@uicast/core 0.0.1-beta.2 → 0.0.2

package/dist/types.d.ts

@@ -1,89 +1,124 @@
-import type { StandardJSONSchemaV1, StandardSchemaV1 } from "@standard-schema/spec";
-export type Expression = string;
-export type ScopePath = string;
+import type { StandardJSONSchemaV1, StandardSchemaV1 } from "@uicast/expr";
+type Expression = string;
+type ScopePath = string;
+/**
+ * One value: `literal` is used as is, `expr` is an expression evaluated against the scopes.
+ *
+ * @example
+ * const props: ValueSource = { expr: "({ text: scopes.root.title })" };
+ * const fixed: ValueSource = { literal: { variant: "outline" } };
+ */
 export type ValueSource = {
     expr: Expression;
 } | {
     literal: unknown;
 };
+/**
+ * A `seed` step: a value source and the field it writes.
+ *
+ * @example
+ * const step: ValueSourceAssignment = { set: "scopes.root.users", expr: "getUsers()" };
+ */
 export type ValueSourceAssignment = {
+    /** The field to write: `scopes.<scope>.<field>`, never deeper. */
     set: ScopePath;
 } & ValueSource;
-export type ConfirmableValueSourceAssignment = {
+/**
+ * A callback step: a value source, optionally written to a field, confirmed first or debounced.
+ *
+ * @example
+ * const toggle: CallbackValueSourceAssignment = { set: "scopes.root.open", expr: "!currentValue" };
+ * const remove: CallbackValueSourceAssignment = { confirm: "Delete it?", expr: "deleteRow({ id: scopes.row.id })" };
+ */
+export type CallbackValueSourceAssignment = {
+    /** The field to write: `scopes.<scope>.<field>`. Absent: the step runs for its effect only. */
+    set?: ScopePath;
+    /** A question asked before this step, e.g. `"Delete this row?"`. Declined, this step and the rest are skipped. */
     confirm?: string;
-} & ValueSourceAssignment;
+    /** This step and the rest wait for 300 ms of quiet; only the latest call runs. */
+    debounce?: boolean;
+} & ValueSource;
 /**
- * The uicast entry model. One line of a uicast document is a
- * `ComponentEntry`. A `ComponentListEntry` is an entry that repeats: it carries
- * `each` (the array to iterate) plus `as` and an optional `keyBy`.
+ * One line of a document: the JSON for one element. List fields are optional, so a `ComponentEntry[]` holds lists
+ * too; `each` marks a list.
  *
- * There is no separate "plain entry" type and no
- * `ComponentEntry | ComponentListEntry` union: the list fields (`each`, `as`,
- * `keyBy`) live on `ComponentEntry` as optional, so one type describes every
- * line and a heterogeneous `ComponentEntry[]` can hold list lines directly.
- * `ComponentListEntry` is the same shape with `each`/`as` required — narrow
- * `ComponentEntry` → `ComponentListEntry` with `isComponentListEntry` (presence
- * of `each`).
+ * @example
+ * const entry: ComponentEntry = {
+ *   key: "open-count", component: "Typography",
+ *   props: { expr: "({ text: 'Open: ' + scopes.root.open })" },
+ * };
  */
 export interface ComponentEntry {
+    /** Unique id. Parents name children by it; re-emitting it replaces the element and its subtree. */
     key: string;
+    /** The component name, matched exactly against the catalog. */
     component: string;
+    /** The props object, e.g. `{ expr: "({ text: scopes.root.title })" }`. Reactive. */
     props?: ValueSource;
+    /** Steps that set up state once, at mount. Each writes its field only while it is still undefined. */
     seed?: ValueSourceAssignment[];
+    /** An expression; truthy hides the element. Reactive. */
     hidden?: Expression;
-    callbacks?: Record<string, ConfirmableValueSourceAssignment[]>;
+    /** An expression; truthy renders the element as busy. Reactive, like `hidden`. */
+    busy?: Expression;
+    /** Steps per event, e.g. `{ onClick: [{ set: "scopes.root.open", expr: "!currentValue" }] }`. */
+    callbacks?: Record<string, CallbackValueSourceAssignment[]>;
+    /** Child keys, in render order. */
     children?: string[];
+    /** An expression returning the array to repeat over; it makes the entry a list. */
     each?: Expression;
+    /** Names each item's two scopes: `scopes.<as>` is the item, `scopes.$<as>` its row. */
     as?: string;
-    keyBy?: (string & {}) | "_index" | "_item";
+    /** The item field that gives the row its `id`. Absent, or missing on an item: the index. */
