@magicvr/schema-ui-shell 0.1.0 → 0.1.1

package/account/AuthContext.d.ts

@@ -0,0 +1,32 @@
+import { type ReactNode } from "react";
+import { type AuthSession } from "@/account/auth-client";
+import type { SessionAdapterState } from "@/host/boot";
+export type AuthStatus = SessionAdapterState;
+export interface AuthContextValue {
+    status: AuthStatus;
+    session: AuthSession | null;
+    user: AuthSession["user"] | null;
+    /** Authenticates, restores a captured return intent, and transitions to the
+     * shell. When the account requires a second factor (S-10 · GOAL-017 D-002
+     * §3) resolveMFA is invoked with the one-time proof and must return the
+     * TOTP code (or recovery code) the user entered. */
+    login: (username: string, password: string, captcha?: import("@/account/auth-client").LoginCaptcha, resolveMFA?: (proof: string) => Promise<{
+        code: string;
+        recoveryCode?: string;
+    }>) => Promise<void>;
+    /** Revokes the session and transitions to the login page. */
+    logout: () => Promise<void>;
+    /** Auth-aware fetch: attaches Bearer and refreshes once on 401. */
+    authFetch: typeof fetch;
+    /**
+     * Re-resolves /me into the session (best-effort; keeps the current session
+     * on failure). W13 T-05 follow-up: the account profile save publishes the
+     * account.profile config-change event and the provider refreshes itself so
+     * the shell header (avatar / display name) updates without a reload.
+     */
+    refreshSession: () => Promise<void>;
+}
+export declare function AuthProvider({ children }: {
+    children: ReactNode;
+}): import("react").JSX.Element;
+export declare function useAuth(): AuthContextValue;

