sh3-core 0.22.5 → 0.24.0

package/dist/documents/picker-primitive.js

@@ -2,23 +2,15 @@ import { sh3 } from '../sh3Runtime.svelte';
 import DocumentBrowser from '../primitives/widgets/_DocumentBrowser.svelte';
 const BOX_STYLE = 'max-width: min(800px, 95vw);';
 const MODAL_OPTS = { dismissOnBackdrop: true, boxStyle: BOX_STYLE };
-/**
- * Create a document picker API bound to a document listing function.
- * The listFn is derived from the shard's document zone + browse permission
- * and baked in at construction time so callers don't pass their own scope.
- *
- * When an `anchor` element is provided the browser opens as a popup
- * (anchored near the element). Without an anchor it opens as a centered
- * modal (the expected default for file-browser dialogs).
- */
-export function createDocumentPicker(listFn) {
-    /** Resolve handle for either popup (anchored) or modal (centered) path. */
+export function createDocumentPicker(listFn, options = {}) {
+    const { listFolders, handle, readOnlyShard, initialShardId, lockToShard } = options;
     function openBrowser(browserProps, anchor) {
+        const props = Object.assign(Object.assign({}, browserProps), { listFolders, handle, readOnlyShard, initialShardId, lockToShard });
         if (anchor) {
             const rect = anchor.getBoundingClientRect();
-            return sh3.popup.show(DocumentBrowser, { anchor: { x: rect.left + rect.width / 2, y: rect.top } }, browserProps);
+            return sh3.popup.show(DocumentBrowser, { anchor: { x: rect.left + rect.width / 2, y: rect.top } }, props);
         }
-        return sh3.modal.open(DocumentBrowser, browserProps, MODAL_OPTS);
+        return sh3.modal.open(DocumentBrowser, props, MODAL_OPTS);
     }
     function wrapHandle(handle, resolve) {
         const origClose = handle.close;

package/dist/host.js

@@ -15,7 +15,7 @@
  * import-hygiene rule is: shards and apps import from `api.ts`, the host
  * imports from `host.ts`.
  */
-import { registerShard as registerShardInternal, registerAllShards, } from './shards/lifecycle.svelte';
+import { registerShard as registerShardInternal, registerAllShards, listRegisteredShards, } from './shards/lifecycle.svelte';
 import { registerApp, registeredApps } from './apps/registry.svelte';
 import { launchApp, readLastApp, clearLastApp } from './apps/lifecycle';
 import { sh3coreShard } from './sh3core-shard/sh3coreShard.svelte';
@@ -35,6 +35,9 @@ import { runModeIdRenameMigration } from './migrations/mode-id-rename';
 import { setLifecycleHandlers } from './navigation/back-stack';
 import { installWebEmitter } from './navigation/platform-web';
 import { returnToHome } from './apps/lifecycle';
+import { resolveAllowedShardIds } from './projects/scope-gate';
+import { sessionState } from './projects/session-state.svelte';
+import { projectsState } from './projects-shard/projectsShard.svelte';
 export { __setBackend };
 export { setLocalOwner };
 export { __setActiveScope, __setDocumentBackend } from './documents/config';
@@ -58,6 +61,7 @@ function createWorkspaceZoneAdapter() {
     };
 }
 export async function bootstrap(config) {
+    var _a;
     // Run before anything touches the workspace zone so renamed keys are
     // already in place when shards activate.
     if (typeof globalThis.localStorage !== 'undefined') {
@@ -83,10 +87,22 @@ export async function bootstrap(config) {
     }
     // 3. Load any packages installed in a previous session from IndexedDB
     await loadInstalledPackages();
-    // 4. v3: run register(ctx) on every registered shard. Lifecycle module
-    //    handles error isolation; one failing shard does not block boot.
-    await registerAllShards();
-    // 5. Read the last-active app from the user zone. If auto-launch fails,
+    // 4. Compute the project-scope register gate. Null when in personal
+    //    scope or when the active project has an empty allowlist; otherwise
+    //    a Set of shard ids whose register() may run. Shards not in the
+    //    set are skipped — they remain in `registeredShards` so the apps
+    //    registry can still display their manifests, but their boot
+    //    side-effects (verbs, contributions, gestures, network calls)
+    //    are suppressed.
+    const activeProject = sessionState.activeProjectId
+        ? (_a = projectsState.projects.find((p) => p.id === sessionState.activeProjectId)) !== null && _a !== void 0 ? _a : null
+        : null;
+    const allowed = resolveAllowedShardIds(activeProject, registeredApps, listRegisteredShards());
+    // 5. v3: run register(ctx) on every registered shard (gated by allowed).
+    //    Lifecycle module handles error isolation; one failing shard does
+    //    not block boot.
+    await registerAllShards(allowed);
+    // 6. Read the last-active app from the user zone. If auto-launch fails,
     // clear the slot so the next reload lands on home instead of looping
     // into the same failure. No toast — the user did not initiate this.
     const lastId = readLastApp();
@@ -99,7 +115,7 @@ export async function bootstrap(config) {
             clearLastApp();
         }
     }
-    // 6. Wire navigation lifecycle handlers and install the web back/forward
+    // 7. Wire navigation lifecycle handlers and install the web back/forward
     // emitter. Order: after autostart shards and the optional last-app
     // launch, so the emitter's synthetic history entries don't interleave
     // with boot-time launches. The window/history guard makes bootstrap
@@ -118,6 +134,7 @@ export async function bootstrap(config) {
  *   - lastApp auto-launch (satellites have no last-app concept)
  */
 export async function bootstrapSatellite(config) {
+    var _a;
     // 1. Framework-owned shards (same list as bootstrap, no excludes for satellites)
     const frameworkShards = [sh3coreShard, shellShard, storeShard, adminShard, projectsShard, appearanceShard, layoutsShard];
     for (const shard of frameworkShards) {
@@ -133,7 +150,13 @@ export async function bootstrapSatellite(config) {
     // 4. v3: one-pass register sweep replaces the old autostart + satellite
     //    passes. `config.activateShardIds` is now a no-op (the field is
     //    retained on the interface for back-compat; Phase 6 deletes it).
+    //    Satellites inherit the host's project scope, so apply the same
+    //    register gate.
     void config;
-    await registerAllShards();
+    const activeProject = sessionState.activeProjectId
+        ? (_a = projectsState.projects.find((p) => p.id === sessionState.activeProjectId)) !== null && _a !== void 0 ? _a : null
+        : null;
+    const allowed = resolveAllowedShardIds(activeProject, registeredApps, listRegisteredShards());
+    await registerAllShards(allowed);
 }
 export { installPackage, listInstalledPackages } from './registry/installer';

