@sigrun/shared 0.4.1 → 0.5.0

package/CHANGELOG.md

@@ -5,7 +5,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.5.0] - 2026-11-02
+
+Version-companion release for sigrun 0.5.0 (no shared changes).
+## [0.4.2] - 2026-10-31
+
+### Fixed
+- The published tarball carries `dist/` again (`prepublishOnly` builds
+  before `npm publish` — releases 0.2.0–0.4.1 shipped without it).
 
 ## [0.4.1] - 2026-10-31
 
@@ -54,3 +61,4 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   conversation/turn shaping, the channel wire types, session-meta,
   commands, interactions, ambient records, access, settings, views,
   view-delta, and jobs — the surfaces the webui, TUI, and server share.
+

package/dist/access.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Per-resource sharing and content access (core hardening W1 Task 5, spec
+ * §5.9 ruling 6/10: per-resource sharing; multi-user M3b adds groups).
+ *
+ * Part of the shared leaf package (`@sigrun/shared`): the server computes
+ * access through `accessOf`, the clients render the `sharing` state — one
+ * source of truth, no drift. PURE module: no imports at all (the
+ * views-purity guard enforces this across `shared/src`).
+ *
+ * The rules, in order (first match wins):
+ *
+ * 0. internal resource → none (curator P5: a conversation created for
+ *    curator work is invisible to EVERY caller — the superuser included);
+ * 1. superuser → write;
+ * 2. ownerless resource → household write (everyone);
+ * 3. user === owner → write;
+ * 4. household sharing with a defined user → the shared level;
+ * 5. people sharing including the user or one of their groups → the shared level;
+ * 6. otherwise none (hidden: 404 on every :id route, absent from lists).
+ *
+ * Anonymous callers (a principal with no user) get nothing from a shared
+ * resource: sharing widens access for identified users only (rule 4/5
+ * require a defined user), while ownerless stays open to everyone by
+ * rule 2.
+ */
+/** What a conversation's owner grants beyond themselves. */
+export type Sharing = {
+    readonly scope: "private";
+} | {
+    readonly scope: "household";
+    readonly level: "read" | "write";
+} | {
+    readonly scope: "people";
+    readonly users: string[];
+    readonly groups?: string[];
+    readonly level: "read" | "write";
+};
+/** The resolved access level of a principal to one resource. */
+export type Access = "none" | "read" | "write";
+/** What accessOf needs of the caller (the server's Principal projects here). */
+export interface AccessPrincipal {
+    readonly user?: string;
+    readonly superuser?: boolean;
+    readonly groups?: readonly string[];
+}
+/**
+ * Resolve one principal's access to one resource. Rule order per the
+ * module doc; the first matching rule wins.
+ */
+export declare function accessOf(p: AccessPrincipal, r: {
+    readonly owner?: string;
+    readonly sharing?: Sharing;
+    readonly internal?: true;
+}): Access;
+/**
+ * Type guard for the wire value: every scope shape checked strictly
+ * (wrong field types are not a Sharing). An empty `people.users` list is
+ * valid (shares with nobody yet) — validation is about shape, not policy.
+ */
+export declare function isSharing(value: unknown): value is Sharing;