package/account/auth-client.d.ts

@@ -0,0 +1,106 @@
+export interface AuthUser {
+    id: string;
+    name: string;
+    roles: string[];
+    /** Self-service avatar asset URL (W13 T-05); absent = no avatar. */
+    avatarUrl?: string;
+    /** True when the account must change its initial/reset password before using
+     * business APIs (W16-F01). */
+    mustChangePassword?: boolean;
+    /**
+     * Permission keys resolved from persisted RBAC at identity load (`/me`).
+     * Required by Schema expressions (`$context.user.permissions contains "…"`).
+     * Optional on the type only because login token payloads may omit it until
+     * `/me` completes; the session returned by login/restore always carries it
+     * when the API provides it.
+     */
+    permissions?: string[];
+}
+export interface AuthSession {
+    user: AuthUser;
+    features: Record<string, boolean>;
+}
+/** Error with a stable code so the UI can branch (e.g. INVALID_CREDENTIALS). */
+export declare class AuthError extends Error {
+    code: string;
+    /** Optional HTTP status carried for errors that localize a {status} param. */
+    status?: number;
+    constructor(code: string, message: string, status?: number);
+}
+export declare function setAuthLostListener(listener: (() => void) | null): void;
+/**
+ * Auth-aware fetch: attaches the Bearer access token, and on a 401 (not an auth
+ * endpoint) attempts one silent refresh then retries once. If the refresh fails,
+ * or the retry is still 401 after a successful refresh, the session is cleared
+ * and the auth-lost listener fires (UI → login page).
+ */
+export declare function authFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+/** Captcha challenge submitted with login (S-11 · GOAL-011 D-002 §5). */
+export interface LoginCaptcha {
+    id: string;
+    answer: string;
+}
+/** Second factor required by the login (S-10 · GOAL-017 D-002 §3): the
+ * password factor succeeded; no tokens are issued until /api/auth/mfa/verify
+ * completes with the one-time proof. */
+export interface LoginMFARequired {
+    mfaRequired: true;
+    mfaProof: string;
+}
+export declare function isLoginMFARequired(value: AuthSession | LoginMFARequired): value is LoginMFARequired;
+/** Completes a two-step login with the second factor (S-10 · GOAL-017 D-002
+ * §3): proof + TOTP code (or one-time recovery code) → real token pair. */
+export declare function mfaVerify(proof: string, code: string, recoveryCode?: string): Promise<AuthSession>;
+/** Authenticates with username/password and persists the token pair. When the
+ * account requires a second factor the response carries mfaRequired + a
+ * one-time proof instead of tokens — complete it via mfaVerify. */
+export declare function login(username: string, password: string, captcha?: LoginCaptcha): Promise<AuthSession | LoginMFARequired>;
+/** Revokes the refresh token (best-effort, idempotent) and clears local state. */
+export declare function logout(): Promise<void>;
+/** Requests a reset code for the account (username or its verified email).
+ * The server answers 202 dispatched even when no recovery path exists, so a
+ * resolved promise NEVER means an email was actually sent — only that the
+ * request was accepted. */
+export declare function recoveryStart(account: string): Promise<void>;
+export interface RecoveryCompleteInput {
+    account: string;
+    code: string;
+    newPassword: string;
+    /** TOTP code — required when the account has MFA enrolled. */
+    secondFactorCode?: string;
+    /** One-time recovery code as the TOTP alternative. */
+    recoveryCode?: string;
+}
+/** Completes self-recovery: verifies the emailed code (+ second factor for
+ * MFA accounts), swaps the password and revokes every live session. Success
+ * returns WITHOUT tokens — the user signs in with the new password. */
+export declare function recoveryComplete(input: RecoveryCompleteInput): Promise<void>;
+/** Restore outcomes (ADR-0035 D4 normalized adapter input, GOAL-004 S4-2). */
+export type RestoreSessionResult = {
+    kind: "none";
+} | {
+    kind: "reauth";
+} | {
+    kind: "session";
+    session: AuthSession;
+};
+/**
+ * Restores a session on boot: if a refresh token exists, rotate it for a fresh
+ * access/refresh pair, then resolve the identity via /me. No refresh token →
+ * `none` (anonymous); rotation or identity resolution failure with an existing
+ * refresh token → `reauth` (the adapter reports reauth-required, ADR-0035 D4).
+ */
+export declare function restoreSession(): Promise<RestoreSessionResult>;
+/** Fetches the current session from /me using the active access token. */
+export declare function fetchMe(): Promise<AuthSession>;
+export interface InviteAcceptInput {
+    token: string;
+    username: string;
+    name: string;
+    password: string;
+}
+/** Redeems an invitation into a real account. Success returns WITHOUT tokens
+ * (GOAL-002 D-001 §4 projection): the invitee signs in with their new
+ * credentials. Errors carry the cataloged server codes (INVITE_INVALID /
+ * USERNAME_TAKEN / INVALID_PASSWORD). */
+export declare function inviteAccept(input: InviteAcceptInput): Promise<void>;

package/account/tokens.d.ts

@@ -0,0 +1,14 @@
+/**
+ * R2 token storage (GOAL-005 D-002): the short-lived JWT access token lives in
+ * memory only; the opaque refresh token persists in localStorage so the session
+ * survives a page reload and is rotated on every refresh. localStorage is the
+ * user-accepted XSS trade-off (D-002), mitigated by short access TTL, server-side
+ * revocation and HTTPS.
+ */
+export declare function getAccessToken(): string | null;
+export declare function setAccessToken(token: string | null): void;
+export declare function getRefreshToken(): string | null;
+export declare function setRefreshToken(token: string | null): void;
+export declare function clearTokens(): void;
+/** Whether a session may exist (an access token in memory or a refresh token). */
+export declare function hasSession(): boolean;

package/app/App.d.ts

@@ -1,5 +1,5 @@
-import { type Branding } from "@/app/branding";
-import { type AppManifest, type NavigationContext } from "@/protocol/app-manifest";
+import { type Branding } from "@schema-ui/shell/app/branding";
+import { type AppManifest, type NavigationContext } from "@schema-ui/protocol/app-manifest";
 export interface AppProps {
     manifest: AppManifest;
     navigationContext?: NavigationContext;