package/dist/layout/slotHostPool.svelte.d.ts

@@ -19,6 +19,17 @@ export declare function acquireSlotHost(slotId: string, viewId: string | null, l
  * unconditional detach would yank the host out of its new home.
  */
 export declare function releaseSlotHost(slotId: string, fromWrapper?: HTMLElement): void;
+/**
+ * Synchronously drain `pendingDestroy`: for every slot id queued for
+ * deferred destruction, run the destroy body immediately if refcount is
+ * 0. Called by `unloadApp` so that all of the unloading app's views are
+ * unmounted before `onAppDeactivate` runs — preventing leaked `$derived`s
+ * in still-mounted views from tripping on state the shard nullifies.
+ *
+ * Safe to call when `pendingDestroy` is empty (no-op). Safe to call
+ * multiple times in succession.
+ */
+export declare function flushPendingDestroys(): void;
 /**
  * Test / teardown helper — destroys every pooled host immediately. Used
  * by HMR boundaries and tests; not part of normal runtime flow.

package/dist/layout/slotHostPool.svelte.js

@@ -279,23 +279,47 @@ export function releaseSlotHost(slotId, fromWrapper) {
         return;
     }
     pendingDestroy.add(slotId);
-    queueMicrotask(() => {
-        var _a, _b;
-        if (!pendingDestroy.has(slotId))
-            return;
-        pendingDestroy.delete(slotId);
-        const current = pool.get(slotId);
-        if (!current || current.refcount > 0)
-            return; // re-acquired, keep
-        (_a = current.resizeObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
-        __disposeSlotContributions(slotId);
-        (_b = current.handle) === null || _b === void 0 ? void 0 : _b.unmount();
-        current.cancelPendingMount();
-        current.host.remove();
-        pool.delete(slotId);
-        delete dirtyState[slotId];
-        delete closableState[slotId];
-    });
+    queueMicrotask(() => destroyIfPending(slotId));
+}
+/**
+ * Internal: run the destroy body for one slotId if it is still pending
+ * and its refcount is 0. Shared between the microtask deferred destroy
+ * and the synchronous `flushPendingDestroys`.
+ */
+function destroyIfPending(slotId) {
+    var _a, _b;
+    if (!pendingDestroy.has(slotId))
+        return;
+    pendingDestroy.delete(slotId);
+    const current = pool.get(slotId);
+    if (!current || current.refcount > 0)
+        return; // re-acquired, keep
+    (_a = current.resizeObserver) === null || _a === void 0 ? void 0 : _a.disconnect();
+    __disposeSlotContributions(slotId);
+    (_b = current.handle) === null || _b === void 0 ? void 0 : _b.unmount();
+    current.cancelPendingMount();
+    current.host.remove();
+    pool.delete(slotId);
+    delete dirtyState[slotId];
+    delete closableState[slotId];
+}
+/**
+ * Synchronously drain `pendingDestroy`: for every slot id queued for
+ * deferred destruction, run the destroy body immediately if refcount is
+ * 0. Called by `unloadApp` so that all of the unloading app's views are
+ * unmounted before `onAppDeactivate` runs — preventing leaked `$derived`s
+ * in still-mounted views from tripping on state the shard nullifies.
+ *
+ * Safe to call when `pendingDestroy` is empty (no-op). Safe to call
+ * multiple times in succession.
+ */
+export function flushPendingDestroys() {
+    // Snapshot the set so destroyIfPending's `pendingDestroy.delete(slotId)`
+    // doesn't mutate the iteration source.
