetailed;