basalt-ui 1.11.0 → 1.13.0

package/AGENTS.md

@@ -6,27 +6,27 @@ Toolchain: Bun runtime, oxlint + oxfmt, conventional commits (empty scope), `mas
 
 ## Subpath ownership
 
-| Subpath                     | Layer           | Purpose                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| --------------------------- | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `basalt-ui`                 | mantine-coupled | BasaltProvider, createBasaltTheme, BasaltShell + sidebar/mobile-nav/breadcrumbs, NavCountBadge, ThemeToggle, ThreadWorkspace + thread-chat components, dashboard composites (DeltaBadge, StatCard with threshold tone, EmptyState, SettingsSection/SettingsRow/DangerZone)                                                                                                                                                                                                                                                                                                                                          |
-| `basalt-ui/charts`          | headless        | visx chart primitives, sparklines, hooks, and token re-exports (Mantine-free)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| `basalt-ui/tokens`          | headless        | VX token refs, buildPaletteCss, defineSeries, seriesTokens, groupTokens, alpha (Mantine-free)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
-| `basalt-ui/theme-lab`       | mantine-coupled | ThemeLabControls, applyOverrides, COLOR_GROUPS — a low-level inspector for the non-derived structural tokens; identity/color tuning lives in DeriveControls                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
-| `basalt-ui/vite`            | mantine-coupled | basaltViteConfig(opts) — Vite preset for basalt-ui consumer apps; basaltAppPlugin(opts) — PWA head, manifest, and icon metadata derived from the token palette                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| `basalt-ui/guard`           | headless        | checkSource, GUARD_RULES, Finding types — the headless theme-guard core                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
-| `basalt-ui/query`           | headless        | createBasaltQueryClient, transport-agnostic unwrap, lazy BasaltQueryDevtools                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| `basalt-ui/router-tanstack` | headless        | TanStack Router bridge: useBasaltNav (active route) + useRouterBreadcrumbs + createSearchParamStore (single-select URL-state store) + createMultiSearchParamStore (multi-select URL-state store)                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| `basalt-ui/forms`           | mantine-coupled | Mantine form adapter: useBasaltForm, field, FormErrorSummary, useFormDraft (Standard Schema)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
-| `basalt-ui/notifications`   | mantine-coupled | Mantine notifications: notify helpers, typed registry, persisted history, NotificationBell, NotificationCenter                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| `basalt-ui/commands`        | mantine-coupled | typed command bus + overlay controller, toSpotlightActions, ShortcutsHelp, BasaltOverlays                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| `basalt-ui/data`            | mantine-coupled | Convenience barrel pulling both TanStack Table + Virtual peer groups: BasaltDataTable, BasaltVirtualList (Mantine-rendered) — prefer ./data/table or ./data/virtual for per-feature opt-in                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| `basalt-ui/data/table`      | mantine-coupled | BasaltDataTable: a sortable data table over TanStack Table, rendered with Mantine (Mantine-rendered)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| `basalt-ui/data/virtual`    | mantine-coupled | BasaltVirtualList: a windowed virtual list over TanStack Virtual, rendered with Mantine (Mantine-rendered)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
-| `basalt-ui/agent`           | headless        | Headless streaming-chat layer: useAgentStream, aiSdkTransport (recommended default) + edenTransport, isResumable/ResumableAgentTransport (stream-resumption seam), PartList, coalesceParts, the ForeignPart/definePartRenderers/narrowAgentPart open part-registry seam, plus the multi-thread createThreadsStore + useAgentThreadRuns + outcome-resolver seam (Mantine-free)                                                                                                                                                                                                                                       |
-| `basalt-ui/agent-chat`      | mantine-coupled | Mantine-styled thread-chat components over basalt-ui/agent: ThreadWorkspace, ThreadFeed, ThreadOutcomeCard, ThreadDetailPanel, Composer, ThreadTranscript (open part-renderer registry via its renderers/fallbackRenderer props), threadPartRenderers, ToolChip (Mantine-coupled). remend and motion are required, not optional — ThreadTranscript imports content/markdown.tsx (remend eagerly), and ThreadFeed/ThreadDetailPanel import motion/react eagerly, so this subpath fails to resolve without both installed even though peerDependenciesMeta marks them optional (npm has no per-subpath optionality).  |
-| `basalt-ui/content`         | mantine-coupled | Prose (article/chat typography), CodeBlock (shiki, optional peer), Callout, TableOfContents, ReadingProgress, Markdown (react-markdown + remark-gfm, optional peers, streaming-aware), MermaidDiagram (beautiful-mermaid, optional peer), mdxComponents/createMdxComponents, ArticleLayout (docs-page frame), ArticleCard/ArticleGrid (overview cards), Article model (sortArticles/filterArticles/formatArticleDate), ArticleFilterBar (category/tags filter UI), toArticleActions (Spotlight projector, @mantine/spotlight type-only), GuideLink/GuideDrawer (contextual-help drawer) — the content/prose surface |
-| `basalt-ui/state`           | headless        | createPersistedState (versioned localStorage) + useOnlineStatus — Mantine-free state primitives                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `basalt-ui/connectivity`    | mantine-coupled | ConnectivityProvider (aggregates browser online/offline, React Query onlineManager, SSE, and health-check pings into one status), useConnectivity, and ConnectivityIndicator — auto-mounted by BasaltProvider                                                                                                                                                                                                                                                                                                                                                                                                       |
+| Subpath                     | Layer           | Purpose                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| --------------------------- | --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `basalt-ui`                 | mantine-coupled | BasaltProvider, createBasaltTheme, BasaltShell + sidebar/mobile-nav/breadcrumbs, NavCountBadge, ThemeToggle, ThreadWorkspace + thread-chat components, dashboard composites (DeltaBadge, StatCard with threshold tone, EmptyState, SettingsSection/SettingsRow/DangerZone)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `basalt-ui/charts`          | headless        | visx chart primitives, sparklines, hooks, and token re-exports (Mantine-free)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| `basalt-ui/tokens`          | headless        | VX token refs, buildPaletteCss, defineSeries, seriesTokens, groupTokens, alpha (Mantine-free)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| `basalt-ui/theme-lab`       | mantine-coupled | ThemeLabControls, applyOverrides, COLOR_GROUPS — a low-level inspector for the non-derived structural tokens; identity/color tuning lives in DeriveControls                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| `basalt-ui/vite`            | mantine-coupled | basaltViteConfig(opts) — Vite preset for basalt-ui consumer apps; basaltAppPlugin(opts) — PWA head, manifest, and icon metadata derived from the token palette                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `basalt-ui/guard`           | headless        | checkSource, GUARD_RULES, Finding types — the headless theme-guard core                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| `basalt-ui/query`           | headless        | createBasaltQueryClient, transport-agnostic unwrap, lazy BasaltQueryDevtools                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `basalt-ui/router-tanstack` | headless        | TanStack Router bridge: useBasaltNav (active route) + useRouterBreadcrumbs + createSearchParamStore (single-select URL-state store) + createMultiSearchParamStore (multi-select URL-state store)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| `basalt-ui/forms`           | mantine-coupled | Mantine form adapter: useBasaltForm, field, FormErrorSummary, useFormDraft (Standard Schema)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `basalt-ui/notifications`   | mantine-coupled | Mantine notifications: notify helpers, typed registry, persisted history, NotificationBell, NotificationCenter                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
+| `basalt-ui/commands`        | mantine-coupled | typed command bus + overlay controller, toSpotlightActions, ShortcutsHelp, BasaltOverlays                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
+| `basalt-ui/data`            | mantine-coupled | Convenience barrel pulling both TanStack Table + Virtual peer groups: BasaltDataTable, BasaltVirtualList (Mantine-rendered) — prefer ./data/table or ./data/virtual for per-feature opt-in                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `basalt-ui/data/table`      | mantine-coupled | BasaltDataTable: a sortable data table over TanStack Table, rendered with Mantine (Mantine-rendered)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| `basalt-ui/data/virtual`    | mantine-coupled | BasaltVirtualList: a windowed virtual list over TanStack Virtual, rendered with Mantine (Mantine-rendered)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `basalt-ui/agent`           | headless        | Headless streaming-chat layer: useAgentStream, aiSdkTransport (recommended default) + edenTransport, isResumable/ResumableAgentTransport (stream-resumption seam), PartList, coalesceParts, the ForeignPart/definePartRenderers/narrowAgentPart open part-registry seam, plus the multi-thread createThreadsStore + useAgentThreadRuns + outcome-resolver seam (Mantine-free)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| `basalt-ui/agent-chat`      | mantine-coupled | Mantine-styled thread-chat components over basalt-ui/agent: ThreadWorkspace, ThreadFeed (variant/renderRow), ThreadFeedRow (inline-expanding Slack row, lazily mounted + kept mounted), ThreadOutcomeCard, ThreadDetailPanel, Composer, ThreadTranscript (open part-renderer registry via its renderers/fallbackRenderer props, per-message MessageAffordances, groupConsecutive, and an optional virtualize/height windowing mode whose VirtualizeOptions carry overscan/estimateSize/initialScroll — a virtualized transcript opens scrolled to the newest message unless initialScroll is "start"), threadPartRenderers, ToolChip (Mantine-coupled). motion is required, not optional — ThreadFeed/ThreadDetailPanel import motion/react eagerly, so this subpath fails to resolve without it installed even though peerDependenciesMeta marks it optional (npm has no per-subpath optionality). remend is genuinely optional here — ThreadTranscript reaches it only through the lazy dynamic import() inside content/markdown.tsx, and @tanstack/react-virtual the same way through the lazy import() behind ThreadTranscript virtualize (absent peer degrades to an unwindowed, height-bound pane). |
+| `basalt-ui/content`         | mantine-coupled | Prose (article/chat typography), CodeBlock (shiki, optional peer), Callout, TableOfContents, ReadingProgress, Markdown (react-markdown + remark-gfm, optional peers; `streaming` is a rendering mode ONLY — `contentTrust` is the independent security input, and any surface rendering agent/model output must pin `contentTrust="untrusted"`, the sole input to the image-origin allowlist; a `fenceRenderers` registry — settledOnly/FenceRenderer/FenceRenderers/FenceRenderContext; `sanitizeSchema`, an additions-only SanitizeSchemaExtension merged over BASALT_SANITIZE_SCHEMA via mergeSanitizeSchema; the remend streaming-repair pass is now a lazy optional peer), MermaidDiagram (beautiful-mermaid, optional peer), mdxComponents/createMdxComponents, ArticleLayout (docs-page frame), ArticleCard/ArticleGrid (overview cards), Article model (sortArticles/filterArticles/formatArticleDate), ArticleFilterBar (category/tags filter UI), toArticleActions (Spotlight projector, @mantine/spotlight type-only), GuideLink/GuideDrawer (contextual-help drawer) — the content/prose surface                                                                                              |
+| `basalt-ui/state`           | headless        | createPersistedState (versioned localStorage) + useOnlineStatus — Mantine-free state primitives                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| `basalt-ui/connectivity`    | mantine-coupled | ConnectivityProvider (aggregates browser online/offline, React Query onlineManager, SSE, and health-check pings into one status), useConnectivity, and ConnectivityIndicator — auto-mounted by BasaltProvider                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
 
 ## Hard rules
 

package/CHANGELOG.md

@@ -1,3 +1,35 @@
+# [1.13.0](https://github.com/jkrumm/basalt-ui/compare/v1.12.0...v1.13.0) (2026-08-04)
+
+
+### Bug Fixes
+
+* hold the pack-test consumer inside the peer ranges it declares ([1fb3abe](https://github.com/jkrumm/basalt-ui/commit/1fb3abe09206cdd46a0a6f05cbbb9e3344c899f6))
+* hold the virtual peer floor at the APIs the transcript calls ([324b474](https://github.com/jkrumm/basalt-ui/commit/324b47459b5717210464ffb5eb8b363bb152f87a))
+* mint ids safely off a secure context and never wedge a stopped turn ([2d72074](https://github.com/jkrumm/basalt-ui/commit/2d7207403baa5a1aa5400355ac92417c9f767ffc))
+* stop a hydrating store flashing empty and a cascade burying its cause ([93fe8c2](https://github.com/jkrumm/basalt-ui/commit/93fe8c261f5d027c003f1ce71108cd1bab1163e9))
+* surface a failed thread load instead of an endless skeleton ([ea15873](https://github.com/jkrumm/basalt-ui/commit/ea15873fc797f237dd5d65ad1ffa5a781ff6e86c))
+
+
+### Features
+
+* give the transcript a Slack shape, affordances and virtualization ([33ca057](https://github.com/jkrumm/basalt-ui/commit/33ca057eb9fd78a59b369c1410b6e34ef0a04602))
+* promote the agent guards and raw-scroll-container to error ([9ee8c44](https://github.com/jkrumm/basalt-ui/commit/9ee8c44acc2cc54973372dca5a8712dcf9def644))
+
+# [1.12.0](https://github.com/jkrumm/basalt-ui/compare/v1.11.0...v1.12.0) (2026-08-03)
+
+
+### Bug Fixes
+
+* stop the tool-part fold carrying stale state and dropping parts ([d47a35f](https://github.com/jkrumm/basalt-ui/commit/d47a35f7d58d985037814b8771b0e426c5396403))
+
+
+### Features
+
+* give the composer its slots and a way to write into them ([e115b7e](https://github.com/jkrumm/basalt-ui/commit/e115b7efd428a09701307f9fe7448f72e69606bb))
+* let a server-backed store stand behind the threads API ([dfdf9c5](https://github.com/jkrumm/basalt-ui/commit/dfdf9c543554167ff9d780dda2cb662238eff419))
+* open the markdown seams and split trust from streaming ([90d406e](https://github.com/jkrumm/basalt-ui/commit/90d406e13311a107a6a160d8f66ff42e41085a75))
+* prove the 1.12.0 seams from outside the package ([0231345](https://github.com/jkrumm/basalt-ui/commit/0231345f88f9d8f7191db6c733ac124d5fae85fd))
+
 # [1.11.0](https://github.com/jkrumm/basalt-ui/compare/v1.10.0...v1.11.0) (2026-08-03)
 
 

package/README.md

@@ -219,31 +219,31 @@ deleted rather than silently surviving into the next real skew.
 
 ## Subpath exports
 
-| Subpath             | Mantine? | Purpose                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
-| ------------------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `.`                 | coupled  | `BasaltProvider`, `createBasaltTheme` / `baseTheme` / `cssVariablesResolver`, `BasaltShell` + sidebar / mobile-nav / breadcrumbs / page-header, `NavCountBadge`, `SidebarAccount` + the provider-agnostic account contract (`BasaltAccountProps`/`State`/`Actions`), `ThreadWorkspace` + thread-chat components, shell types — the root entry still re-exports the thread-chat components; `./agent-chat` takes the same components standalone, without `BasaltProvider`, the shell, the dashboard composites, or `./connectivity` |
-| `./charts`          | **free** | visx chart primitives, sparklines, hooks, and token re-exports                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `./tokens`          | **free** | `VX` token refs, `buildPaletteCss`, `defineSeries`, `seriesTokens`, `groupTokens`, `alpha`, `ColorPair` / `SeriesMap` types                                                                                                                                                                                                                                                                                                                                                                                                        |
-| `./theme-lab`       | coupled  | `ThemeLabControls`, `applyOverrides`, `loadOverrides`, `COLOR_GROUPS` for live theme inspection                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| `./vite`            | —        | `basaltViteConfig(opts)` — Vite preset for basalt-ui consumer apps; `basaltAppPlugin(opts)` — PWA head, manifest, and icon metadata derived from the token palette                                                                                                                                                                                                                                                                                                                                                                 |
-| `./guard`           | **free** | `checkSource`, `GUARD_RULES`, `Finding` types — the headless theme-guard core                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| `./query`           | **free** | `createBasaltQueryClient`, transport-agnostic `unwrap`, lazy `BasaltQueryDevtools`                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| `./router-tanstack` | **free** | TanStack Router bridge: `useBasaltNav` (active route) + `useRouterBreadcrumbs`                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `./forms`           | coupled  | Mantine form adapter: `useBasaltForm`, `field`, `FormErrorSummary`, `useFormDraft` (Standard Schema)                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| `./notifications`   | coupled  | Mantine notifications: `notify` helpers, typed registry, persisted history, `NotificationBell`                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| `./commands`        | coupled  | Typed command bus + overlay controller, `toSpotlightActions`, `ShortcutsHelp`, `BasaltOverlays`                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| `./data`            | coupled  | Convenience barrel pulling both peer groups: `BasaltDataTable`, `BasaltVirtualList` (Mantine-rendered) — prefer `./data/table` / `./data/virtual` for per-feature opt-in                                                                                                                                                                                                                                                                                                                                                           |
-| `./data/table`      | coupled  | `BasaltDataTable` — sortable data table over TanStack Table, rendered with Mantine                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
-| `./data/virtual`    | coupled  | `BasaltVirtualList` — windowed virtual list over TanStack Virtual, rendered with Mantine                                                                                                                                                                                                                                                                                                                                                                                                                                           |
-| `./agent`           | **free** | Headless streaming layer (`useAgentStream`, `PartList`) + multi-thread `createThreadsStore` / `useAgentThreadRuns` / outcome seam                                                                                                                                                                                                                                                                                                                                                                                                  |
-| `./agent-chat`      | coupled  | Mantine-styled thread-chat components over `./agent`: `ThreadWorkspace`, `ThreadFeed`, `ThreadOutcomeCard`, `ThreadDetailPanel`, `Composer`, `ThreadTranscript`, `threadPartRenderers` — **requires `remend` and `motion`**, not merely optional peers; see [Requirements](#requirements)                                                                                                                                                                                                                                          |
-| `./state`           | **free** | `createPersistedState` (versioned localStorage) + `useOnlineStatus` — Mantine-free state primitives                                                                                                                                                                                                                                                                                                                                                                                                                                |
-| `./connectivity`    | coupled  | `ConnectivityProvider` (aggregates browser/React-Query/SSE/health-check status), `useConnectivity`, `ConnectivityIndicator` — auto-mounted by `BasaltProvider`                                                                                                                                                                                                                                                                                                                                                                     |
-| `./content`         | coupled  | `Prose`, `CodeBlock`, `Callout`, `TableOfContents`, `ReadingProgress`, `Markdown`, `MermaidDiagram`, `ArticleLayout`, `ArticleCard` / `ArticleGrid`, `GuideLink` / `GuideDrawer`, `mdxComponents`                                                                                                                                                                                                                                                                                                                                  |
-| `./styles.css`      | —        | `@layer basalt` base styles, iOS input safety net, font stack                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