+    const ids = [...pendingDestroy];
+    for (const slotId of ids) {
+        destroyIfPending(slotId);
+    }
 }
 /**
  * Test / teardown helper — destroys every pooled host immediately. Used

package/dist/layout/slotHostPool.test.js

@@ -1,7 +1,7 @@
 import { describe, it, expect, beforeEach, vi } from 'vitest';
 import { tick } from 'svelte';
 import { resetFramework } from '../__test__/reset';
-import { acquireSlotHost, releaseSlotHost } from './slotHostPool.svelte';
+import { acquireSlotHost, releaseSlotHost, flushPendingDestroys } from './slotHostPool.svelte';
 import { registerView } from '../shards/registry';
 import SlotContainer from './SlotContainer.svelte';
 import { renderWithShell } from '../__test__/render';
@@ -102,6 +102,50 @@ describe('slotHostPool — D.5 root swap preserves app slots', () => {
         expect(teardown).not.toHaveBeenCalled();
     });
 });
+// ─── D.9 ─────────────────────────────────────────────────────────────────────
+describe('slotHostPool — D.9 flushPendingDestroys synchronously unmounts', () => {
+    beforeEach(resetFramework);
+    it('synchronously unmounts pooled hosts whose refcount has reached 0', async () => {
+        const teardown = vi.fn();
+        registerView('flush:view', { mount: () => ({ unmount: teardown }) });
+        // Acquire a slot host, then drop refcount to 0 — this enters pendingDestroy
+        // but does NOT unmount until the next microtask (existing behavior).
+        acquireSlotHost('flush-slot', 'flush:view', 'Flush View');
+        // The view-factory mount is itself deferred to a microtask; let it run
+        // so the pool entry has a real `handle` to unmount.
+        await Promise.resolve();
+        releaseSlotHost('flush-slot');
+        // The destroy microtask has NOT yet run, so teardown has not been called.
+        expect(teardown).not.toHaveBeenCalled();
+        // flushPendingDestroys runs the destroy body now, synchronously.
+        flushPendingDestroys();
+        expect(teardown).toHaveBeenCalledTimes(1);
+    });
+    it('does not unmount entries whose refcount is still > 0', async () => {
+        const teardown = vi.fn();
+        registerView('keep:view', { mount: () => ({ unmount: teardown }) });
+        acquireSlotHost('keep-slot', 'keep:view', 'Keep View');
+        await Promise.resolve();
+        // Refcount is 1, never released.
+        flushPendingDestroys();
+        expect(teardown).not.toHaveBeenCalled();
+        // Cleanup
+        releaseSlotHost('keep-slot');
+    });
+    it('clears pendingDestroy so the queued microtask is a no-op', async () => {
+        const teardown = vi.fn();
+        registerView('once:view', { mount: () => ({ unmount: teardown }) });
+        acquireSlotHost('once-slot', 'once:view', 'Once View');
+        await Promise.resolve();
+        releaseSlotHost('once-slot');
+        flushPendingDestroys();
+        expect(teardown).toHaveBeenCalledTimes(1);
+        // The previously-queued microtask should now find pendingDestroy empty
+        // for this slot and do nothing. teardown stays at 1.
+        await Promise.resolve();
+        expect(teardown).toHaveBeenCalledTimes(1);
+    });
+});
 // ─── D.6 ─────────────────────────────────────────────────────────────────────
 describe('slotHostPool — D.6 data-sh3-view attribute', () => {
     beforeEach(resetFramework);