package/app/AuthGate.d.ts

@@ -11,7 +11,7 @@
  * ("无法显示此页面"). The production-wiring regression lock lives in
  * auth-gate.wiring.test.tsx.
  */
-import type { AppManifest } from "@/protocol/app-manifest";
+import type { AppManifest } from "@schema-ui/protocol/app-manifest";
 /** Boot placeholder while the session adapter resolves (ADR-0035 D4). */
 export declare function BootScreen(): import("react").JSX.Element;
 /** Renders the login page when unauthenticated, the shell when authenticated. */

package/app/navigation.d.ts

@@ -1,5 +1,5 @@
-import { type AppManifest, type NavigationContext } from "@/protocol/app-manifest";
-import { type MessageParams } from "@/i18n/catalog";
+import { type AppManifest, type NavigationContext } from "@schema-ui/protocol/app-manifest";
+import { type MessageParams } from "@schema-ui/lib/i18n/catalog";
 export interface ProjectedLink {
     type: "link";
     href?: string;

package/components/ui/breadcrumbs.d.ts

@@ -15,7 +15,7 @@
  * "/" separators, brighter non-clickable current item, and an optional
  * small circular ghost back button (semantic parent) at the far left.
  */
-import { type MessageParams } from "@/i18n/catalog";
+import { type MessageParams } from "@schema-ui/lib/i18n/catalog";
 export interface BreadcrumbEntry {
     /** Page id (manifest pageId); group labels use the label text as key. */
     pageId: string;

package/host/boot.d.ts

@@ -6,7 +6,7 @@
  * reuses the fixture-pinned `evaluateBootstrap`, so the vendored upstream
  * host-bootstrap suite covers every stage this orchestrator executes.
  */
-import type { AppManifest } from "@/protocol/app-manifest";
+import type { AppManifest } from "@schema-ui/protocol/app-manifest";
 import { discoverBootstrapDocument, type BootstrapAuth, type BootstrapEvaluation } from "@/host/bootstrap";
 import { type HostFailure } from "@/host/failure";
 /** Session adapter state (ADR-0035 D4): normalized by AuthContext. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@magicvr/schema-ui-shell",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "type": "module",
   "description": "schema-ui-core 包面（VP-023 R3 六包化）",
   "main": "index.js",
@@ -9,21 +9,26 @@
     ".": {
       "types": "./app/index.d.ts",
       "import": "./index.js"
-    }
+    },
+    "./*": "./*"
   },
   "files": [
     "index.js",
-    "lib",
-    "theme",
-    "components",
+    "account",
     "app",
+    "components",
     "host",
     "i18n",
-    "ui",
+    "lib",
+    "protocol",
     "renderer",
-    "render"
+    "theme"
   ],
   "license": "UNLICENSED",
+  "peerDependencies": {
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
+  },
   "publishConfig": {
     "access": "public"
   }

package/protocol/app-manifest.d.ts

@@ -0,0 +1,117 @@
+export declare const DEFAULT_MANIFEST_PATH = "/.well-known/schema-ui/app-manifest.json";
+/**
+ * Host manifest-version support set (strict negotiation, ADR-0009): 2.7 for
+ * existing production manifests, 2.8 for Host/App interoperability manifests
+ * (returnIntentQueryKeys etc.), 2.9 for ADR-0039/ADR-0040 (data.route-binding /
+ * form.controls.readonly). Kept additive — older manifests stay accepted.
+ */
+export declare const APP_MANIFEST_SUPPORTED_PROTOCOL_VERSIONS: readonly ["2.7", "2.8", "2.9"];
+export declare const APP_MANIFEST_PROTOCOL_VERSION: "2.9";
+export declare const MANIFEST_SOURCE_HEADER = "X-Schema-UI-Manifest-Source";
+export declare const APP_MANIFEST_SOURCE = "https://github.com/magicvr/schema-ui-docs/tree/81aa1d8";
+/** True when `expression` matches the frozen $context expression grammar. */
+export declare function isValidExpression(expression: string): boolean;
+export type ManifestErrorCode = "MANIFEST_LOAD_FAILED" | "MISSING_PROTOCOL_VERSION" | "INVALID_PROTOCOL_VERSION" | "UNSUPPORTED_PROTOCOL_VERSION" | "PROTOCOL_VERSION_TOO_LOW" | "MISSING_REQUIRED_CAPABILITY" | "CAPABILITY_REQUIRED" | "UNKNOWN_MANIFEST_FIELD" | "INVALID_MANIFEST" | "INVALID_PATH" | "MANIFEST_HOME_PAGE_UNKNOWN" | "MANIFEST_HOME_ROUTE_PARAMETRIC" | "PAGE_REF_WITH_EMPTY_PAGES" | "MISSING_PATH_BINDING" | "MANIFEST_PAGE_ID_MISMATCH" | "INVALID_LOGO_URL" | "UNKNOWN_NAV_SLOT" | "NAV_LINK_MUTEX" | "NAV_GROUP_NESTED" | "NAV_PAGE_REF_UNKNOWN" | "INVALID_RETURN_INTENT_QUERY_KEYS" | "FORBIDDEN_VARIABLE" | "SYNTAX";
+export declare class ManifestError extends Error {
+    readonly code: ManifestErrorCode;
+    readonly path: string;
+    /** Optional machine detail (e.g. the missing capability id). */
+    readonly detail?: string;
+    constructor(code: ManifestErrorCode, path: string, message: string, detail?: string);
+}
+export interface AppInfo {
+    appId: string;
+    name?: string;
+    nameKey?: string;
+    homePageRef?: string;
+    logo?: {
+        light: string;
+        dark?: string;
+    };
+    description?: string;
+    descriptionKey?: string;
+}
+export interface PageEntry {
+    pageId: string;
+    title?: string;
+    titleKey?: string;
+    schemaUrl: string;
+    route: string;
+    /** v2.8+ (ADR-0036): auth-return intent allowlist extension for this page. */
+    returnIntentQueryKeys?: string[];
+}
+export interface VisibleWhen {
+    when: string;
+}
+export interface NavPermissions {
+    view?: string;
+}
+export interface NavLink {
+    pageRef?: string;
+    url?: string;
+    label?: string;
+    labelKey?: string;
+    icon?: string;
+    visibleWhen?: VisibleWhen;
+    permissions?: NavPermissions;
+}
+export interface NavGroup {
+    label?: string;
+    labelKey?: string;
+    icon?: string;
+    items: NavLink[];
+    visibleWhen?: VisibleWhen;
+    permissions?: NavPermissions;
+}
+export type NavItem = NavLink | NavGroup;
+export interface Navigation {
+    top?: NavItem[];
+    sidebar?: NavItem[];
+    user?: NavItem[];
+}
+export interface AppManifest {
+    protocolVersion: string;
+    requiredCapabilities: string[];
+    app: AppInfo;
+    pages: PageEntry[];
+    navigation?: Navigation;
+}
+export interface RouteMatch {
+    page: PageEntry;
+    index: number;
+    params: Record<string, string>;
+}
+export interface ResolvedRoute extends RouteMatch {
+    path: string;
+    query: Record<string, string>;
+    source: "home" | "deepLink";
+}
+export interface NavigationContext {
+    user?: Record<string, unknown>;
+    features?: Record<string, unknown>;
+}
+export declare function validateAppManifest(value: unknown): AppManifest;
+export declare function matchRoute(pages: PageEntry[], path: string): RouteMatch | undefined;
+export declare function stripPathQuery(path: string): string;
+export declare function resolveInitialRoute(manifest: AppManifest, requestedPath: string): ResolvedRoute | undefined;
+export declare function resolveSchemaUrl(baseURL: string, schemaUrl: string, params: Record<string, string>): string;
+export declare function resolveRoutePath(route: string, params: Record<string, string>): string;
+export declare function resolveLogoUrl(baseURL: string, logoUrl: string): string;
+export declare function pageIdMatches(page: PageEntry, schemaPageId: string): boolean;
+export declare function loadAppManifest(options?: {
+    url?: string;
+    fetcher?: typeof fetch;
+}): Promise<AppManifest>;
+/** Loads the manifest with its raw 200 bytes (bootstrap integrity, ADR-0035 D6). */
+export declare function loadAppManifestBytes(options?: {
+    url?: string;
+    fetcher?: typeof fetch;
+}): Promise<{
+    manifest: AppManifest;
+    bytes: Uint8Array;
+}>;
+export declare function evaluateExpression(expression: string, context: NavigationContext): boolean;
+export declare function isNavigationItemVisible(item: NavLink | NavGroup, context: NavigationContext): boolean;
+/** Normalizes a page identifier for contribution-key matching (trim + lowercase).
+ *  Added in the R4 zero-conflict upgrade drill as a protocol additive sample. */
+export declare function normalizePageID(id: string): string;