package/dist/access.js

@@ -0,0 +1,87 @@
+/**
+ * Per-resource sharing and content access (core hardening W1 Task 5, spec
+ * §5.9 ruling 6/10: per-resource sharing; multi-user M3b adds groups).
+ *
+ * Part of the shared leaf package (`@sigrun/shared`): the server computes
+ * access through `accessOf`, the clients render the `sharing` state — one
+ * source of truth, no drift. PURE module: no imports at all (the
+ * views-purity guard enforces this across `shared/src`).
+ *
+ * The rules, in order (first match wins):
+ *
+ * 0. internal resource → none (curator P5: a conversation created for
+ *    curator work is invisible to EVERY caller — the superuser included);
+ * 1. superuser → write;
+ * 2. ownerless resource → household write (everyone);
+ * 3. user === owner → write;
+ * 4. household sharing with a defined user → the shared level;
+ * 5. people sharing including the user or one of their groups → the shared level;
+ * 6. otherwise none (hidden: 404 on every :id route, absent from lists).
+ *
+ * Anonymous callers (a principal with no user) get nothing from a shared
+ * resource: sharing widens access for identified users only (rule 4/5
+ * require a defined user), while ownerless stays open to everyone by
+ * rule 2.
+ */
+/**
+ * Resolve one principal's access to one resource. Rule order per the
+ * module doc; the first matching rule wins.
+ */
+export function accessOf(p, r) {
+    // 0. Internal (curator P5): invisible to everyone, the superuser
+    // included — BEFORE any other rule can widen access. The marker is
+    // server-owned (written once in the creating commit), so no caller,
+    // share, or role can ever open an internal resource.
+    if (r.internal === true)
+        return "none";
+    // 1. The superuser always writes.
+    if (p.superuser === true)
+        return "write";
+    // 2. Ownerless is household-write for everyone.
+    if (r.owner === undefined)
+        return "write";
+    // 3. The owner always writes.
+    if (p.user !== undefined && p.user === r.owner)
+        return "write";
+    // 4./5. Sharing widens identified users only — an anonymous caller
+    // (no user) falls straight through to none.
+    if (p.user !== undefined && r.sharing !== undefined) {
+        if (r.sharing.scope === "household")
+            return r.sharing.level;
+        if (r.sharing.scope === "people") {
+            const sharing = r.sharing;
+            if (sharing.users.includes(p.user) ||
+                p.groups?.some((group) => sharing.groups?.includes(group)) === true) {
+                return sharing.level;
+            }
+        }
+    }
+    // 6. Hidden.
+    return "none";
+}
+/**
+ * Type guard for the wire value: every scope shape checked strictly
+ * (wrong field types are not a Sharing). An empty `people.users` list is
+ * valid (shares with nobody yet) — validation is about shape, not policy.
+ */
+export function isSharing(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return false;
+    }
+    const record = value;
+    switch (record.scope) {
+        case "private":
+            return true;
+        case "household":
+            return record.level === "read" || record.level === "write";
+        case "people":
+            return (Array.isArray(record.users) &&
+                record.users.every((user) => typeof user === "string") &&
+                (record.groups === undefined ||
+                    (Array.isArray(record.groups) &&
+                        record.groups.every((group) => typeof group === "string"))) &&
+                (record.level === "read" || record.level === "write"));
+        default:
+            return false;
+    }
+}

package/dist/ambient.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The ambient seam TYPES (spec: docs/approval-ux-seams.md, "Ambient
+ * surfaces"; the block mapping: UI-blocks design §9.2): the channel-neutral record
+ * shapes for persistent read-mostly state — statusline slots and panel
+ * widgets — written by extensions through the host context and rendered
+ * by channels generically.
+ *
+ * The CANONICAL type declarations live here (the shared leaf package);
+ * `src/harness/ambient.ts` imports them (type-only) for the doc
+ * definitions and validation runtime. The records ride the §5 wire
+ * AS-IS (envelope + body + details — never projected), so these shapes
+ * are the channel contract too (see `@sigrun/shared/views`).
+ *
+ * Lifecycle difference from interactions: an ambient surface is replaced
+ * repeatedly (write = FULL state replacement, never a delta) and never
+ * blocks. One slot key is owned by exactly one extension (allocation,
+ * not silent composition — the pi-zentui chrome-skin lesson).
+ *
+ * Layering mirrors the interaction seam: strict envelope (key, place,
+ * budget, refresh, expires) around a block-tree body (placement
+ * `ambient`; `status`/`footer` allow one line), with opaque `details`.
+ * The legacy `line`/`rows`/`gauge`/`ledger` primitives are REJECTED
+ * (ruling 16: no compatibility layer).
+ */
+import type { Tree } from "./blocks/index.js";
+import type { JsonObject } from "./json.js";
+/** Where a channel places the surface. */
+export type AmbientPlace = "status" | "footer" | "panel";
+/** The strict envelope + block-tree body of one ambient surface. */
+export type AmbientRecord = {
+    /** The keyed slot id ("goal", "rpiv-todos", "fabric"). */
+    readonly key: string;
+    /** Which extension owns this key (set by the host context, not the author). */
+    readonly owner: string;
+    readonly place: AmbientPlace;
+    /** Panel row budget / line-slot width guidance (channel advisory). */
+    readonly maxRows?: number;
+    /** Overflow policy for panels (rpiv-todo's drop-completed-first rule). */
+    readonly overflow?: "drop" | "wrap" | "summarize";
+    /** Channel re-render hint between data writes (countdowns, clocks), ms. */
+    readonly refreshMs?: number;
+    /** Auto-clear rule: "never" stays until replaced with an empty body. */
+    readonly expires: "never" | "idle";
+    readonly updatedAt: number;
+    /**
+     * The ambient body: a block tree (placement `ambient`). `status` and
+     * `footer` allow one line — a single line-level block or one
+     * `columns` of one-line blocks. Undefined = the surface is cleared.
+     * Legacy-shaped bodies fail validation (ruling 16).
+     */
+    readonly body?: Tree;
+    /** Opaque extension-owned payload; rendered collapsed, never interpreted. */
+    readonly details?: JsonObject;
+};