package/dist/layouts-shard/layoutsShard.svelte.js

@@ -135,6 +135,7 @@ export const layoutsShard = {
         id: '__layouts__',
         label: 'Saved Layouts',
         version: VERSION,
+        kind: 'system',
         views: [],
     },
     register(ctx) {

package/dist/overlays/OverlayRoots.svelte

@@ -14,6 +14,7 @@
    * they portal in.
    */
 
+  import { untrack } from 'svelte';
   import DragPreview from '../layout/DragPreview.svelte';
   import FloatLayer from './FloatLayer.svelte';
   import { registerLayerRoot, unregisterLayerRoot } from './roots';
@@ -47,12 +48,22 @@
     };
   });
 
+  // Re-bind only when the active LayoutTree itself changes (app/preset
+  // switch). bindFloatStore iterates `floats` to clamp persisted entries,
+  // which would otherwise subscribe this effect to every push/splice from
+  // floatManager — and bindFloatStore unconditionally calls
+  // compactRootStore.reset() at the end, so a re-fire on push wipes the
+  // auto-focus that openFloat() set milliseconds earlier (compact-body
+  // would stay on docked after the first ²-press; see float-compact-bind
+  // regression test).
   $effect(() => {
     const tree = layoutStore.tree;
-    bindFloatStore(tree.floats, () => ({
-      w: window.innerWidth,
-      h: window.innerHeight,
-    }));
+    untrack(() => {
+      bindFloatStore(tree.floats, () => ({
+        w: window.innerWidth,
+        h: window.innerHeight,
+      }));
+    });
     return () => unbindFloatStore();
   });
 </script>

package/dist/overlays/__test__/OverlayBindHarness.svelte

@@ -0,0 +1,20 @@
+<script lang="ts">
+  /*
+   * Test harness — mirrors the $effect block in OverlayRoots.svelte that
+   * binds the float manager to the active LayoutTree's floats array.
+   * Keeps the `untrack` shape so the harness validates the production
+   * fix: the bind should NOT re-fire on float push/splice (which would
+   * trip compactRootStore.reset() and wipe auto-focus from openFloat).
+   */
+  import { untrack } from 'svelte';
+  import { layoutStore } from '../../layout/store.svelte';
+  import { bindFloatStore, unbindFloatStore } from '../float';
+
+  $effect(() => {
+    const tree = layoutStore.tree;
+    untrack(() => {
+      bindFloatStore(tree.floats, () => ({ w: 360, h: 740 }));
+    });
+    return () => unbindFloatStore();
+  });
+</script>

package/dist/overlays/__test__/OverlayBindHarness.svelte.d.ts

@@ -0,0 +1,3 @@
+declare const OverlayBindHarness: import("svelte").Component<Record<string, never>, {}, "">;
+type OverlayBindHarness = ReturnType<typeof OverlayBindHarness>;
+export default OverlayBindHarness;

package/dist/overlays/float-compact-bind.svelte.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/overlays/float-compact-bind.svelte.test.js