package/protocol/conformance/component-format.d.ts

@@ -0,0 +1,13 @@
+/**
+ * D-COMP component-format fixture adapter (schema-ui-docs v2.7.0).
+ * Validates format wire types without coercion.
+ */
+export type ComponentFormat = "currency" | "percent" | "datetime" | string;
+export type FormatResult = {
+    ok: true;
+    value: unknown;
+} | {
+    ok: false;
+    code: "COMPONENT_DATA_TYPE_MISMATCH";
+};
+export declare function applyComponentFormat(format: ComponentFormat, value: unknown): FormatResult;

package/protocol/conformance/query-serialize.d.ts

@@ -0,0 +1,24 @@
+/**
+ * ADR-0010 query-serialization adapter (schema-ui-docs v2.7.0 fixtures).
+ *
+ * Merges base URL query with ordered source layers; encodes keys/values per
+ * RFC 3986 (unreserved A-Za-z0-9-._~); sorts final keys by Unicode code point.
+ */
+export type QueryScalar = string | number | boolean | null;
+export type QueryPair = [string, unknown];
+export type QuerySource = QueryPair[];
+export type QuerySerializeResult = {
+    ok: true;
+    url: string;
+} | {
+    ok: false;
+    code: "INVALID_BASE_URL_QUERY" | "INVALID_QUERY_KEY" | "INVALID_QUERY_VALUE";
+};
+/** RFC3986 encode: percent-encode everything except unreserved. */
+export declare function encodeRFC3986(value: string): string;
+/**
+ * JCS-style number serialization used by query-serialization fixtures.
+ * Matches JSON number text for typical finite values (1e+21, 1e-7, 0.000001).
+ */
+export declare function serializeQueryNumber(value: number): string;
+export declare function serializeQuery(baseUrl: string, sources: QuerySource[]): QuerySerializeResult;

package/protocol/conformance/request-construction.d.ts

@@ -0,0 +1,42 @@
+/**
+ * request-construction fixture adapter (schema-ui-docs v2.7.0).
+ *
+ * Builds HTTP request / navigation / modal outcomes from declarative mappings.
+ * Batch kinds are out of scope for MVP callers (Q1); this module still implements
+ * non-batch kinds used by stage3 execution.
+ */
+export type RequestConstructionResult = {
+    ok: true;
+    request?: {
+        method: string;
+        url: string;
+        body: unknown;
+        headers?: Record<string, string>;
+    };
+    navigation?: {
+        url: string;
+    };
+    modalOpen?: {
+        modalId: string;
+    };
+    resolvedBase?: string;
+    /** Batch triggers: selection snapshot after a successful reload (ADR-0022 D2). */
+    selectionAfterSuccessReload?: {
+        keys: unknown[];
+        count: number;
+    };
+} | {
+    ok: false;
+    code: string;
+    path: string;
+};
+/** D3 invariants: scalar keys only, dedupe preserving order, count = keys.length. */
+export declare function normalizeSelection(keys: unknown[]): {
+    keys: unknown[];
+    count: number;
+};
+/**
+ * Run one request-construction fixture case.
+ * Batch kinds return a structured error; stage3 excludes them via Q1.
+ */
+export declare function constructRequest(input: Record<string, unknown>): RequestConstructionResult;

