[codex] Harden Summon public beta packaging

.changeset/curated-public-api.md

@@ -0,0 +1,10 @@
+---
+"@anarchitecture/summon": minor
+"@anarchitecture/summon-server": patch
+"@anarchitecture/summon-react": patch
+---
+
+Curate the root Summon export to the beta host-authoring API and move advanced
+browser, engine, and host runtime APIs behind explicit public subpaths. Packed
+server and React packages now import those public subpaths instead of relying on
+root export leakage.

.github/ISSUE_TEMPLATE/bug-report.md

@@ -1,31 +1,43 @@
 ---
-name: 🐛 Bug Report
-about: Thank you for taking the time, please report a reproducible bug
-title: "[Bug] <Bug Title Here>"
+name: Bug report
+about: Report a reproducible Summon bug
+title: "[Bug] "
 labels: bug
-assignees: add codeowner's @name here 
-
 ---
 
-**Describe the bug**
-*A clear and concise description of what the bug is.*
+## Summary
+
+What broke?
+
+## Reproduction
+
+1.
+2.
+3.
+
+## Expected Behavior
+
+What should have happened?
+
+## Actual Behavior
+
+What happened instead?
+
+## Environment
 
-**To Reproduce:**
-*Steps to reproduce the behavior:*
-1. Go to '...'
-2. Click on '....'
-3. Scroll down to '....'
-4. See error
+- Package and version:
+- Browser/runtime:
+- Operating system:
+- Node/pnpm versions:
 
-**Expected behavior:**
-*A clear and concise description of what you expected to happen.*
+## Generated Surface Context
 
-**Supporting Material**
-*If applicable, add screenshots, output log and/or other documentation to help explain your problem.*
+If this involves generated output, include the smallest useful protocol snippet,
+surface plan, validation issue, or Devtools event. Do not include credentials,
+private user data, or secrets.
 
-**Environment (please complete the following information):**
- - OS: [ex: iOS]
- - Version 
+## Sandbox Or Security Impact
 
-**Additional context**
-Add any other context that you feel is relevant about the problem here.
+Does this involve sandbox containment, grant bypass, CSP behavior, iframe
+configuration, or host-owned data exposure? If yes, do not file a public issue
+for exploitable behavior; use GitHub private vulnerability reporting instead.

.github/ISSUE_TEMPLATE/config.yml

@@ -1,4 +1,2 @@
-contact_links:
-    - name: ❓ Questions and Help 🤔
-      url: https://discord.gg/block-opensource (/add your discord channel if applicable)
-      about: This issue tracker is not for support questions. Please refer to the community for more help. 
+blank_issues_enabled: true
+contact_links: []

.github/workflows/release.yml

@@ -18,7 +18,7 @@ jobs:
   release:
     name: Version or publish
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 35
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -34,9 +34,7 @@ jobs:
 
       - run: pnpm install --frozen-lockfile
 
-      - run: pnpm build
-
-      - run: pnpm check:public-packages
+      - run: pnpm exec playwright install --with-deps chromium webkit
 
       - name: Create Release PR or publish
         uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1.7.0

CODEOWNERS

@@ -1,24 +1 @@
-# This CODEOWNERS file denotes the project leads
-# and encodes their responsibilities for code review.
-
-# Instructions: At a minimum, replace the '@GITHUB_USER_NAME_GOES_HERE'
-# here with at least one project lead.
-
-# Lines starting with '#' are comments.
-# Each line is a file pattern followed by one or more owners.
-# The format is described: https://github.blog/2017-07-06-introducing-code-owners/
-
-# These owners will be the default owners for everything in the repo.
-*       @nahiyankhan
-
-
-# -----------------------------------------------
-# BELOW THIS LINE ARE TEMPLATES, UNUSED
-# -----------------------------------------------
-# Order is important. The last matching pattern has the most precedence.
-# So if a pull request only touches javascript files, only these owners
-# will be requested to review.
-# *.js    @octocat @github/js
-
-# You can also use email addresses if you prefer.
-# docs/*  docs@example.com
+* @nahiyankhan