package/dist/ambient.js

@@ -0,0 +1,25 @@
+/**
+ * The ambient seam TYPES (spec: docs/approval-ux-seams.md, "Ambient
+ * surfaces"; the block mapping: UI-blocks design §9.2): the channel-neutral record
+ * shapes for persistent read-mostly state — statusline slots and panel
+ * widgets — written by extensions through the host context and rendered
+ * by channels generically.
+ *
+ * The CANONICAL type declarations live here (the shared leaf package);
+ * `src/harness/ambient.ts` imports them (type-only) for the doc
+ * definitions and validation runtime. The records ride the §5 wire
+ * AS-IS (envelope + body + details — never projected), so these shapes
+ * are the channel contract too (see `@sigrun/shared/views`).
+ *
+ * Lifecycle difference from interactions: an ambient surface is replaced
+ * repeatedly (write = FULL state replacement, never a delta) and never
+ * blocks. One slot key is owned by exactly one extension (allocation,
+ * not silent composition — the pi-zentui chrome-skin lesson).
+ *
+ * Layering mirrors the interaction seam: strict envelope (key, place,
+ * budget, refresh, expires) around a block-tree body (placement
+ * `ambient`; `status`/`footer` allow one line), with opaque `details`.
+ * The legacy `line`/`rows`/`gauge`/`ledger` primitives are REJECTED
+ * (ruling 16: no compatibility layer).
+ */
+export {};

package/dist/blocks/format.d.ts

@@ -0,0 +1,28 @@
+/**
+ * `formatValue` (UI-blocks spec §5.3): the one value formatter behind
+ * `format` props — `stat`, `meter`, table columns, chart axes and card
+ * time slots. Pure `Intl` only; no imports outside `shared/src/`.
+ *
+ * Determinism (spec §14.3): the same input and locale give the same
+ * bytes. Everything here is derived from the arguments — no clock
+ * reads (the `relative` format takes the timestamp to describe, and
+ * `now` comes from `Date.now()` at the CALL SITE inside `toText`
+ * rendering... which is equally forbidden to wander). `relative` is
+ * therefore stable within a call and pinned by tests that pass a
+ * timestamp chosen so the unit boundary cannot flip mid-run.
+ */
+import type { JsonValue } from "../json.js";
+/**
+ * Render `value` in `format` for `locale` (spec §5.3's format list).
+ *
+ * - `undefined` format: numbers group digits; strings pass through;
+ *   `null` renders empty; booleans spell out; objects and arrays render
+ *   as JSON with SORTED keys (deterministic bytes regardless of the
+ *   key order the data arrived in).
+ * - `datetime`/`date`/`time` take epoch milliseconds or an ISO string,
+ *   rendered in `timeZone` when given (defaults to the locale's).
+ * - `relative` describes a timestamp relative to `Date.now()`; the unit
+ *   is chosen by the span, per `Intl.RelativeTimeFormat`.
+ * - An unknown format falls back to plain number formatting.
+ */
+export declare function formatValue(value: JsonValue, format: string | undefined, locale: string, timeZone?: string): string;