+    keyBy?: string;
 }
 /**
- * A list entry repeats — the same shape as `ComponentEntry` with the iteration
- * fields required. `each` is the structural marker (its presence is what makes
- * an entry a list); `as` names the per-item scope.
+ * An entry that repeats once per item of `each`.
+ *
+ * @example
+ * const rows: ComponentListEntry = { key: "task-row", component: "TableRow", each: "scopes.root.tasks", as: "task" };
  */
 export interface ComponentListEntry extends ComponentEntry {
+    /** An expression returning the array to repeat over. */
     each: Expression;
+    /** Names each item's two scopes: `scopes.<as>` is the item, `scopes.$<as>` its row. */
     as: string;
 }
-/**
- * Narrow a `ComponentEntry` to a `ComponentListEntry`. List-ness is the
- * presence of `each` — there is no `kind` discriminator, exactly like root-ness
- * (derived from an entry being referenced by no other entry's `children`).
- */
 export declare function isComponentListEntry(entry: ComponentEntry): entry is ComponentListEntry;
 /**
- * Narrow an untrusted parsed value to a `ComponentEntry` — the shape guard for
- * model-emitted lines (`streamJsonLines` output, fence bodies, stored JSONL).
+ * Whether parsed JSON is an entry: string `key` and `component`, and `children`, if present, an array. The renderer
+ * checks the other fields at mount.
+ *
+ * @example
+ * const entries = parsedLines.filter(isComponentEntry);
  */
 export declare function isComponentEntry(value: unknown): value is ComponentEntry;
 /**
- * An interface that combines StandardJSONSchema and StandardSchema.
- * */
+ * A schema that validates at run time (Standard Schema) and converts to JSON Schema for the prompt (Standard JSON
+ * Schema). Zod 4.2+, Valibot and ArkType schemas fit.
+ *
+ * @example
+ * const props: CombinedSpec = z.strictObject({ text: z.string() });
+ */
 export type CombinedSpec<Input = unknown, Output = Input> = StandardSchemaV1<Input, Output> & StandardJSONSchemaV1<Input, Output>;
 /**
- * The partner module the LLM reads for a component: a props spec plus optional
- * callback specs (its `description` + `props` schema are serialized into the
- * prompt). Parameterized over the concrete `props` / `callbacks` specs so an
- * implementation can recover their exact types — `createComponentImplementation`
- * infers `TProps` / `TCallbacks` straight off the `def` it's handed to type its
- * `render` callback. Both params default to the widened base, so a bare
- * `ComponentDefinition` is the heterogeneous form used in collections
- * (`ComponentDefinition[]`, the `allDefinitions` registry, the prompt
- * serializer). The `createComponentDefinition` factory (in
- * `def/create-component-definition.ts`) is the value-side constructor for this.
+ * What the model reads about a component: its name, description, props and events. Make one with
+ * `createComponentDefinition`.
+ *
+ * @example
+ * const definitions: ComponentDefinition[] = [...defs, BadgeDef];
+ * getComponentsPartialPrompt({ definitions });
  */
 export type ComponentDefinition<TProps extends CombinedSpec = CombinedSpec, TCallbacks extends Record<string, CombinedSpec> = Record<string, CombinedSpec>> = {
+    /** What an entry's `component` names, e.g. `"Badge"`. Must be unique: the prompt builder and `<RendererProvider>` throw on a repeat. */
     name: string;
+    /** When to use the component, printed word for word in the prompt. */
     description: string;
+    /** The props schema: the prompt prints it, and the renderer parses props through it before `render`. */
     props: TProps;
+    /** Event name → payload schema, e.g. `{ onChange: z.object({ value: z.string() }), onClear: z.null() }`. */
     callbacks?: TCallbacks;
-    /**
-     * Host-only component. Registered in the renderer registry so entries
-     * referencing it mount correctly, but filtered out of the LLM-facing
-     * prompt list in `getComponentsPartialPrompt`. Use for internal infrastructure
-     * (e.g. RootFragment — the synthetic wrapper used by `Renderer`'s `init`
-     * prop machinery) that the LLM should never emit.
-     */
+    /** Kept out of the prompt; an entry that names it still renders. */
     hidden?: boolean;
 };
+export {};