@@ -0,0 +1,51 @@
+/*
+ * Regression: in compact mode, floatManager.open() must auto-switch the
+ * compact body to the new float. The setRoot call inside openFloat is
+ * correct, but a reactive $effect that re-binds the float store on every
+ * iteration of `tree.floats` re-runs the moment the array is mutated,
+ * and bindFloatStore unconditionally calls compactRootStore.reset() —
+ * wiping the auto-focus that openFloat just set.
+ *
+ * This test mounts a tiny wrapper that mirrors the OverlayRoots $effect
+ * (read layoutStore.tree, call bindFloatStore on every run) and asserts
+ * compactRootStore is still pointing at the new float after open().
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { mount, unmount, flushSync } from 'svelte';
+import { floatManager, unbindFloatStore, __resetFloatManagerForTest, } from './float';
+import { compactRootStore, __resetCompactRootStoreForTest, } from '../layout/compact/rootStore.svelte';
+import { __resetLayoutStoreForTest } from '../layout/store.svelte';
+import { viewportStore } from '../viewport/store.svelte';
+import OverlayBindHarness from './__test__/OverlayBindHarness.svelte';
+describe('floatManager.open in compact — preserves setRoot under reactive bind', () => {
+    let mounted = null;
+    let host = null;
+    beforeEach(() => {
+        __resetFloatManagerForTest();
+        __resetCompactRootStoreForTest();
+        __resetLayoutStoreForTest();
+        viewportStore.override('compact');
+    });
+    afterEach(() => {
+        if (mounted) {
+            unmount(mounted);
+            mounted = null;
+        }
+        if (host) {
+            host.remove();
+            host = null;
+        }
+        viewportStore.override(null);
+        unbindFloatStore();
+    });
+    it('opens a float and the compact body root points to it after the bind effect settles', () => {
+        host = document.createElement('div');
+        document.body.appendChild(host);
+        mounted = mount(OverlayBindHarness, { target: host });
+        flushSync();
+        const id = floatManager.open('test:view', { title: 'Notes' });
+        // Allow any reactive re-bind to run.
+        flushSync();
+        expect(compactRootStore.current).toEqual({ kind: 'float', floatId: id });
+    });
+});

package/dist/overlays/modal.js

@@ -96,6 +96,7 @@ function removeEscapeListenerIfIdle() {
     document.removeEventListener('keydown', onDocumentKeydown, true);
 }
 function removeEntry(entry) {
+    var _a;
     const idx = stack.indexOf(entry);
     if (idx < 0)
         return; // already closed — idempotent
@@ -104,6 +105,7 @@ function removeEntry(entry) {
     entry.host.remove();
     syncBackdrop();
     removeEscapeListenerIfIdle();
+    (_a = entry.onClose) === null || _a === void 0 ? void 0 : _a.call(entry);
 }
 function openModal(Content, props, options) {
     const root = getLayerRoot('modal');
@@ -138,6 +140,7 @@ function openModal(Content, props, options) {
     entry.host = host;
     entry.frame = frame;
     entry.handle = handle;
+    entry.onClose = options === null || options === void 0 ? void 0 : options.onClose;
     stack.push(entry);
     syncBackdrop();
     ensureEscapeListener();

package/dist/overlays/modal.test.js

@@ -88,6 +88,51 @@ describe('modal — back-cascade integration', () => {
         expect(layerRoot.querySelectorAll('.sh3-modal-host').length).toBe(0);
     });
 });
+describe('modal — onClose callback', () => {
+    let layerRoot;
+    beforeEach(() => {
+        layerRoot = makeLayerRoot();
+    });
+    afterEach(() => {
+        modalManager.closeAll();
+        teardownLayerRoot(layerRoot);
+    });
+    it('fires onClose when handle.close() is called', async () => {
+        let calls = 0;
+        const handle = modalManager.open(DummyFrame, {}, { onClose: () => calls++ });
+        await tick();
+        handle.close();
+        await tick();
+        expect(calls).toBe(1);
+    });
+    it('fires onClose on backdrop dismissal', async () => {
+        let calls = 0;
+        modalManager.open(DummyFrame, {}, { dismissOnBackdrop: true, onClose: () => calls++ });
+        await tick();
+        const frame = layerRoot.querySelector('.modal-frame');
+        frame.dispatchEvent(new MouseEvent('click', { bubbles: true }));
+        await tick();
+        expect(calls).toBe(1);
+    });
+    it('fires onClose on closeAll', async () => {
+        let calls = 0;
+        modalManager.open(DummyFrame, {}, { onClose: () => calls++ });
+        modalManager.open(DummyFrame, {}, { onClose: () => calls++ });
+        await tick();
+        modalManager.closeAll();
+        await tick();
+        expect(calls).toBe(2);
+    });
+    it('does not fire onClose twice when close() is called repeatedly (idempotent)', async () => {
+        let calls = 0;
+        const handle = modalManager.open(DummyFrame, {}, { onClose: () => calls++ });
+        await tick();
+        handle.close();
+        handle.close();
+        await tick();
+        expect(calls).toBe(1);
+    });
+});
 describe('modal — overlay host marker', () => {
     let layerRoot;
     beforeEach(() => {