-| `./tokens.css`      | **free** | Prebuilt `--vx-*` stylesheet — the default `buildPaletteCss()` output as a plain file, for a consumer with no bundler, React or Mantine; `basalt-ui tokens:css` re-emits it with a custom scheme selector                                                                                                                                                                                                                                                                                                                          |
-| `./configs/*`       | —        | Raw toolchain presets — oxlint, oxfmt, tsconfig (base/react-app/node), lefthook                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
-| `./llms.txt`        | —        | Machine-readable surface map — one entry per published subpath with import specifier, description, layer, and optional peers                                                                                                                                                                                                                                                                                                                                                                                                       |
+| Subpath             | Mantine? | Purpose                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| ------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `.`                 | coupled  | `BasaltProvider`, `createBasaltTheme` / `baseTheme` / `cssVariablesResolver`, `BasaltShell` + sidebar / mobile-nav / breadcrumbs / page-header, `NavCountBadge`, `SidebarAccount` + the provider-agnostic account contract (`BasaltAccountProps`/`State`/`Actions`), `ThreadWorkspace` + thread-chat components, shell types — the root entry still re-exports the thread-chat components; `./agent-chat` takes the same components standalone, without `BasaltProvider`, the shell, the dashboard composites, or `./connectivity`                                                                                                                    |
+| `./charts`          | **free** | visx chart primitives, sparklines, hooks, and token re-exports                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `./tokens`          | **free** | `VX` token refs, `buildPaletteCss`, `defineSeries`, `seriesTokens`, `groupTokens`, `alpha`, `ColorPair` / `SeriesMap` types                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| `./theme-lab`       | coupled  | `ThemeLabControls`, `applyOverrides`, `loadOverrides`, `COLOR_GROUPS` for live theme inspection                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `./vite`            | —        | `basaltViteConfig(opts)` — Vite preset for basalt-ui consumer apps; `basaltAppPlugin(opts)` — PWA head, manifest, and icon metadata derived from the token palette                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `./guard`           | **free** | `checkSource`, `GUARD_RULES`, `Finding` types — the headless theme-guard core                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| `./query`           | **free** | `createBasaltQueryClient`, transport-agnostic `unwrap`, lazy `BasaltQueryDevtools`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `./router-tanstack` | **free** | TanStack Router bridge: `useBasaltNav` (active route) + `useRouterBreadcrumbs`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `./forms`           | coupled  | Mantine form adapter: `useBasaltForm`, `field`, `FormErrorSummary`, `useFormDraft` (Standard Schema)                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| `./notifications`   | coupled  | Mantine notifications: `notify` helpers, typed registry, persisted history, `NotificationBell`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `./commands`        | coupled  | Typed command bus + overlay controller, `toSpotlightActions`, `ShortcutsHelp`, `BasaltOverlays`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `./data`            | coupled  | Convenience barrel pulling both peer groups: `BasaltDataTable`, `BasaltVirtualList` (Mantine-rendered) — prefer `./data/table` / `./data/virtual` for per-feature opt-in                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `./data/table`      | coupled  | `BasaltDataTable` — sortable data table over TanStack Table, rendered with Mantine                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| `./data/virtual`    | coupled  | `BasaltVirtualList` — windowed virtual list over TanStack Virtual, rendered with Mantine                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
+| `./agent`           | **free** | Headless streaming layer (`useAgentStream`, `PartList`) + multi-thread `createThreadsStore` / `useAgentThreadRuns` / outcome seam                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `./agent-chat`      | coupled  | Mantine-styled thread-chat components over `./agent`: `ThreadWorkspace`, `ThreadFeed` (`variant`/`renderRow`), `ThreadFeedRow` (inline-expanding Slack row, lazily mounted + kept mounted), `ThreadOutcomeCard`, `ThreadDetailPanel`, `Composer`, `ThreadTranscript` (`groupConsecutive`/`affordances`/`virtualize` — windowed transcripts open at the newest message unless `initialScroll: 'start'`; `virtualize` is enabled by the optional `@tanstack/react-virtual` peer, absent it degrades to an unwindowed, height-bound pane), `threadPartRenderers` — **requires `motion`**, not merely an optional peer; see [Requirements](#requirements) |
+| `./state`           | **free** | `createPersistedState` (versioned localStorage) + `useOnlineStatus` — Mantine-free state primitives                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+| `./connectivity`    | coupled  | `ConnectivityProvider` (aggregates browser/React-Query/SSE/health-check status), `useConnectivity`, `ConnectivityIndicator` — auto-mounted by `BasaltProvider`                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `./content`         | coupled  | `Prose`, `CodeBlock`, `Callout`, `TableOfContents`, `ReadingProgress`, `Markdown`, `MermaidDiagram`, `ArticleLayout`, `ArticleCard` / `ArticleGrid`, `GuideLink` / `GuideDrawer`, `mdxComponents`                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `./styles.css`      | —        | `@layer basalt` base styles, iOS input safety net, font stack                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| `./tokens.css`      | **free** | Prebuilt `--vx-*` stylesheet — the default `buildPaletteCss()` output as a plain file, for a consumer with no bundler, React or Mantine; `basalt-ui tokens:css` re-emits it with a custom scheme selector                                                                                                                                                                                                                                                                                                                                                                                                                                             |
+| `./configs/*`       | —        | Raw toolchain presets — oxlint, oxfmt, tsconfig (base/react-app/node), lefthook                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| `./llms.txt`        | —        | Machine-readable surface map — one entry per published subpath with import specifier, description, layer, and optional peers                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
 