package/protocol/conformance/runtime-schema-validate.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Browser-safe structural validation for vendored page/node/action/reaction
+ * schemas. Mirrors `protocol/conformance/schema-validate.ts` but imports the
+ * pinned `docs/schemas/*.json` at build time (Vite `@schemas` alias) instead of
+ * reading them from disk, so the runtime loader can enforce D-VAL in the
+ * browser. The schema set is identical, so runtime and test-time validators
+ * stay aligned and neither redefines upstream node/page semantics.
+ */
+export type RuntimeSchemaKind = "node" | "page" | "action" | "reaction";
+export interface RuntimeSchemaValidationResult {
+    ok: boolean;
+    errors: Array<{
+        path: string;
+        message: string;
+        keyword?: string;
+    }>;
+}
+/**
+ * Structural validation of a fetched page document against the pinned page/node
+ * schemas. `ok: false` means the document must fail closed and never reach the
+ * renderer.
+ */
+export declare function validatePageDocument(document: unknown): RuntimeSchemaValidationResult;

package/protocol/conformance/upload-orchestration.d.ts

@@ -0,0 +1,102 @@
+/**
+ * Upload orchestration (schema-ui-docs@2.7.0 · docs/07-actions-contract.md §7
+ * + ADR-0012). I-PROTO-FULL-001 D-UPLOAD include.
+ *
+ * Client contract:
+ *   - one multipart request per file (fieldName default "file"; method POST
+ *     default, PUT allowed)
+ *   - constraints (multiple / maxSize / accept) are checked BEFORE any
+ *     request; any violation rejects the whole batch atomically
+ *   - accept tokens: ".ext" matches the file extension case-insensitively,
+ *     "type/*" matches the MIME main type, other tokens match MIME exactly
+ *     (case-insensitive)
+ *   - serial uploads in selection order; any failure stops the batch and no
+ *     partial field value is committed
+ *   - field value: url (priority) or id; multiple → array in selection order
+ *   - retryPolicy idempotent → Idempotency-Key header "{invocationId}:{index}"
+ */
+export interface UploadFile {
+    name: string;
+    type: string;
+    size: number;
+    contentId: string;
+}
+/** Real-transport file: an UploadFile plus the bytes to send (browser File). */
+export interface UploadableFile extends UploadFile {
+    blob: Blob;
+}
+export interface UploadActionResult {
+    url?: string;
+    id?: string;
+    method?: string;
+    fieldName?: string;
+    accept?: string;
+    maxSize?: number;
+    multiple?: boolean;
+    retryPolicy?: string;
+}
+export interface UploadRequestPart {
+    name: string;
+    fileName: string;
+    contentId: string;
+}
+export interface UploadRequest {
+    method: string;
+    url: string;
+    part: UploadRequestPart;
+    headers?: Record<string, string>;
+}
+export type UploadResult = {
+    type: "success";
+    response: {
+        url?: string;
+        id?: string;
+    };
+} | {
+    type: "failure";
+    status?: number;
+};
+export interface UploadBatchResultOk {
+    ok: true;
+    requests: UploadRequest[];
+    fieldValue: string | string[] | null;
+}
+export interface UploadBatchResultError {
+    ok: false;
+    code: string;
+    fileIndex: number;
+    requests: UploadRequest[];
+    fieldValue: null;
+}
+export type UploadBatchResult = UploadBatchResultOk | UploadBatchResultError;
+/** accept token matching (ADR-0012 D2): ".ext", "type/*", exact MIME. */
+export declare function acceptTokenMatches(token: string, file: UploadFile): boolean;
+/** Client-side constraints (ADR-0012 D2); returns the first violation. */
+export declare function validateUploadSelection(action: UploadActionResult, files: UploadFile[]): {
+    ok: true;
+} | {
+    ok: false;
+    code: string;
+    fileIndex: number;
+};
+/** Builds the per-file multipart request descriptors (pre-request). */
+export declare function buildUploadRequests(action: UploadActionResult, files: UploadFile[], invocationId?: string): UploadBatchResultError | {
+    ok: true;
+    requests: UploadRequest[];
+};
+/**
+ * Fixture-driven orchestration: replays pre-recorded transport results
+ * (`conformance/fixtures/uploads/cases.json` contract).
+ */
+export declare function runUploadBatch(input: {
+    action: UploadActionResult;
+    files: UploadFile[];
+    results?: UploadResult[];
+    invocationId?: string;
+}): UploadBatchResult;
+/**
+ * Real transport orchestration used by the Renderer's upload control: the
+ * same constraints and request shape, executed against a live fetch with
+ * multipart FormData carrying the actual file bytes (ADR-0012 D4).
+ */
+export declare function uploadFilesWithFetch(action: UploadActionResult, files: UploadableFile[], fetcher: typeof fetch, invocationId?: string): Promise<UploadBatchResult>;