package/dist/overlays/types.d.ts

@@ -53,4 +53,13 @@ export interface ModalOptions {
      * palette on touch-only devices).
      */
     initialFocus?: boolean;
+    /**
+     * Invoked after the modal has been torn down — from any dismissal
+     * path (handle.close(), Escape, backdrop click, closeAll). Use this
+     * to reset caller-side "is open" state instead of wrapping
+     * handle.close after open() returns: by then the manager has already
+     * passed handle.close by reference to ModalFrame and onBackdropClick,
+     * so post-hoc wraps would be bypassed by every real dismissal.
+     */
+    onClose?: () => void;
 }

package/dist/primitives/widgets/DocumentFilePicker.svelte

@@ -1,10 +1,12 @@
-<script lang="ts">
+<script lang="ts" generics="M extends 'open' | 'save'">
   import type { CommitOnlyEvents } from './_contract';
   import { sh3 } from '../../sh3Runtime.svelte';
   import DocumentBrowser from './_DocumentBrowser.svelte';
   import type { DocumentMeta } from '../../documents/types';
   import type { DocEntry, OpenerValue, SaverValue } from './DocumentFilePicker';
 
+  type ValueFor<Mode extends 'open' | 'save'> = Mode extends 'open' ? OpenerValue : SaverValue;
+
   type DocListFn = () => Promise<Array<DocumentMeta & { shardId: string }>>;
   type FolderListFn = (shardId: string, prefix: string) => Promise<string[]>;
   type HandleFn = {
@@ -17,7 +19,7 @@
 
   let {
     mode,
-    value = $bindable<OpenerValue | SaverValue>(null),
+    value = $bindable<ValueFor<M>>(null as ValueFor<M>),
     listDocuments,
     listFolders,
     handle,
@@ -29,8 +31,8 @@
     selectable = 'file',
     onchange,
   }: {
-    mode: 'open' | 'save';
-    value?: OpenerValue | SaverValue;
+    mode: M;
+    value?: ValueFor<M>;
     listDocuments: DocListFn;
     listFolders?: FolderListFn;
     handle?: HandleFn;
@@ -40,7 +42,7 @@
     size?: 'sm' | 'md';
     buttonLabel?: string;
     selectable?: 'file' | 'folder' | 'both';
-  } & CommitOnlyEvents<OpenerValue | SaverValue> = $props();
+  } & CommitOnlyEvents<ValueFor<M>> = $props();
 
   let trigger = $state<HTMLButtonElement | undefined>(undefined);
   let openFlag = $state(false);
@@ -56,8 +58,8 @@
   );
 
   function handleCommit(result: OpenerValue | SaverValue) {
-    value = result;
-    onchange?.(result);
+    value = result as ValueFor<M>;
+    onchange?.(result as ValueFor<M>);
   }
 