 Named exports only — no default exports.
 
@@ -443,20 +443,19 @@ import { BasaltVirtualList } from 'basalt-ui/data/virtual'
 ### `./content` — prose + markdown
 
 ````bash
-bun add remend                      # required — `Markdown` imports it eagerly, so the subpath won't resolve without it
-bun add react-markdown remark-gfm   # Markdown
-bun add shiki                       # CodeBlock / fenced-code highlighting (brings @shikijs/langs, @shikijs/themes as optional peers)
-bun add beautiful-mermaid           # MermaidDiagram / ```mermaid fences
+bun add react-markdown remark-gfm     # Markdown
+bun add remend                        # `Markdown`'s streaming-tail repair — optional, lazy dynamic import
+bun add rehype-sanitize               # `Markdown`'s sanitize pass — optional, lazy dynamic import
+bun add shiki                         # CodeBlock / fenced-code highlighting (brings @shikijs/langs, @shikijs/themes as optional peers)
+bun add beautiful-mermaid             # MermaidDiagram / ```mermaid fences
 ````
 
-`remend` is the one peer here that is not lazy: `Markdown` imports it at the top of the module, so
-`basalt-ui/content` fails to resolve without it even if you never render `Markdown` yourself. That
-eager import also reaches past this subpath: both the root `.` entry and `./agent-chat`'s
-`ThreadWorkspace` / `ThreadTranscript` import `Markdown` directly (not lazily) as their text
-renderer, so `remend` is listed as **required** in the [Requirements](#requirements) table too, not
-only here.
-Everything else degrades gracefully when absent (markdown falls back to plain text, fences to
-plain mono, mermaid renders nothing). `Markdown` is the package's **only** markdown
+Every peer here is lazy: `Markdown` reaches all of them through a dynamic `import()`, so
+`basalt-ui/content` resolves and renders with none of them installed. Absence degrades gracefully
+— never a crash: without `react-markdown`/`remark-gfm`, markdown falls back to plain text; without
+`remend`, the streaming tail renders unrepaired; without `rehype-sanitize`, the sanitize pass is
+skipped (dev-warned once); without `shiki`, fences fall back to plain mono; without
+`beautiful-mermaid`, mermaid fences render nothing. `Markdown` is the package's **only** markdown
 renderer — it backs long-form content and AI chat alike:
 
 ```tsx
@@ -465,12 +464,16 @@ import { Markdown, Prose, CodeBlock, TableOfContents } from 'basalt-ui/content'
 // Long-form: 72ch measure, article typography, heading anchors + slug dedup.
 <Markdown>{article.body}</Markdown>
 
-// AI output: chat density, block-split + memoized, `remend`-repaired in-flight tail.
-<Markdown streaming density="chat">{part.text}</Markdown>
+// AI output: chat density, block-split + memoized, `remend`-repaired in-flight tail. Model-generated
+// text is untrusted regardless of whether it has finished streaming — pin `contentTrust` explicitly.
+<Markdown streaming density="chat" contentTrust="untrusted">{part.text}</Markdown>
 ```
 
-`streaming` also tightens image URLs to same-origin — LLM-authored markdown can otherwise exfiltrate
-via a remote image URL. Full doctrine: `agent/rules/basalt-content.md`.
+`streaming` is a rendering mode only — it says the text is still arriving, not who wrote it. The
+security input is the separate `contentTrust` prop (`'trusted' | 'untrusted'`), the sole driver of
+the `allowedImagePrefixes` default: same-origin-only when untrusted, since LLM-authored markdown can
+otherwise exfiltrate via a remote image URL. Any surface rendering agent/model output must pin
+`contentTrust="untrusted"` explicitly. Full doctrine: `agent/rules/basalt-content.md`.
 
 ### `./agent` — streaming-chat layer
 
@@ -606,16 +609,25 @@ Wire the drift gate to catch doctrine falling behind after a basalt-ui upgrade:
 
 ## Requirements
 
-| Peer                    | Version   | Notes                                                                                                                                                                                                                                                                             |
-| ----------------------- | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `react` / `react-dom`   | `^19`     | required                                                                                                                                                                                                                                                                          |
-| `@mantine/core`         | `^9.3`    | required                                                                                                                                                                                                                                                                          |
-| `@mantine/hooks`        | `^9.3`    | required                                                                                                                                                                                                                                                                          |
-| `@tanstack/react-query` | —         | required for the root `.` entry — `BasaltProvider` hard-requires it at build time; NOT required by `./agent-chat`, which doesn't touch it                                                                                                                                         |
-| `remend`                | `1.3.0`   | required for both the root `.` entry and `./agent-chat` — both export `ThreadWorkspace`/`ThreadTranscript` (`agent-chat/thread-message.tsx`), which statically imports `content/markdown.tsx`, which imports `remend` eagerly; see [`./content`](#content--prose--markdown) below |
-| `motion`                | `12.42.0` | required for both the root `.` entry and `./agent-chat` — both export `ThreadFeed`/`ThreadDetailPanel` (`agent-chat/thread-feed.tsx` / `thread-detail-panel.tsx`), which import `motion/react` eagerly; the root's `ThemeToggle` also uses it                                     |
-
-`./agent-chat`'s `optionalPeers` in `llms.txt`/`surfaces.ts` still lists `remend` and `motion` (npm has no per-subpath optionality in `peerDependenciesMeta`), but treat both as required when installing just this subpath — see the subpath table above.
+| Peer                      | Version        | Notes                                                                                                                                                                                                                                         |
+| ------------------------- | -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `react` / `react-dom`     | `^19`          | required                                                                                                                                                                                                                                      |
+| `@mantine/core`           | `^9.3`         | required                                                                                                                                                                                                                                      |
+| `@mantine/hooks`          | `^9.3`         | required                                                                                                                                                                                                                                      |
+| `@tanstack/react-query`   | —              | required for the root `.` entry — `BasaltProvider` hard-requires it at build time; NOT required by `./agent-chat`, which doesn't touch it                                                                                                     |
+| `motion`                  | `12.42.0`      | required for both the root `.` entry and `./agent-chat` — both export `ThreadFeed`/`ThreadDetailPanel` (`agent-chat/thread-feed.tsx` / `thread-detail-panel.tsx`), which import `motion/react` eagerly; the root's `ThemeToggle` also uses it |
+| `@tanstack/react-virtual` | `>=3.13.26 <4` | optional for `./agent-chat` — enables `ThreadTranscript`'s `virtualize` windowing mode via a lazy `import()`; absent it degrades to an unwindowed, height-bound pane                                                                          |
+
+`remend` was required through 1.10.x — `content/markdown.tsx` imported it at the top of the module,
+so both the root `.` entry and `./agent-chat`'s `ThreadWorkspace`/`ThreadTranscript` hard-required it
+transitively. It is now a genuinely optional, lazy peer (dynamic `import()`); see
+[`./content`](#content--prose--markdown) below.
+
+`./agent-chat`'s `optionalPeers` in `llms.txt`/`surfaces.ts` lists `remend`, `motion`, and
+`@tanstack/react-virtual` (npm has no per-subpath optionality in `peerDependenciesMeta`) — only
+`motion` needs to be treated as required when installing just this subpath; `remend` and
+`@tanstack/react-virtual` are accurately optional there too, both reached only through a lazy
+`import()` (the latter behind `ThreadTranscript`'s `virtualize` option).
 