package/protocol/load-page.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Runtime page-schema loader for the schema-driven render path (R1 · GOAL-002).
+ *
+ * Resolves a manifest `PageEntry`'s schemaUrl (with route-parameter expansion),
+ * fetches the page document, forces structural validation (D-VAL) against the
+ * pinned page/node schemas, and returns the parsed document or throws a unified
+ * `PageSchemaError`. The fetcher is injectable so tests exercise network,
+ * parse, and validation failure paths without a server. This module does NOT
+ * switch the app's default render branch (that is GOAL-003).
+ */
+import type { PageEntry } from "@schema-ui/protocol/app-manifest";
+export type PageSchemaErrorCode = "PAGE_LOAD_FAILED" | "PAGE_NOT_FOUND" | "PAGE_PARSE_FAILED" | "PAGE_SCHEMA_INVALID" | "PAGE_ID_MISMATCH";
+export interface PageSchemaValidationIssue {
+    path: string;
+    message: string;
+    keyword?: string;
+}
+/** Unified, observable error for the schema loading + validation pipeline. */
+export declare class PageSchemaError extends Error {
+    readonly code: PageSchemaErrorCode;
+    readonly url: string;
+    readonly issues?: PageSchemaValidationIssue[];
+    constructor(code: PageSchemaErrorCode, url: string, message: string, issues?: PageSchemaValidationIssue[]);
+}
+export interface LoadPageOptions {
+    /** Origin/base used to resolve relative schemaUrl values. Defaults to `location.origin`. */
+    baseURL?: string;
+    /** Injectable fetch; defaults to `globalThis.fetch`. */
+    fetcher?: typeof fetch;
+    /**
+     * Optional in-memory document cache keyed by resolved schemaUrl (owned by
+     * the App shell). A hit skips the network fetch AND the D-VAL structural
+     * validation (the stored document was already validated at load time, and
+     * its meta.pageId was verified against the manifest page). Intentionally
+     * opt-in: tests and callers that must observe every load pass none.
+     */
+    cache?: Map<string, unknown>;
+}
+/**
+ * Load and validate a page document for the given manifest page and route
+ * params. Resolves the schemaUrl (expanding `{param}` placeholders), fetches
+ * it, enforces structural validation, and verifies the document's `meta.pageId`
+ * matches the manifest page. Returns the parsed page document on success.
+ */
+export declare function loadPageDocument(page: PageEntry, params: Record<string, string>, options?: LoadPageOptions): Promise<unknown>;

package/renderer/custom-components.d.ts

@@ -1,5 +1,5 @@
 import type { ComponentType } from "react";
-import type { RenderCustomNode, RenderNode } from "@/renderer/render.types";
+import type { RenderCustomNode, RenderNode } from "@schema-ui/renderer/renderer/render.types";
 export interface CustomComponentProps {
     node: RenderCustomNode;
     context: Record<string, unknown>;