package/dist/types.js

@@ -1,14 +1,12 @@
-/**
- * Narrow a `ComponentEntry` to a `ComponentListEntry`. List-ness is the
- * presence of `each` — there is no `kind` discriminator, exactly like root-ness
- * (derived from an entry being referenced by no other entry's `children`).
- */
 export function isComponentListEntry(entry) {
     return entry.each !== undefined;
 }
 /**
- * Narrow an untrusted parsed value to a `ComponentEntry` — the shape guard for
- * model-emitted lines (`streamJsonLines` output, fence bodies, stored JSONL).
+ * Whether parsed JSON is an entry: string `key` and `component`, and `children`, if present, an array. The renderer
+ * checks the other fields at mount.
+ *
+ * @example
+ * const entries = parsedLines.filter(isComponentEntry);
  */
 export function isComponentEntry(value) {
     if (!value || typeof value !== "object")
@@ -16,7 +14,6 @@ export function isComponentEntry(value) {
     const entry = value;
     return (typeof entry.key === "string" &&
         typeof entry.component === "string" &&
-        // The least-trusted input path: `children` as a string (a plausible LLM
-        // slip) would be iterated char-by-char downstream into phantom child slots.
+        // A string `children` (a plausible LLM slip) would be iterated char by char downstream.
         (entry.children === undefined || Array.isArray(entry.children)));
 }

package/dist/url-policy.d.ts

@@ -0,0 +1,45 @@
+import { type JSONSchema } from "./json-schema.js";
+/**
+ * Which URLs a prop declared as a URL (`z.url()`) may hold. An object changes the default rules field by field; a
+ * predicate replaces them.
+ *
+ * @example
+ * const urlPolicy: UrlPolicy = { hosts: ["cdn.example.com", "*.imgix.net"] };
+ *
+ * @example
+ * const urlPolicy: UrlPolicy = (url) => url.startsWith("https://cdn.example.com/");
+ */
+export type UrlPolicy = {
+    /** Relative URLs: `/a`, `a/b`, `?q=1`, `#x`. Default `true`. */
+    allowRelative?: boolean;
+    /** Absolute URLs on the page origin. Default `true`. */
+    allowSameOrigin?: boolean;
+    /** Extra http/https hosts: an exact match, or `*.example.com` for subdomains (not the apex, so list both). */
+    hosts?: readonly string[];
+    /** `data:` raster images. Default `true`. SVG is never allowed: it can carry script. */
+    allowDataImages?: boolean;
+    /** The page origin, for where there is no `location` (SSR); without either, only `hosts` matches an absolute URL. */
+    origin?: string;
+} | ((url: string) => boolean);
+type UrlCheck = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+export declare const resolveUrlPolicy: (policy?: Exclude<UrlPolicy, (url: string) => boolean>) => {
+    allowRelative: boolean;
+    allowSameOrigin: boolean;
+    hosts: readonly string[];
+    allowDataImages: boolean;
+    origin: string | undefined;
+};
+export declare const checkUrl: (value: string, policy?: UrlPolicy) => UrlCheck;
+type UrlViolation = {
+    path: string;
+    url: string;
+    reason: string;
+};
+export declare const findUrlViolations: (schema: JSONSchema | undefined, value: unknown, policy?: UrlPolicy) => UrlViolation[];
+export declare const schemaHasUrlFormat: (schema: JSONSchema | undefined) => boolean;
+export {};