 Optional peer batteries and their packages are listed per battery above.
 

package/agent/rules/basalt-agent.md

@@ -257,6 +257,20 @@ composer) on the right, collapsing to a single pane below 768px. The lower-level
 `threadPartRenderers`) are exported too for bespoke layouts. Motion (feed insert, panel slide) runs
 on the shared `MOTION_*` tokens and honours `useReducedMotion`.
 
+`ThreadFeed` also takes a `variant` (`'outcome'`, the default above, or `'inline'` for
+`ThreadFeedRow`, the Slack-style row that expands in place instead of opening a separate detail
+panel — lazily mounted on first expand, then kept mounted and hidden via CSS on every collapse
+after that) and a `renderRow` override that takes priority over `variant` entirely, for full control
+over live-run wiring (`onSend`/`onStop`/`liveParts`/`liveStatus`) the built-in `'inline'` row
+doesn't expose on its own; wire a real `onSend` on `ThreadFeed` itself to make the built-in row's
+composer usable, or omit it and the row's composer renders disabled rather than a live control that
+silently discards input. `ThreadTranscript` also takes `groupConsecutive` (suppresses role
+label/chrome on same-speaker runs), a per-message `affordances` contract (timestamp/copy/regenerate/
+custom actions), and an optional `virtualize`/`height` windowing mode for very long threads. A
+windowed transcript owns its own scroll node (never nest it in `BasaltStickToBottom`) and scrolls
+itself to the newest message once on mount — `virtualize={{ initialScroll: 'start' }}` opts out, and
+is what a consumer restoring its own saved scroll position wants so the two don't fight.
+
 **Boundary:** the headless layer (`createThreadsStore`, `useAgentThreadRuns`, the outcome types)
 stays Mantine-free in `./agent`; the components are Mantine-coupled and ship from `./agent-chat`
 (also re-exported from the root entry). Never add `@mantine/*` under `src/agent/**` — it is

package/agent/rules/basalt-content.md

@@ -76,10 +76,23 @@ token, no debouncing needed.
 - The LAST (in-flight) block is repaired via `remend` before rendering — unclosed `**`/`` ` ``/
   `~~`/`$$`, an incomplete `[text](url` link (remend rewrites it to
   `streamdown:incomplete-link` — any `streamdown:` href is dropped by the link hardening below).
+  `remend` is a lazy optional peer (dynamic `import()`); the root `.` entry no longer hard-requires
+  it.
+- **`streaming` is a RENDERING mode only** — it says the text is still arriving, not who wrote it.
+  Trust is a separate prop, `contentTrust: 'trusted' | 'untrusted'`, and it is the sole input to the
+  image allowlist below. Any surface rendering agent/model output must pin
+  `contentTrust="untrusted"` explicitly — a finished agent message is still model-generated, so
+  don't lean on `streaming` as a stand-in for trust.
 - **Hardening is ALWAYS ON**, streaming or not: `allowedLinkPrefixes` (default `['https://',
-'mailto:', '#', '/']`) / `allowedImagePrefixes` (default `['https://', '/']`) / `defaultOrigin`
-  (resolves a relative URL before the allowlist check's result is used). A disallowed `href`/`src`
-  renders as an unlinked `<span>` / a dropped image — never a raw unsafe URL.
+'mailto:', '#', '/']`) / `defaultOrigin` (resolves a relative URL before the allowlist check's
+  result is used) / a `rehype-sanitize` pass (optional peer; `sanitizeSchema` only ADDS to the
+  default schema, never removes from it). `allowedImagePrefixes` defaults off `contentTrust`, NOT
+  `streaming`: `['https://', '/']` when trusted, same-origin-only `['/']` when untrusted — an
+  auto-fetched image is the classic prompt-injection exfiltration channel. `contentTrust` itself
+  defaults to `'untrusted'` when `streaming` is set, `'trusted'` otherwise — a backward-compat
+  floor, not the policy (see the bullet above). An explicit `allowedImagePrefixes` always overrides
+  the `contentTrust` default. A disallowed `href`/`src` renders as an unlinked `<span>` / a dropped
+  image — never a raw unsafe URL.
 - Fenced code highlights/upgrades per BLOCK on settle, not per token — the in-flight fence renders
   plain mono (`CodeBlock showCopy={false}`) until its block settles.
 - Heading ids: a document-wide `SlugTracker` in non-streaming mode gives correct cross-heading

package/configs/oxlint-plugin.js

@@ -372,9 +372,13 @@ const OVERFLOW_KEYS = new Set(['overflow', 'overflowY'])
 const SCROLLING_VALUES = new Set(['auto', 'scroll'])
 