package/dist/blocks/format.js

@@ -0,0 +1,199 @@
+/**
+ * `formatValue` (UI-blocks spec §5.3): the one value formatter behind
+ * `format` props — `stat`, `meter`, table columns, chart axes and card
+ * time slots. Pure `Intl` only; no imports outside `shared/src/`.
+ *
+ * Determinism (spec §14.3): the same input and locale give the same
+ * bytes. Everything here is derived from the arguments — no clock
+ * reads (the `relative` format takes the timestamp to describe, and
+ * `now` comes from `Date.now()` at the CALL SITE inside `toText`
+ * rendering... which is equally forbidden to wander). `relative` is
+ * therefore stable within a call and pinned by tests that pass a
+ * timestamp chosen so the unit boundary cannot flip mid-run.
+ */
+/** The byte-scale units `bytes` walks up through (binary steps of 1024). */
+const BYTE_UNITS = ["B", "KB", "MB", "GB", "TB", "PB"];
+/** The duration steps `duration` walks down through, with their ms sizes. */
+const DURATION_STEPS = [
+    { unit: "d", ms: 86_400_000 },
+    { unit: "h", ms: 3_600_000 },
+    { unit: "m", ms: 60_000 },
+    { unit: "s", ms: 1_000 },
+    { unit: "ms", ms: 1 },
+];
+/** A locale-aware number formatter with at most `max` fraction digits. */
+function numberFormatter(locale, maximumFractionDigits) {
+    return new Intl.NumberFormat(locale, { maximumFractionDigits });
+}
+/**
+ * `bytes`: 1024-based scale with a `maximumFractionDigits: 1` number,
+ * e.g. `1536 → "1.5 KB"`, `512 → "512 B"`.
+ */
+function formatBytes(value, locale) {
+    let unit = 0;
+    let scaled = value;
+    while (Math.abs(scaled) >= 1024 && unit < BYTE_UNITS.length - 1) {
+        scaled /= 1024;
+        unit++;
+    }
+    return `${numberFormatter(locale, 1).format(scaled)} ${BYTE_UNITS[unit]}`;
+}
+/**
+ * `duration`: milliseconds in, the two most significant non-zero units
+ * out, e.g. `11520000 → "3h 12m"`, `1500 → "1s 500ms"`, `0 → "0s"`.
+ * Sub-second remainders are truncated (not rounded) so the last unit
+ * named is the one actually covered.
+ */
+function formatDuration(ms, locale) {
+    let rest = Math.trunc(ms);
+    const parts = [];
+    for (const step of DURATION_STEPS) {
+        if (parts.length === 2)
+            break;
+        if (rest >= step.ms || (parts.length > 0 && rest > 0)) {
+            const size = Math.floor(rest / step.ms);
+            parts.push(`${numberFormatter(locale, 0).format(size)}${step.unit}`);
+            rest -= size * step.ms;
+        }
+    }
+    if (parts.length === 0)
+        return `0s`;
+    return parts.join(" ");
+}
+/** Coerce a datetime-ish JSON value to epoch milliseconds, or `undefined`. */
+function epochMillis(value) {
+    if (typeof value === "number")
+        return value;
+    if (typeof value === "string") {
+        const parsed = Date.parse(value);
+        return Number.isNaN(parsed) ? undefined : parsed;
+    }
+    return undefined;
+}
+/**
+ * Render `value` in `format` for `locale` (spec §5.3's format list).
+ *
+ * - `undefined` format: numbers group digits; strings pass through;
+ *   `null` renders empty; booleans spell out; objects and arrays render
+ *   as JSON with SORTED keys (deterministic bytes regardless of the
+ *   key order the data arrived in).
+ * - `datetime`/`date`/`time` take epoch milliseconds or an ISO string,
+ *   rendered in `timeZone` when given (defaults to the locale's).
+ * - `relative` describes a timestamp relative to `Date.now()`; the unit
+ *   is chosen by the span, per `Intl.RelativeTimeFormat`.
+ * - An unknown format falls back to plain number formatting.
+ */
+export function formatValue(value, format, locale, timeZone) {
+    switch (format) {
+        case "number":
+        case undefined:
+            return plain(value, locale);
+        case "compact":
+            return typeof value === "number"
+                ? new Intl.NumberFormat(locale, {
+                    notation: "compact",
+                    maximumFractionDigits: 1,
+                }).format(value)
+                : plain(value, locale);
+        case "percent":