package/dist/url-policy.js

@@ -0,0 +1,252 @@
+import { isSchemaObject, resolvePointer } from "./json-schema.js";
+// The defaults, in one place: the check applies them and the prompt describes them.
+export const resolveUrlPolicy = (policy = {}) => {
+    const { allowRelative = true, allowSameOrigin = true, hosts = [], allowDataImages = true, origin } = policy;
+    return { allowRelative, allowSameOrigin, hosts, allowDataImages, origin };
+};
+const OK = { ok: true };
+// Never fetch on their own.
+const INERT_SCHEMES = new Set(["mailto", "tel", "sms", "blob"]);
+// No `svg+xml`: SVG can carry script.
+const DATA_IMAGE_RE = /^data:image\/(png|jpe?g|gif|webp|avif|bmp|x-icon|vnd\.microsoft\.icon)[;,]/i;
+const SCHEME_RE = /^([a-z][a-z0-9+.-]*):/i;
+// For http(s) the URL parser reads `\` as `/`, so a value with no scheme names a host exactly when it starts with two.
+const NAMES_HOST_RE = /^[\\/]{2}/;
+// Supplies only the scheme: a value that names a host keeps its own.
+const NETWORK_PATH_BASE = "https://base.invalid/";
+// Strip what the URL parser strips, or `"java\nscript:"` reads as relative here and `javascript:` in the DOM.
+const normalize = (raw) => {
+    const url = raw.replace(/[\t\n\r]/g, "");
+    // A loop, not a regex: a trailing `[\0- ]+$` takes quadratic time on a long run of spaces.
+    let start = 0;
+    let end = url.length;
+    while (start < end && url.charCodeAt(start) <= 0x20)
+        start++;
+    while (end > start && url.charCodeAt(end - 1) <= 0x20)
+        end--;
+    return url.slice(start, end);
+};
+const parseUrl = (url, base) => {
+    try {
+        return new URL(url, base);
+    }
+    catch {
+        return null;
+    }
+};
+const hostAllowed = (host, hosts) => {
+    const lower = host.toLowerCase();
+    return hosts.some((entry) => {
+        const pattern = entry.toLowerCase();
+        if (pattern.startsWith("*.")) {
+            return lower.endsWith(pattern.slice(1)) && lower !== pattern.slice(2);
+        }
+        return lower === pattern;
+    });
+};
+// Parsed once per string: an explicit origin with a path or a trailing slash still names its origin.
+const explicitOrigins = new Map();
+const currentOrigin = (explicit) => {
+    if (!explicit)
+        return typeof location !== "undefined" ? location.origin : null;
+    let origin = explicitOrigins.get(explicit);
+    if (origin === undefined) {
+        origin = parseUrl(explicit)?.origin ?? null;
+        explicitOrigins.set(explicit, origin);
+    }
+    return origin;
+};
+const checkHost = (url, allowSameOrigin, explicitOrigin, hosts) => {
+    if (allowSameOrigin && url.origin === currentOrigin(explicitOrigin))
+        return OK;
+    if (hosts.length && hostAllowed(url.hostname, hosts))
+        return OK;
+    return {
+        ok: false,
+        reason: `"${url.hostname}" is not an allowed host. Add it to the renderer's ` +
+            `urlPolicy ({ hosts: ["${url.hostname}"] }) if this destination is trusted`,
+    };
+};
+// An empty string passes: nothing to fetch.
+export const checkUrl = (value, policy) => {
+    const url = normalize(value);
+    if (!url)
+        return OK;
+    if (typeof policy === "function") {
+        return policy(url) ? OK : { ok: false, reason: "rejected by the host's urlPolicy predicate" };
+    }
+    const { allowRelative, allowSameOrigin, hosts, allowDataImages, origin: explicitOrigin } = resolveUrlPolicy(policy);
+    const scheme = SCHEME_RE.exec(url)?.[1]?.toLowerCase() ?? null;
+    if (scheme === null) {
+        if (NAMES_HOST_RE.test(url)) {
+            const resolved = parseUrl(url, NETWORK_PATH_BASE);
+            if (!resolved)