 /**
- * Reports a `style` object property that turns a node into its own scroll container. Warning-level
- * by design: whether a raw scroll box is wrong depends on who owns the scroll node, which no AST
- * check can see — so this steers rather than blocks, and `theme-allow` opts out.
+ * Reports a `style` object property that turns a node into its own scroll container. Whether a raw
+ * scroll box is wrong depends on who owns the scroll node, which no AST check can see — so the
+ * `theme-allow` comment is a first-class part of the rule, not an escape valve for exceptional
+ * cases: a component that legitimately owns its scroll node (`BasaltStickToBottom`,
+ * `BasaltVirtualList`, `ThreadTranscript`'s virtualized pane) declares that ownership with the
+ * comment and moves on. Severity went `off` → `warn` (1.12.0) → `error` (1.13.0) once every live
+ * site in the repo carried that declaration; the opt-out mechanism is identical at either level.
  */
 const rawScrollContainer = {
   meta: {

package/configs/oxlint-plugin.test.ts

@@ -417,21 +417,21 @@ describe('basalt/ai-sdk-major', () => {
   })
 })
 
-// ── raw-scroll-container — promotion (off → warn shipped) ────────────────────
+// ── raw-scroll-container — promotion (off → warn → error shipped) ───────────
 
 describe('basalt/raw-scroll-container promotion', () => {
-  it('ships "warn" (not "off") in the consumer preset', () => {
+  it('ships "error" (not "warn"/"off") in the consumer preset', () => {
     const shipped = JSON.parse(
       readFileSync(resolve(import.meta.dirname, 'oxlint.json'), 'utf8'),
     ) as { rules: Record<string, unknown> }
-    expect(shipped.rules['basalt/raw-scroll-container']).toBe('warn')
+    expect(shipped.rules['basalt/raw-scroll-container']).toBe('error')
   })
 
-  it('stays "warn" repo-local', () => {
+  it('stays at the shipped level ("error") repo-local', () => {
     const repoLocal = JSON.parse(
       readFileSync(resolve(import.meta.dirname, '..', '..', '..', '.oxlintrc.json'), 'utf8'),
     ) as { rules: Record<string, unknown> }
-    expect(repoLocal.rules['basalt/raw-scroll-container']).toBe('warn')
+    expect(repoLocal.rules['basalt/raw-scroll-container']).toBe('error')
   })
 
   it('still flags a raw overflow:auto style property at the shipped level', () => {
@@ -447,3 +447,32 @@ describe('basalt/raw-scroll-container promotion', () => {
     expect(rules).toContain('raw-scroll-container')
   })
 })
+
+// ── agent rules — promotion (warn → error shipped) ──────────────────────────
+// The three agent-chat rules were promoted warn → error in the SHIPPED preset alongside
+// raw-scroll-container above, but had no equivalent lock — `scripts/gen-oxlint.ts` only regenerates
+// the `overrides` array; this top-level `rules` block is hand-maintained and
+// `tests/oxlint-preset-sync.test.ts` only checks `overrides` against `projectBanList('shipped')`, so
+// a later accidental revert of one of these three back to "warn" would pass the suite silently.
+
+describe('basalt agent rules promotion', () => {
+  it.each(['basalt/agent-resume-guard', 'basalt/agent-no-raw-usechat', 'basalt/ai-sdk-major'])(
+    '%s ships "error" (not "warn"/"off") in the consumer preset',
+    (rule) => {
+      const shipped = JSON.parse(
+        readFileSync(resolve(import.meta.dirname, 'oxlint.json'), 'utf8'),
+      ) as { rules: Record<string, unknown> }
+      expect(shipped.rules[rule]).toBe('error')
+    },
+  )
+
+  it.each(['basalt/agent-resume-guard', 'basalt/agent-no-raw-usechat', 'basalt/ai-sdk-major'])(
+    '%s stays at the shipped level ("error") repo-local',
+    (rule) => {
+      const repoLocal = JSON.parse(
+        readFileSync(resolve(import.meta.dirname, '..', '..', '..', '.oxlintrc.json'), 'utf8'),
+      ) as { rules: Record<string, unknown> }
+      expect(repoLocal.rules[rule]).toBe('error')
+    },
+  )
+})

package/configs/oxlint.json

@@ -20,12 +20,12 @@
     "basalt/raw-size-literal": "warn",
     "basalt/card-inset": "error",
     "basalt/chart-in-raw-surface": "error",
-    "basalt/raw-scroll-container": "warn",
+    "basalt/raw-scroll-container": "error",
     "basalt/visx-boundary": "error",
     "basalt/visx-tooltip": "error",
-    "basalt/agent-resume-guard": "warn",
-    "basalt/agent-no-raw-usechat": "warn",
-    "basalt/ai-sdk-major": "warn"
+    "basalt/agent-resume-guard": "error",
+    "basalt/agent-no-raw-usechat": "error",
+    "basalt/ai-sdk-major": "error"
   },
   "overrides": [
     {