   function onOpenClosed() {

package/dist/primitives/widgets/DocumentFilePicker.svelte.d.ts

@@ -1,32 +1,49 @@
 import type { CommitOnlyEvents } from './_contract';
 import type { DocumentMeta } from '../../documents/types';
 import type { OpenerValue, SaverValue } from './DocumentFilePicker';
-type DocListFn = () => Promise<Array<DocumentMeta & {
-    shardId: string;
-}>>;
-type FolderListFn = (shardId: string, prefix: string) => Promise<string[]>;
-type HandleFn = {
-    mkdir: (shardId: string, path: string) => Promise<void>;
-    rmdir: (shardId: string, path: string, opts: {
-        recursive: boolean;
-    }) => Promise<void>;
-    renameFolder: (shardId: string, oldPath: string, newPath: string) => Promise<void>;
-    rename: (shardId: string, oldPath: string, newPath: string) => Promise<void>;
-    delete: (shardId: string, path: string) => Promise<void>;
+declare function $$render<M extends 'open' | 'save'>(): {
+    props: {
+        mode: M;
+        value?: M extends "open" ? OpenerValue : SaverValue;
+        listDocuments: () => Promise<Array<DocumentMeta & {
+            shardId: string;
+        }>>;
+        listFolders?: (shardId: string, prefix: string) => Promise<string[]>;
+        handle?: {
+            mkdir: (shardId: string, path: string) => Promise<void>;
+            rmdir: (shardId: string, path: string, opts: {
+                recursive: boolean;
+            }) => Promise<void>;
+            renameFolder: (shardId: string, oldPath: string, newPath: string) => Promise<void>;
+            rename: (shardId: string, oldPath: string, newPath: string) => Promise<void>;
+            delete: (shardId: string, path: string) => Promise<void>;
+        };
+        readOnlyShard?: (shardId: string) => boolean;
+        disabled?: boolean;
+        invalid?: boolean;
+        size?: "sm" | "md";
+        buttonLabel?: string;
+        selectable?: "file" | "folder" | "both";
+    } & CommitOnlyEvents<M extends "open" ? OpenerValue : SaverValue>;
+    exports: {};
+    bindings: "value";
+    slots: {};
+    events: {};
 };
-type $$ComponentProps = {
-    mode: 'open' | 'save';
-    value?: OpenerValue | SaverValue;
-    listDocuments: DocListFn;
-    listFolders?: FolderListFn;
-    handle?: HandleFn;
-    readOnlyShard?: (shardId: string) => boolean;
-    disabled?: boolean;
-    invalid?: boolean;
-    size?: 'sm' | 'md';
-    buttonLabel?: string;
-    selectable?: 'file' | 'folder' | 'both';
-} & CommitOnlyEvents<OpenerValue | SaverValue>;
-declare const DocumentFilePicker: import("svelte").Component<$$ComponentProps, {}, "value">;
-type DocumentFilePicker = ReturnType<typeof DocumentFilePicker>;
+declare class __sveltets_Render<M extends 'open' | 'save'> {
+    props(): ReturnType<typeof $$render<M>>['props'];
+    events(): ReturnType<typeof $$render<M>>['events'];
+    slots(): ReturnType<typeof $$render<M>>['slots'];
+    bindings(): "value";
+    exports(): {};
+}
+interface $$IsomorphicComponent {
+    new <M extends 'open' | 'save'>(options: import('svelte').ComponentConstructorOptions<ReturnType<__sveltets_Render<M>['props']>>): import('svelte').SvelteComponent<ReturnType<__sveltets_Render<M>['props']>, ReturnType<__sveltets_Render<M>['events']>, ReturnType<__sveltets_Render<M>['slots']>> & {
+        $$bindings?: ReturnType<__sveltets_Render<M>['bindings']>;
+    } & ReturnType<__sveltets_Render<M>['exports']>;
+    <M extends 'open' | 'save'>(internal: unknown, props: ReturnType<__sveltets_Render<M>['props']> & {}): ReturnType<__sveltets_Render<M>['exports']>;
+    z_$$bindings?: ReturnType<__sveltets_Render<any>['bindings']>;
+}
+declare const DocumentFilePicker: $$IsomorphicComponent;
+type DocumentFilePicker<M extends 'open' | 'save'> = InstanceType<typeof DocumentFilePicker<M>>;
 export default DocumentFilePicker;

package/dist/primitives/widgets/ShardPicker.svelte

@@ -0,0 +1,38 @@
+<script lang="ts">
+  import type { CommitOnlyEvents } from './_contract';
+  import PickerList from './PickerList.svelte';
+  import type { PickerItem } from './PickerList';
+  import { listRegisteredShards } from '../../shards/lifecycle.svelte';
+
+  let {
+    value = $bindable<string[]>([]),
+    onchange,
+    disabled = false,
+    size = 'md',
+  }: {
+    value?: string[];
+    disabled?: boolean;
+    size?: 'sm' | 'md';
+  } & CommitOnlyEvents<string[]> = $props();
+
+  const items = $derived<PickerItem[]>(
+    listRegisteredShards()
+      .filter((m) => m.kind === 'service')
+      .map((m) => ({ id: m.id, label: m.label, sublabel: m.id }))
+      .sort((a, b) => a.label.localeCompare(b.label)),
+  );
+
+  function handleChange(next: string[]) {
+    value = next;
+    onchange?.(next);
+  }
+</script>
+
+<PickerList
+  {items}
+  {value}
+  onchange={handleChange}
+  {disabled}
+  {size}
+  emptyText="No service shards installed."
+/>