+                return { ok: false, reason: "not a parseable URL" };
+            return checkHost(resolved, allowSameOrigin, explicitOrigin, hosts);
+        }
+        return allowRelative ? OK : { ok: false, reason: "relative URLs are not allowed by this urlPolicy" };
+    }
+    if (scheme === "data") {
+        if (allowDataImages && DATA_IMAGE_RE.test(url))
+            return OK;
+        return {
+            ok: false,
+            reason: DATA_IMAGE_RE.test(url)
+                ? "data: URLs are not allowed by this urlPolicy"
+                : 'only "data:image/<raster>" URLs are allowed (svg+xml can carry script)',
+        };
+    }
+    if (INERT_SCHEMES.has(scheme))
+        return OK;
+    if (scheme !== "http" && scheme !== "https") {
+        return { ok: false, reason: `the "${scheme}:" scheme is not allowed` };
+    }
+    const parsed = parseUrl(url);
+    if (!parsed)
+        return { ok: false, reason: "not a parseable absolute URL" };
+    return checkHost(parsed, allowSameOrigin, explicitOrigin, hosts);
+};
+const URL_FORMATS = new Set(["uri", "url", "uri-reference", "iri", "iri-reference"]);
+const hasUrlFormat = (node) => {
+    const format = Object.hasOwn(node, "format") ? Reflect.get(node, "format") : undefined;
+    return typeof format === "string" && URL_FORMATS.has(format);
+};
+const indexes = new WeakMap();
+const indexOf = (root) => {
+    let index = indexes.get(root);
+    if (!index) {
+        index = { root, reach: new Map(), applicable: new Map() };
+        indexes.set(root, index);
+    }
+    return index;
+};
+// Whether a URL format sits at or below `start`, through any keyword and any `$ref` chain. A stack, so depth sets no limit.
+const reachesUrlFormat = (index, start) => {
+    if (typeof start !== "object" || start === null)
+        return false;
+    const cached = index.reach.get(start);
+    if (cached !== undefined)
+        return cached;
+    const seen = new Set();
+    const stack = [start];
+    let found = false;
+    while (!found && stack.length > 0) {
+        const node = stack.pop();
+        if (typeof node !== "object" || node === null || seen.has(node))
+            continue;
+        seen.add(node);
+        found = hasUrlFormat(node);
+        for (const [key, child] of Object.entries(node)) {
+            stack.push(key === "$ref" && typeof child === "string" ? resolvePointer(child, index.root) : child);
+        }
+    }
+    index.reach.set(start, found);
+    return found;
+};
+// The nodes that hold for one value: `start` and every applicator under it that keeps the value.
+// All but `not` (a URL format under it forbids a URL); one that holds for only some values counts for all.
+const applicableNodes = (index, start) => {
+    const cached = index.applicable.get(start);
+    if (cached)
+        return cached;
+    const out = new Set();
+    const stack = [start];
+    while (stack.length > 0) {
+        const node = stack.pop();
+        if (!isSchemaObject(node) || out.has(node) || !reachesUrlFormat(index, node))
+            continue;
+        out.add(node);
+        if (typeof node.$ref === "string")
+            stack.push(resolvePointer(node.$ref, index.root));
+        stack.push(...(node.allOf ?? []), ...(node.anyOf ?? []), ...(node.oneOf ?? []));
+        stack.push(node.if, node.then, node.else, ...Object.values(node.dependentSchemas ?? {}));
+    }
+    const nodes = [...out];
+    index.applicable.set(start, nodes);
+    return nodes;
+};
+const pathOf = (visit) => {
+    let path = "";
+    for (let at = visit; at?.parent; at = at.parent) {
+        const step = typeof at.key === "number" ? `[${at.key}]` : `.${at.key}`;