+            return typeof value === "number"
+                ? new Intl.NumberFormat(locale, {
+                    style: "percent",
+                    maximumFractionDigits: 1,
+                }).format(value)
+                : plain(value, locale);
+        case "bytes":
+            return typeof value === "number" ? formatBytes(value, locale) : plain(value, locale);
+        case "duration":
+            return typeof value === "number" ? formatDuration(value, locale) : plain(value, locale);
+        case "datetime":
+        case "date":
+        case "time": {
+            const at = epochMillis(value);
+            if (at === undefined)
+                return plain(value, locale);
+            const options = format === "datetime"
+                ? { dateStyle: "medium", timeStyle: "short" }
+                : format === "date"
+                    ? { dateStyle: "medium" }
+                    : { timeStyle: "medium" };
+            return new Intl.DateTimeFormat(locale, timeZone ? { ...options, timeZone } : options).format(at);
+        }
+        case "relative": {
+            const at = epochMillis(value);
+            if (at === undefined)
+                return plain(value, locale);
+            return relativeFrom(at, Date.now(), locale);
+        }
+        default:
+            if (format.startsWith("currency:")) {
+                const currency = format.slice("currency:".length);
+                if (typeof value !== "number")
+                    return plain(value, locale);
+                try {
+                    return new Intl.NumberFormat(locale, {
+                        style: "currency",
+                        currency,
+                    }).format(value);
+                }
+                catch {
+                    // An invalid ISO 4217 code (validation's job to catch
+                    // earlier) renders as a plain number, never a throw.
+                    return numberFormatter(locale, 2).format(value);
+                }
+            }
+            return plain(value, locale);
+    }
+}
+/** The no-format rendering: locale-numbered primitives, sorted-key JSON. */
+function plain(value, locale) {
+    if (value === null)
+        return "";
+    switch (typeof value) {
+        case "string":
+            return value;
+        case "number":
+            return new Intl.NumberFormat(locale, { maximumFractionDigits: 3 }).format(value);
+        case "boolean":
+            return value ? "true" : "false";
+        default:
+            return JSON.stringify(sortKeys(value));
+    }
+}
+/** Recursively copy `value` with every object's keys in sorted order. */
+function sortKeys(value) {
+    if (Array.isArray(value))
+        return value.map(sortKeys);
+    if (value !== null && typeof value === "object") {
+        const out = {};
+        for (const key of Object.keys(value).sort()) {
+            out[key] = sortKeys(value[key]);
+        }
+        return out;
+    }
+    return value;
+}
+/**
+ * `"<span> ago"` for a timestamp: picks the unit whose threshold the
+ * span has crossed (`Intl.RelativeTimeFormat` conventions: seconds
+ * under a minute, minutes under an hour, hours under a day, days under
+ * a week, then weeks, months, years).
+ */
+function relativeFrom(at, now, locale) {
+    const spanSeconds = Math.round((at - now) / 1000);
+    const abs = Math.abs(spanSeconds);
+    const rtf = new Intl.RelativeTimeFormat(locale, { numeric: "auto" });
+    if (abs < 60)
+        return rtf.format(spanSeconds, "second");
+    if (abs < 3600)
+        return rtf.format(Math.round(spanSeconds / 60), "minute");
+    if (abs < 86_400)
+        return rtf.format(Math.round(spanSeconds / 3600), "hour");
+    if (abs < 7 * 86_400)
+        return rtf.format(Math.round(spanSeconds / 86_400), "day");
+    if (abs < 30 * 86_400)
+        return rtf.format(Math.round(spanSeconds / (7 * 86_400)), "week");
+    if (abs < 365 * 86_400)
+        return rtf.format(Math.round(spanSeconds / (30 * 86_400)), "month");
+    return rtf.format(Math.round(spanSeconds / (365 * 86_400)), "year");
+}