package/renderer/form-controls.d.ts

@@ -1,7 +1,7 @@
 import { type ReactNode } from "react";
-import { type MessageParams } from "@/i18n/catalog";
-import type { UploadableFile } from "@/protocol/conformance/upload-orchestration";
-import { type FormControlField } from "@/renderer/form-controls.types";
+import { type MessageParams } from "@schema-ui/lib/i18n/catalog";
+import type { UploadableFile } from "@schema-ui/protocol/conformance/upload-orchestration";
+import { type FormControlField } from "@schema-ui/renderer/renderer/form-controls.types";
 export interface FormControlsProps {
     fields: FormControlField[];
     values: Record<string, unknown>;

package/renderer/permissions.d.ts

@@ -1,4 +1,4 @@
-import { type NavigationContext } from "@/protocol/app-manifest";
+import { type NavigationContext } from "@schema-ui/protocol/app-manifest";
 /**
  * R4 D-PERM permission evaluation engine (ADR-0023, frozen by GOAL-006 D-004).
  *

package/renderer/render.d.ts

@@ -1,8 +1,8 @@
 import { type ComponentType, type ReactNode } from "react";
-import { type UploadableFile } from "@/protocol/conformance/upload-orchestration";
-import { type FormControlField } from "@/renderer/form-controls.types";
-import { type ResourceList, type ResourceQuery } from "@/renderer/resource";
-import { type RenderActionButtonNode, type RenderChartNode, type RenderFormNode, type RenderPageDocument, type RenderStatCardNode, type RenderTableNode } from "@/renderer/render.types";
+import { type UploadableFile } from "@schema-ui/protocol/conformance/upload-orchestration";
+import { type FormControlField } from "@schema-ui/renderer/renderer/form-controls.types";
+import { type ResourceList, type ResourceQuery } from "@schema-ui/renderer/renderer/resource";
+import { type RenderActionButtonNode, type RenderChartNode, type RenderFormNode, type RenderPageDocument, type RenderStatCardNode, type RenderTableNode } from "@schema-ui/renderer/renderer/render.types";
 /**
  * R5 D-COMP minimal Renderer (resolve R4 F-002) + S4 Schema CRUD (GOAL-007).
  *

package/renderer/render.types.d.ts

@@ -1,5 +1,5 @@
-import { type FormControlField, type FormControlGateError } from "@/renderer/form-controls.types";
-import { type FormControlStateMap, type ReactionError } from "@/renderer/reactions";
+import { type FormControlField, type FormControlGateError } from "@schema-ui/renderer/renderer/form-controls.types";
+import { type FormControlStateMap, type ReactionError } from "@schema-ui/renderer/renderer/reactions";
 /**
  * D-COMP page renderer (frozen §5 whitelist + I-PROTO-FULL-001 full registry
  * surface; resolve R4 F-002).

package/renderer/resource.d.ts

@@ -1,4 +1,4 @@
-import type { SortOrder } from "@/components/data-table";
+import type { SortOrder } from "@schema-ui/renderer/components/data-table";
 export declare const DEFAULT_PAGE_SIZE = 10;
 /**
  * Frozen list-endpoint rule (I-010-001 v0.2.0 · A-001 F-001): `table.props.dataSource`

package/renderer/schema-table.d.ts

@@ -1,5 +1,5 @@
-import { type ResourceItem } from "@/renderer/resource";
-import type { RenderTableNode } from "@/renderer/render.types";
+import { type ResourceItem } from "@schema-ui/renderer/renderer/resource";
+import type { RenderTableNode } from "@schema-ui/renderer/renderer/render.types";
 /**
  * Default schema-driven table surface (R1 · GOAL-004 / D-004) + S4 CRUD wiring
  * + A-002 generic adapter (GOAL-010 S3).