@sigrun/sigrun 0.0.0-stage → 0.1.0

package/dist/skills/index.js

@@ -0,0 +1,418 @@
+/**
+ * The skills convention (spec §3.2 + §9.4) — CORE-OWNED, not an extension
+ * package.
+ *
+ * v1 discovered ONE root: `skills/<dir>/SKILL.md` in the conversation
+ * workspace. W5 Task 4 (spec §9.4) grows discovery to THREE roots, with
+ * first-wins precedence in this order:
+ *
+ * 1. the WORKSPACE root — `skills/` under the conversation workspace, read
+ *    through the conversation `ExecutionEnv` (the section via
+ *    `PromptInput.env`, the tool via `ToolExecutionApi.env`), so discovery
+ *    follows the resolved workspace;
+ * 2. the USER root — `<configDir>/skills/` (a named config-root entry),
+ *    read from the host filesystem;
+ * 3. PACKAGE roots — skill directories shipped by extension packages
+ *    (manifest `sigrun.skills`/`pi.skills` dirs and factory-result `skills`
+ *    dirs, collected by the loader in install order), read from the host
+ *    filesystem.
+ *
+ * A name that appears in several roots keeps the HIGHER root's skill and
+ * logs `skills: "<name>" from <lower root> shadowed by <higher root>`.
+ * `load_skill(name)` returns the WINNING skill's body, read from its own
+ * root — the env for workspace skills, the filesystem for the others.
+ * User/package skills belong to the deployment; workspace skills belong to
+ * the workspace (under a future remote workspace the two sources differ in
+ * location — intended).
+ *
+ * v1 semantics (spec §3.2, unchanged per root):
+ *
+ * - Discovery: `<dir>/SKILL.md` only; other files ignored.
+ * - Frontmatter `name` and `description` required (single-line values,
+ *   matching quotes stripped); `disable-model-invocation: true` hides the
+ *   skill from the model entirely — absent from the section, unknown to
+ *   `load_skill` (pi's convention); all other fields ignored. A SKILL.md
+ *   missing either required field — or the `---` block entirely — is
+ *   skipped with a log.
+ * - Within one root, duplicate names resolve first-wins (the earlier
+ *   directory in sorted order) with a log; across roots, the precedence
+ *   order above decides.
+ * - The section lists `- name: description (path)` per skill, capped at
+ *   `sectionMaxBytes()` (default 4KB, read LIVE per render — boot wires
+ *   the settings store) with a truncation notice when capped; zero skills
+ *   render no section.
+ * - `load_skill(name)` returns the SKILL.md body (everything after the
+ *   frontmatter block); an unknown name is an explicit error listing the
+ *   available skills.
+ *
+ * `listSkills` (Task 2c) is the `/skill:name`-facing list: the SAME
+ * three-root discovery but WITHOUT the model-visibility filter — a
+ * `disable-model-invocation: true` skill is hidden from the section and
+ * unknown to `load_skill` yet still expands through `/skill:name`
+ * (pi's convention). It carries the flag so the section keeps
+ * filtering; nothing about the section's behaviour changes.
+ * Built through `createSkillsExtension(opts)` so boot can wire the three
+ * roots; it still installs as the core extension named `sigrun.skills`
+ * (the reserved-section owner is unchanged) and never goes through the
+ * extension loader.
+ */
+import { Type } from "@earendil-works/pi-ai";
+import { defineExtension, defineTool, section, } from "@earendil-works/pi-durable";
+import { readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+/** The section key the skills list renders under. */
+export const SKILLS_SECTION_KEY = "skills";
+/** Total rendered-section budget (spec §3.2: 4KB, notice included). */
+export const SKILLS_SECTION_LIMIT_BYTES = 4096;
+const SKILLS_DIRECTORY = "skills";
+const SKILL_FILE = "SKILL.md";
+const FRONTMATTER_DELIMITER = "---";
+const SKILLS_SECTION_HEADER = "Workspace skills. Call the load_skill tool with a skill's name to read its full instructions; each entry shows the skill's path, so you can also read its SKILL.md directly.";
+/** The three discovery roots, in precedence order (§9.4). */
+const ROOT_PRECEDENCE = ["workspace", "user dir", "package"];
+const encoder = new TextEncoder();
+/** UTF-8 byte length — the unit the section cap is measured in. */
+function byteLength(text) {
+    return encoder.encode(text).length;
+}
+/** Strip one matching pair of surrounding quotes, if present. */
+function unquote(value) {
+    if (value.length >= 2) {
+        const first = value[0];
+        const last = value[value.length - 1];
+        if ((first === '"' && last === '"') || (first === "'" && last === "'")) {
+            return value.slice(1, -1);
+        }
+    }
+    return value;
+}
+/**
+ * Parse a SKILL.md: the frontmatter must be a `---`-delimited block of
+ * `key: value` lines at the very top; the body is everything after the
+ * closing delimiter. Returns `undefined` when the block is absent or never
+ * closes (neither required field could have parsed).
+ */
+function parseSkillFile(text) {
+    const lines = text.split(/\r?\n/);
+    if (lines[0]?.trim() !== FRONTMATTER_DELIMITER)
+        return undefined;
+    let close = -1;
+    for (let i = 1; i < lines.length; i++) {
+        if (lines[i]?.trim() === FRONTMATTER_DELIMITER) {
+            close = i;
+            break;
+        }
+    }
+    if (close === -1)
+        return undefined;
+    const fields = {};
+    for (const line of lines.slice(1, close)) {
+        const match = /^([A-Za-z0-9_-]+):\s*(.*)$/.exec(line);
+        if (match === null)
+            continue;
+        const value = unquote(match[2].trim());
+        if (value !== "")
+            fields[match[1]] = value;
+    }
+    return {
+        name: fields.name,
+        description: fields.description,
+        disableModelInvocation: fields["disable-model-invocation"] === "true",
+        body: lines
+            .slice(close + 1)
+            .join("\n")
+            .replace(/^\r?\n/, ""),
+    };
+}
+/**
+ * Parse one read SKILL.md into a skill, applying the shared skip/hide
+ * rules with a log. `displayDir` is the path named in the logs and the
+ * section entry; `fileLabel` names the file in skip logs.
+ */
+function skillFromFile(text, displayDir, fileLabel) {
+    const parsed = parseSkillFile(text);
+    if (parsed === undefined) {
+        console.warn(`skills: skipping ${fileLabel} (the frontmatter block is required)`);
+        return undefined;
+    }
+    if (parsed.name === undefined) {
+        console.warn(`skills: skipping ${fileLabel} (the "name" field is required)`);
+        return undefined;
+    }
+    if (parsed.description === undefined) {
+        console.warn(`skills: skipping ${fileLabel} (the "description" field is required)`);
+        return undefined;
+    }
+    return {
+        name: parsed.name,
+        description: parsed.description,
+        body: parsed.body,
+        dir: displayDir,
+        disableModelInvocation: parsed.disableModelInvocation,
+    };
+}
+/** Directory-name comparison (plain code-point order, locale-independent). */
+function byDirectoryName(a, b) {
+    return a.name < b.name ? -1 : a.name > b.name ? 1 : 0;
+}
+/** Skill-name comparison (plain code-point order, locale-independent). */
+function bySkillName(a, b) {
+    return a.name < b.name ? -1 : a.name > b.name ? 1 : 0;
+}
+/** Read and parse one skill directory's SKILL.md; `undefined` = not a skill. */
+async function readSkill(env, dir, context) {
+    const relative = `${SKILLS_DIRECTORY}/${dir.name}/${SKILL_FILE}`;
+    const joined = await env.joinPath([SKILLS_DIRECTORY, dir.name, SKILL_FILE], context);
+    if (!joined.ok) {
+        throw new Error(`Failed to build path for ${relative}: ${joined.error.message}`, {
+            cause: joined.error,
+        });
+    }
+    const read = await env.readTextFile(joined.value, context);
+    if (!read.ok) {
+        if (read.error.code === "not_found") {
+            // A directory without SKILL.md is simply not a skill (v1 ignores
+            // every other file in a skill directory).
+            return undefined;
+        }
+        throw new Error(`Failed to read ${relative}: ${read.error.message}`, {
+            cause: read.error,
+        });
+    }
+    return skillFromFile(read.value, `${SKILLS_DIRECTORY}/${dir.name}`, relative);
+}
+/**
+ * Scan the workspace's skills through the conversation `ExecutionEnv`.
+ * An absent `skills/` directory is the designed empty case; any other read
+ * failure fails loud. Directories are visited in sorted name order so
+ * duplicate frontmatter names resolve deterministically first-wins.
+ * `includeHidden` (the `listSkills` path): a skill with
+ * `disable-model-invocation: true` is KEPT in the list carrying the
+ * flag; the default (`false`, the section and `load_skill` path) hides
+ * it from the model entirely — it never reaches the section or the
+ * tool.
+ */
+export async function scanSkills(env, context, opts) {
+    const listing = await env.listDir(SKILLS_DIRECTORY, context);
+    if (!listing.ok) {
+        if (listing.error.code === "not_found")
+            return [];
+        throw new Error(`Failed to list the ${SKILLS_DIRECTORY}/ directory: ${listing.error.message}`, { cause: listing.error });
+    }
+    const directories = listing.value
+        .filter((entry) => entry.kind === "directory")
+        .sort(byDirectoryName);
+    const byName = new Map();
+    for (const entry of directories) {
+        const skill = await readSkill(env, entry, context);
+        if (skill === undefined)
+            continue;
+        if (skill.disableModelInvocation && opts?.includeHidden !== true) {
+            console.warn(`skills: hiding ${skill.dir} (disable-model-invocation)`);
+            continue;
+        }
+        if (!byName.has(skill.name)) {
+            byName.set(skill.name, skill);
+        }
+        else {
+            const winner = byName.get(skill.name);
+            console.warn(`skills: duplicate name "${skill.name}" (${skill.dir} ignored; ${winner.dir} wins)`);
+        }
+    }
+    return [...byName.values()].sort(bySkillName);
+}
+/**
+ * Scan ONE filesystem root (the user dir or a package's skills dir).
+ * Same rules as the workspace root — `SKILL.md` only, sorted directory
+ * order, first-wins within the root — read synchronously through
+ * `node:fs` (the root is host-local by definition). An absent root is
+ * the designed empty case. `includeHidden` keeps
+ * `disable-model-invocation: true` skills (the `listSkills` path); the
+ * default hides them with a log, exactly like the workspace root.
+ */
+function scanFsRoot(root, opts) {
+    let entries;
+    try {
+        entries = readdirSync(root, { withFileTypes: true });
+    }
+    catch (cause) {
+        if (cause?.code === "ENOENT")
+            return [];
+        throw new Error(`Failed to list the skills root ${root}: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+    }
+    const byName = new Map();
+    const directories = [...entries]
+        .filter((entry) => entry.isDirectory())
+        .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    for (const entry of directories) {
+        const file = join(root, entry.name, SKILL_FILE);
+        let text;
+        try {
+            text = readFileSync(file, "utf8");
+        }
+        catch (cause) {
+            if (cause?.code === "ENOENT") {
+                // A directory without SKILL.md is simply not a skill.
+                continue;
+            }
+            throw new Error(`Failed to read ${file}: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+        }
+        const skill = skillFromFile(text, join(root, entry.name), file);
+        if (skill === undefined)
+            continue;
+        if (skill.disableModelInvocation && opts?.includeHidden !== true) {
+            console.warn(`skills: hiding ${skill.dir} (disable-model-invocation)`);
+            continue;
+        }
+        if (!byName.has(skill.name)) {
+            byName.set(skill.name, skill);
+        }
+        else {
+            const winner = byName.get(skill.name);
+            console.warn(`skills: duplicate name "${skill.name}" (${skill.dir} ignored; ${winner.dir} wins)`);
+        }
+    }
+    return [...byName.values()].sort(bySkillName);
+}
+/**
+ * The §9.4 root label for a collision log: "workspace", "user dir", or
+ * the contributing package's extension name (packages are attributed).
+ */
+function rootLabelOf(root, extension) {
+    if (root === "package" && extension !== undefined)
+        return extension;
+    return root;
+}
+/**
+ * Merge the three roots in precedence order (workspace > user > packages,
+ * packages in install order): first-wins on the skill NAME, every loss
+ * logged as `skills: "<name>" from <lower root> shadowed by <higher root>`.
+ * `includeHidden` threads to each root scan (the `listSkills` path).
+ */
+export async function discoverSkills(env, context, opts, options) {
+    const byName = new Map();
+    const merge = (skills, root, extension) => {
+        for (const skill of skills) {
+            const existing = byName.get(skill.name);
+            if (existing === undefined) {
+                byName.set(skill.name, { skill, root, extension });
+                continue;
+            }
+            const higher = ROOT_PRECEDENCE.indexOf(root);
+            const lower = ROOT_PRECEDENCE.indexOf(existing.root);
+            if (higher < lower) {
+                // The new root outranks the recorded one — it wins, and the
+                // loser is logged.
+                byName.set(skill.name, { skill, root, extension });
+                console.warn(`skills: "${skill.name}" from ${rootLabelOf(existing.root, existing.extension)} shadowed by ${rootLabelOf(root, extension)}`);
+            }
+            else {
+                console.warn(`skills: "${skill.name}" from ${rootLabelOf(root, extension)} shadowed by ${rootLabelOf(existing.root, existing.extension)}`);
+            }
+        }
+    };
+    if (env !== undefined) {
+        merge(await scanSkills(env, context, options), "workspace");
+    }
+    merge(scanFsRoot(opts.userDir, options), "user dir");
+    for (const root of opts.packageRoots()) {
+        merge(scanFsRoot(root.dir, options), "package", root.extension);
+    }
+    return [...byName.values()].map((entry) => entry.skill).sort(bySkillName);
+}
+/**
+ * The `/skill:name`-facing skill list (Task 2c): the same three-root
+ * discovery as `discoverSkills`, but `disable-model-invocation: true`
+ * skills are INCLUDED (carrying the flag) — `/skill:name` works for
+ * them while the section and `load_skill` keep them hidden. Read LIVE
+ * per call (the same posture as the section's per-render scan).
+ */
+export async function listSkills(env, context, opts) {
+    return discoverSkills(env, context, opts, { includeHidden: true });
+}
+/**
+ * Assemble the section text: the header plus one `- name: description
+ * (path)` line per skill, capped at `limitBytes` bytes including the
+ * truncation notice. The path lets the model read the SKILL.md directly
+ * (and resolve bundled references) via the read tool, complementing
+ * `load_skill`. Whole lines drop from the end until the text fits; the
+ * notice names how many skills were cut. When even the header cannot
+ * fit, the NOTICE alone renders — the model learns skills exist and are
+ * reachable through `load_skill`, which is the section's whole point at
+ * that size. Zero skills render no section at all.
+ */
+export function renderSkillList(skills, limitBytes) {
+    // `disable-model-invocation: true` never reaches the section — the
+    // filter is the section's own (a hidden skill passed in through the
+    // `/skill:name` list is still invisible here).
+    const visible = skills.filter((skill) => !skill.disableModelInvocation);
+    if (visible.length === 0)
+        return undefined;
+    const header = `${SKILLS_SECTION_HEADER}\n\n`;
+    const lines = visible.map((skill) => `- ${skill.name}: ${skill.description} (${skill.dir})`);
+    const full = header + lines.join("\n");
+    if (byteLength(full) <= limitBytes)
+        return full;
+    let kept = lines.length - 1;
+    while (kept >= 0) {
+        const dropped = lines.length - kept;
+        const notice = `\n(skill list truncated: ${dropped} more not shown)`;
+        const body = lines.slice(0, kept).join("\n");
+        const text = header + body + notice;
+        if (byteLength(text) <= limitBytes)
+            return text;
+        kept -= 1;
+    }
+    // Not even the header fits: the notice alone (the smallest honest
+    // rendering — it says skills exist and how many were cut).