package/dist/blocks/icons.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The named icons (UI-blocks spec §10.2): a CLOSED set of 49 names.
+ *
+ * The webui draws them from a bundled subset of Lucide; the TUI maps
+ * each name to a Unicode glyph with an ASCII fallback. An unknown icon
+ * name fails validation (U0 Task 2) — `IconName` is the literal union,
+ * so a typo is a type error wherever the contract is used literally.
+ */
+/** The v1 icon set, exactly as spec §10.2 pins it. */
+export declare const ICON_NAMES: readonly ["add", "edit", "delete", "refresh", "search", "filter", "share", "copy", "link", "external", "more", "check", "close", "drag", "file", "folder", "calendar", "clock", "user", "users", "tag", "list", "board", "chart", "image", "book", "cart", "home", "bell", "lock", "key", "info", "warn", "error", "success", "pending", "running", "sun", "moon", "cloud", "cloud-sun", "cloud-rain", "cloud-snow", "cloud-lightning", "fog", "wind", "droplets", "thermometer", "umbrella"];
+/** One name from the closed set. */
+export type IconName = (typeof ICON_NAMES)[number];

package/dist/blocks/icons.js

@@ -0,0 +1,64 @@
+/**
+ * The named icons (UI-blocks spec §10.2): a CLOSED set of 49 names.
+ *
+ * The webui draws them from a bundled subset of Lucide; the TUI maps
+ * each name to a Unicode glyph with an ASCII fallback. An unknown icon
+ * name fails validation (U0 Task 2) — `IconName` is the literal union,
+ * so a typo is a type error wherever the contract is used literally.
+ */
+/** The v1 icon set, exactly as spec §10.2 pins it. */
+export const ICON_NAMES = [
+    // navigation and actions
+    "add",
+    "edit",
+    "delete",
+    "refresh",
+    "search",
+    "filter",
+    "share",
+    "copy",
+    "link",
+    "external",
+    "more",
+    "check",
+    "close",
+    "drag",
+    // objects
+    "file",
+    "folder",
+    "calendar",
+    "clock",
+    "user",
+    "users",
+    "tag",
+    "list",
+    "board",
+    "chart",
+    "image",
+    "book",
+    "cart",
+    "home",
+    "bell",
+    "lock",
+    "key",
+    // status
+    "info",
+    "warn",
+    "error",
+    "success",
+    "pending",
+    "running",
+    // weather
+    "sun",
+    "moon",
+    "cloud",
+    "cloud-sun",
+    "cloud-rain",
+    "cloud-snow",
+    "cloud-lightning",
+    "fog",
+    "wind",
+    "droplets",
+    "thermometer",
+    "umbrella",
+];

package/dist/blocks/index.d.ts

@@ -0,0 +1,25 @@
+/**
+ * `@sigrun/shared/blocks` — the block-set foundation (UI-blocks U0).
+ *
+ * One entry point for the wire types (§4/§5/§6.1), the data-op applier
+ * (§4.3), the icon names (§10.2), display downsampling (§5.4), and the
+ * channel-facing surface transport. Consumed by the server, the webui
+ * and the TUI alike; re-exported for extensions through
+ * `@sigrun/sigrun/blocks` (U0 Task 4).
+ *
+ * The runtime half is deliberately tiny and dependency-free: the purity
+ * guard (`test/views-purity.test.ts`) holds every specifier inside
+ * `shared/src/`.
+ */
+export { BLOCK_SET_VERSION } from "./types.js";
+export { DataOpError, applyOps, resolvePointer } from "./ops.js";
+export { ICON_NAMES } from "./icons.js";
+export { lttb } from "./lttb.js";
+export { formatValue } from "./format.js";
+export { toText } from "./text.js";
+export { canonicalJson, eventKeyWeb, instanceKey } from "./instance.js";
+export type { Action, ActionButton, Bindable, Binding, Block, BlockBase, BulkAction, CalloutBlock, Card, CardBadge, CardMetric, CardMeta, CardStatus, ChartAxisX, ChartAxisY, ChartBlock, ChartSeries, ChartThreshold, ChoiceField, ChoiceOption, CollectionBlock, CollectionColumn, CollectionGroup, CollectionSort, CollectionTime, ColumnChild, ColumnsBlock, Confirm, CoreTarget, DataOp, DataOps, DataUpdate, DateField, DatePreset, DaterangeField, DatetimeField, DetailsBlock, DiffBlock, Field, FieldBase, FieldsBlock, FieldsRow, FileField, Format, FormBlock, GridBlock, GridChild, ImageBlock, ListField, LogBlock, LogLine, LongtextField, MarkdownBlock, MeterBlock, MeterThreshold, NumberField, PageBlock, PageEmpty, Placement, SectionBlock, SecretField, Size, StackBlock, StatBlock, TextField, ToggleField, Tone, Tree, TreeBlock, TreeNode, WidthCondition, } from "./types.js";
+export type { IconName } from "./icons.js";
+export type { TextOptions } from "./text.js";
+export type { SurfaceAccess, SurfaceActErr, SurfaceActOk, SurfaceActResult, SurfaceChangedEvent, SurfaceFetch, SurfaceLoad, SurfaceTransport, SurfaceUploadBody, } from "./transport.js";
+export type { JsonObject, JsonValue } from "../json.js";