+        path = step + path;
+    }
+    return path.startsWith(".") ? path.slice(1) : path;
+};
+// A subschema with no URL format below it is never walked, so a URL-free table costs nothing.
+const pushVisit = (stack, index, node, value, parent, key) => {
+    if (isSchemaObject(node) && reachesUrlFormat(index, node))
+        stack.push({ node, value, parent, key });
+};
+// Only declared URL props are checked: a URL-looking `text` prop is content.
+export const findUrlViolations = (schema, value, policy) => {
+    if (!schema)
+        return [];
+    const index = indexOf(schema);
+    if (!reachesUrlFormat(index, schema))
+        return [];
+    const out = [];
+    const flagged = new Set();
+    // Per object, the nodes already applied: a shared or cyclic value is walked once per node.
+    const walked = new WeakMap();
+    // Children are pushed last to first, so values are checked, and violations reported, in document order.
+    const stack = [{ node: schema, value, parent: null, key: "" }];
+    for (let visit = stack.pop(); visit; visit = stack.pop()) {
+        const val = visit.value;
+        const nodes = applicableNodes(index, visit.node);
+        if (typeof val === "string") {
+            if (!nodes.some(hasUrlFormat))
+                continue;
+            const result = checkUrl(val, policy);
+            if (result.ok)
+                continue;
+            const path = pathOf(visit);
+            if (!flagged.has(path)) {
+                flagged.add(path);
+                out.push({ path, url: val, reason: result.reason });
+            }
+            continue;
+        }
+        if (typeof val !== "object" || val === null)
+            continue;
+        let done = walked.get(val);
+        if (!done) {
+            done = new Set();
+            walked.set(val, done);
+        }
+        for (let n = nodes.length - 1; n >= 0; n--) {
+            const node = nodes[n];
+            if (done.has(node))
+                continue;
+            done.add(node);
+            if (Array.isArray(val)) {
+                const tuple = node.prefixItems ?? [];
+                for (let i = val.length - 1; i >= 0; i--) {
+                    pushVisit(stack, index, node.unevaluatedItems, val[i], visit, i);
+                    pushVisit(stack, index, node.contains, val[i], visit, i);
+                    pushVisit(stack, index, i < tuple.length ? tuple[i] : node.items, val[i], visit, i);
+                }
+                continue;
+            }
+            const declared = node.properties ?? {};
+            // Patterns are not matched: each one applies to every key.
+            const patterns = Object.values(node.patternProperties ?? {});
+            const entries = Object.entries(val);
+            for (let e = entries.length - 1; e >= 0; e--) {
+                const [key, child] = entries[e];
+                if (Object.hasOwn(declared, key)) {
+                    pushVisit(stack, index, declared[key], child, visit, key);
+                }
+                else {
+                    pushVisit(stack, index, node.unevaluatedProperties, child, visit, key);
+                    pushVisit(stack, index, node.additionalProperties, child, visit, key);
+                }
+                for (const sub of patterns)
+                    pushVisit(stack, index, sub, child, visit, key);
+                pushVisit(stack, index, node.propertyNames, key, visit, key);
+            }
+        }
+    }
+    return out;
+};
+export const schemaHasUrlFormat = (schema) => schema !== undefined && reachesUrlFormat(indexOf(schema), schema);