+    return `(skill list truncated: ${lines.length} more not shown — call load_skill by name)`;
+}
+/** Section render: discover all three roots, list the winning skills. */
+async function renderSkills(input, context, opts) {
+    const skills = await discoverSkills(input.env, context, opts);
+    return renderSkillList(skills, opts.sectionMaxBytes());
+}
+/** An explicit tool error: text content the model can read and recover from. */
+function skillError(message) {
+    return { output: [{ type: "text", text: message }], isError: true };
+}
+/** Build the `load_skill` tool against the same three-root discovery. */
+function buildLoadSkillTool(opts) {
+    return defineTool({
+        name: "load_skill",
+        description: "Load one skill's full instructions by name, as listed in the skills section.",
+        parameters: Type.Object({
+            name: Type.String({
+                description: "The skill name exactly as listed in the skills section.",
+            }),
+        }),
+        async execute(args, api, context) {
+            const skills = await discoverSkills(api.env, context, opts);
+            const skill = skills.find((candidate) => candidate.name === args.name);
+            if (skill === undefined) {
+                if (skills.length === 0) {
+                    return skillError(`load_skill: unknown skill "${args.name}"; no skills are installed.`);
+                }
+                const available = skills.map((candidate) => candidate.name).join(", ");
+                return skillError(`load_skill: unknown skill "${args.name}"; available skills: ${available}`);
+            }
+            api.output(skill.body);
+            return {};
+        },
+    });
+}
+/**
+ * Build the skills extension (core-owned): one prompt section plus one
+ * tool over the three-root discovery. `openHarness` installs the result
+ * unconditionally before `Harness.open`, under the unchanged core name
+ * `sigrun.skills`.
+ */
+export function createSkillsExtension(opts) {
+    return defineExtension({
+        name: "sigrun.skills",
+        sections: [
+            section(SKILLS_SECTION_KEY, (input, context) => renderSkills(input, context, opts)),
+        ],
+        tools: [buildLoadSkillTool(opts)],
+    });
+}

package/node_modules/@sigrun/shared/CHANGELOG.md

@@ -0,0 +1,16 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0] - 2026-10-21
+### Added
+- First published release of the shared leaf (workspace package of
+  [@sigrun/sigrun](https://github.com/sigrun-ai/sigrun)): theme tokens,
+  conversation/turn shaping, the channel wire types, session-meta,
+  commands, interactions, ambient records, access, settings, views,
+  view-delta, and jobs — the surfaces the webui, TUI, and server share.

package/node_modules/@sigrun/shared/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Michael MacLeod
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/@sigrun/shared/README.md

@@ -0,0 +1,10 @@
+# @sigrun/shared
+
+The pure client-shared leaf of [sigrun](https://github.com/sigrun-ai/sigrun):
+theme tokens, turn/conversation shaping, and the channel wire types —
+consumed by the webui, the TUI, and the server. Zero runtime dependencies;
+every subpath is a types+code pair (`@sigrun/shared/themes`, `/conversations`,
+`/turns`, …) exported from `dist`.
+
+Part of the sigrun workspace; published from the repository root as
+`@sigrun/shared` (see the root `CHANGELOG.md` for release history).

package/node_modules/@sigrun/shared/dist/access.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Per-resource sharing and content access (core hardening W1 Task 5, spec
+ * §5.9 ruling 6/10: per-resource sharing; groups cut).
+ *
+ * Part of the shared leaf package (`@sigrun/shared`): the server computes
+ * access through `accessOf`, the clients render the `sharing` state — one
+ * source of truth, no drift. PURE module: no imports at all (the
+ * views-purity guard enforces this across `shared/src`).
+ *
+ * The rules, in order (first match wins):
+ *
+ * 1. superuser → write;
+ * 2. ownerless resource → household write (everyone);
+ * 3. user === owner → write;
+ * 4. household sharing with a defined user → the shared level;
+ * 5. people sharing including the user → the shared level;
+ * 6. otherwise none (hidden: 404 on every :id route, absent from lists).