package/dist/blocks/index.js

@@ -0,0 +1,21 @@
+/**
+ * `@sigrun/shared/blocks` — the block-set foundation (UI-blocks U0).
+ *
+ * One entry point for the wire types (§4/§5/§6.1), the data-op applier
+ * (§4.3), the icon names (§10.2), display downsampling (§5.4), and the
+ * channel-facing surface transport. Consumed by the server, the webui
+ * and the TUI alike; re-exported for extensions through
+ * `@sigrun/sigrun/blocks` (U0 Task 4).
+ *
+ * The runtime half is deliberately tiny and dependency-free: the purity
+ * guard (`test/views-purity.test.ts`) holds every specifier inside
+ * `shared/src/`.
+ */
+// ─── Runtime (pure, dependency-free) ──────────────────────────────────────
+export { BLOCK_SET_VERSION } from "./types.js";
+export { DataOpError, applyOps, resolvePointer } from "./ops.js";
+export { ICON_NAMES } from "./icons.js";
+export { lttb } from "./lttb.js";
+export { formatValue } from "./format.js";
+export { toText } from "./text.js";
+export { canonicalJson, eventKeyWeb, instanceKey } from "./instance.js";

package/dist/blocks/instance.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The instance-key helpers the CHANNELS need (UI-blocks U3 Task 5, spec
+ * §7.3): `canonicalJson` (the default `instanceKey`) and
+ * `eventKeyWeb`/`eventKeyNode` (the wire `k` — sha256 hex of
+ * `slug\0id\0key`). The server's copy lives in
+ * `src/server/surfaces/instance.ts`; these are the DOM- and Node-safe
+ * twins (WebCrypto's `crypto.subtle.digest` vs `node:crypto`), kept
+ * byte-compatible by the shared canonical-JSON rule.
+ *
+ * The wire's purity rule holds: NO node: imports here — the Node flavor
+ * is a separate module (`instance-node.ts`) so the webui never sees it.
+ */
+import type { JsonObject, JsonValue } from "../json.js";
+/**
+ * Canonical JSON: every object serializes with keys SORTED (recursive);
+ * primitives and arrays serialize as usual. Two params objects equal up
+ * to key order produce byte-identical strings — the same rule as the
+ * server's `canonicalJson` (kept in sync by hand; both sides pin it by
+ * test).
+ */
+export declare function canonicalJson(value: JsonValue): string;
+/** The default instance key (spec §7.3): canonical JSON of the params. */
+export declare function instanceKey(params: JsonObject): string;
+/**
+ * The wire `k` for one surface instance (spec §7.3), WebCrypto flavor:
+ * `sha256(slug + "\0" + id + "\0" + key)` hex. Async (the DOM digest is
+ * promise-shaped); the Node twin (`instance-node.ts`) is sync.
+ */
+export declare function eventKeyWeb(slug: string, id: string, key: string): Promise<string>;