package/package.json

@@ -1,18 +1,18 @@
 {
   "name": "@uicast/core",
-  "version": "0.0.1-beta.2",
-  "description": "LLM-generated UIs from a stream of JSONLines — the framework-agnostic uicast engine: entry format, sandboxed expressions, reactive scopes, and prompt builders.",
+  "version": "0.0.2",
+  "description": "The framework-agnostic engine of uicast, the expression-driven generative UI framework: entry format, guarded expressions (allow-list, not a sandbox), reactive scopes, and prompt builders.",
   "license": "MIT",
+  "author": "Andrey Gubanov (https://github.com/finom)",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/finom/uicast.git",
     "directory": "packages/core"
   },
-  "homepage": "https://github.com/finom/uicast#readme",
+  "homepage": "https://uicast.dev",
   "keywords": [
     "generative-ui",
     "llm",
-    "jsonlines",
     "streaming",
     "ui",
     "agent",
@@ -24,6 +24,10 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
+    "./internal": {
+      "types": "./dist/internal.d.ts",
+      "default": "./dist/internal.js"
+    },
     "./prompt": {
       "types": "./dist/prompt/index.d.ts",
       "default": "./dist/prompt/index.js"
@@ -35,25 +39,23 @@
     "CHANGELOG.md"
   ],
   "scripts": {
-    "build": "tsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json",
-    "prepublishOnly": "npm run build",
+    "build": "rm -rf dist && tsc -p tsconfig.build.json && tsc-alias -p tsconfig.build.json",
+    "prepublishOnly": "node -e \"if (!process.env.CI) throw new Error('Publish from CI: PACKAGE=<dir> npm run patch or minor tags a release, and the tag publishes it')\" && npm run build",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
-    "typecheck": "tsc --noEmit",
-    "npm-publish": "if [ -z \"$NPM_TAG\" ]; then echo 'Error: NPM_TAG is not set'; exit 1; fi; npm publish --tag=$NPM_TAG"
-  },
-  "dependencies": {
-    "@standard-schema/spec": "^1.1.0",
-    "acorn": "^8.16.0",
-    "standard-tool": "^0.1.0"
+    "typecheck": "tsc --noEmit"
   },
   "devDependencies": {
-    "@vitest/coverage-v8": "^4.1.0",
-    "vitest": "^4.1.0",
-    "zod": "~4.3.6"
+    "@vitest/coverage-v8": "^5.0.2",
+    "standard-tool": "^0.1.0",
+    "vitest": "^5.0.1",
+    "zod": "~4.6.5"
   },
   "publishConfig": {
     "access": "public"
+  },
+  "peerDependencies": {
+    "@uicast/expr": "^0.0.2"
   }
 }

package/dist/def/create-component-definition.d.ts

@@ -1,9 +0,0 @@
-import type { CombinedSpec, ComponentDefinition } from "../types.js";
-/**
- * Value-side constructor for a {@link ComponentDefinition} (the type lives in
- * `types.ts`). Infers the concrete `props` / `callbacks` specs at the call site
- * and returns the def unchanged — its purpose is the inference + a single typed
- * authoring shape; `createComponentImplementation` later reads those inferred
- * types off the returned def.
- */
-export declare const createComponentDefinition: <TProps extends CombinedSpec, TCallbacks extends Record<string, CombinedSpec> = Record<string, never>>({ name, description, props, callbacks, hidden, }: ComponentDefinition<TProps, TCallbacks>) => ComponentDefinition<TProps, TCallbacks>;

package/dist/def/create-component-definition.js

@@ -1,10 +0,0 @@
-/**
- * Value-side constructor for a {@link ComponentDefinition} (the type lives in
- * `types.ts`). Infers the concrete `props` / `callbacks` specs at the call site
- * and returns the def unchanged — its purpose is the inference + a single typed
- * authoring shape; `createComponentImplementation` later reads those inferred
- * types off the returned def.
- */
-export const createComponentDefinition = ({ name, description, props, callbacks, hidden, }) => {
-    return { name, description, props, callbacks, hidden };
-};

package/dist/expr/analyze.d.ts

@@ -1,5 +0,0 @@
-import type * as acorn from "acorn";
-/** Does the expression `await` anything? */
-export declare function containsAwait(node: acorn.AnyNode | null | undefined): boolean;
-export declare function extractScopeReads(ast: acorn.AnyNode): string[];
-export declare function extractFreeIdentifiers(ast: acorn.AnyNode): string[];