+ *
+ * Anonymous callers (a principal with no user) get nothing from a shared
+ * resource: sharing widens access for identified users only (rule 4/5
+ * require a defined user), while ownerless stays open to everyone by
+ * rule 2.
+ */
+/** What a conversation's owner grants beyond themselves. */
+export type Sharing = {
+    readonly scope: "private";
+} | {
+    readonly scope: "household";
+    readonly level: "read" | "write";
+} | {
+    readonly scope: "people";
+    readonly users: string[];
+    readonly level: "read" | "write";
+};
+/** The resolved access level of a principal to one resource. */
+export type Access = "none" | "read" | "write";
+/** What accessOf needs of the caller (the server's Principal projects here). */
+export interface AccessPrincipal {
+    readonly user?: string;
+    readonly superuser?: boolean;
+}
+/**
+ * Resolve one principal's access to one resource. Rule order per the
+ * module doc; the first matching rule wins.
+ */
+export declare function accessOf(p: AccessPrincipal, r: {
+    readonly owner?: string;
+    readonly sharing?: Sharing;
+}): Access;
+/**
+ * Type guard for the wire value: every scope shape checked strictly
+ * (wrong field types are not a Sharing). An empty `people.users` list is
+ * valid (shares with nobody yet) — validation is about shape, not policy.
+ */
+export declare function isSharing(value: unknown): value is Sharing;

package/node_modules/@sigrun/shared/dist/access.js

@@ -0,0 +1,72 @@
+/**
+ * Per-resource sharing and content access (core hardening W1 Task 5, spec
+ * §5.9 ruling 6/10: per-resource sharing; groups cut).
+ *
+ * Part of the shared leaf package (`@sigrun/shared`): the server computes
+ * access through `accessOf`, the clients render the `sharing` state — one
+ * source of truth, no drift. PURE module: no imports at all (the
+ * views-purity guard enforces this across `shared/src`).
+ *
+ * The rules, in order (first match wins):
+ *
+ * 1. superuser → write;
+ * 2. ownerless resource → household write (everyone);
+ * 3. user === owner → write;
+ * 4. household sharing with a defined user → the shared level;
+ * 5. people sharing including the user → the shared level;
+ * 6. otherwise none (hidden: 404 on every :id route, absent from lists).
+ *
+ * Anonymous callers (a principal with no user) get nothing from a shared
+ * resource: sharing widens access for identified users only (rule 4/5
+ * require a defined user), while ownerless stays open to everyone by
+ * rule 2.
+ */
+/**
+ * Resolve one principal's access to one resource. Rule order per the
+ * module doc; the first matching rule wins.
+ */
+export function accessOf(p, r) {
+    // 1. The superuser always writes.
+    if (p.superuser === true)
+        return "write";
+    // 2. Ownerless is household-write for everyone.
+    if (r.owner === undefined)
+        return "write";
+    // 3. The owner always writes.
+    if (p.user !== undefined && p.user === r.owner)
+        return "write";
+    // 4./5. Sharing widens identified users only — an anonymous caller
+    // (no user) falls straight through to none.
+    if (p.user !== undefined && r.sharing !== undefined) {
+        if (r.sharing.scope === "household")
+            return r.sharing.level;
+        if (r.sharing.scope === "people" && r.sharing.users.includes(p.user)) {
+            return r.sharing.level;
+        }
+    }
+    // 6. Hidden.
+    return "none";
+}
+/**
+ * Type guard for the wire value: every scope shape checked strictly
+ * (wrong field types are not a Sharing). An empty `people.users` list is
+ * valid (shares with nobody yet) — validation is about shape, not policy.
+ */
+export function isSharing(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return false;
+    }
+    const record = value;
+    switch (record.scope) {
+        case "private":
+            return true;
+        case "household":
+            return record.level === "read" || record.level === "write";
+        case "people":
+            return (Array.isArray(record.users) &&
+                record.users.every((user) => typeof user === "string") &&
+                (record.level === "read" || record.level === "write"));
+        default:
+            return false;
+    }
+}