CODE_OF_CONDUCT.md

@@ -0,0 +1,6 @@
+# Code Of Conduct
+
+Summon follows Block's open-source community standards.
+
+See the Block organization code of conduct:
+https://github.com/block/.github/blob/main/CODE_OF_CONDUCT.md

CONTRIBUTING.md

@@ -0,0 +1,67 @@
+# Contributing To Summon
+
+Thanks for helping make Summon sturdier. Summon is pre-1.0, so public APIs can
+still move, but changes should preserve the core boundary: generated artifacts
+describe UI; the host owns grants, handlers, state, network, credentials, and
+persistence.
+
+## Local Setup
+
+```sh
+pnpm install --frozen-lockfile
+cp apps/server/.env.example apps/server/.env
+# optional for generation demos: set ANTHROPIC_API_KEY in apps/server/.env
+pnpm dev:all
+```
+
+The browser demo runs at `http://localhost:5173/generate.html`.
+
+## Required Checks
+
+Run the focused checks for your change, then run the full release gate before a
+public package or sandbox-boundary change:
+
+```sh
+pnpm typecheck
+pnpm test
+pnpm build
+pnpm check:public-packages
+pnpm check:public-api
+pnpm pack:dry-run
+pnpm smoke:public-packages
+pnpm test:safety
+```
+
+`pnpm test:safety` runs Chromium and WebKit smoke tests for sandbox containment,
+strict input, component islands, startup fatal checks, and generate-page boot.
+Run it before changing iframe attributes, CSP, postMessage routing, bootstrap
+startup checks, script policy, grants, or component overlay behavior.
+
+## Package Boundary
+
+Applications should import public packages only:
+
+- `@anarchitecture/summon` for host-authoring helpers and surface-plan types.
+- `@anarchitecture/summon/browser` for iframe/runtime browser helpers.
+- `@anarchitecture/summon/engine` for protocol, validation, prompt contracts,
+  stream graph, and other advanced engine APIs.
+- `@anarchitecture/summon/host` for adapter authors needing the full host
+  runtime surface.
+- `@anarchitecture/summon-server` for provider-neutral generation lifecycle.
+- `@anarchitecture/summon-react` for React rendering and component islands.
+
+Do not import `src/*.ts` paths or `@summon-internal/*` packages from apps,
+examples, docs, or public package builds. If a public export changes, update
+`scripts/check-public-api.mjs`, package-consumption docs, and the packed-package
+smoke test in the same change.
+
+## Changesets
+
+Public package changes need a changeset:
+
+```sh
+pnpm changeset
+```
+
+Private `@summon-internal/*` implementation packages and demo apps are ignored
+by Changesets; describe public impact on `@anarchitecture/*` packages.

README.md

@@ -82,9 +82,9 @@ generation starts. The model sees that plan as a contract but cannot widen it.
 
 ## Public Packages
 
-- `@anarchitecture/summon` - core protocol, surface plans, host contract
-  helpers, diagnostics primitives, and explicit browser/policy/envelope/assets/
-  Devtools subpaths.
+- `@anarchitecture/summon` - curated host-authoring helpers, policy helpers,
+  and surface-plan APIs. Advanced browser, engine, host, policy, envelope,
+  assets, and Devtools APIs live on explicit subpaths.
 - `@anarchitecture/summon-server` - provider-neutral generation lifecycle,
   repair, summaries, and model-provider interfaces.
 - `@anarchitecture/summon-react` - `SummonSurface` and React component island
@@ -137,6 +137,8 @@ pnpm typecheck
 pnpm test
 pnpm test:safety
 pnpm build
+pnpm check:public-api
+pnpm smoke:public-packages
 pnpm pack:dry-run
 pnpm dev:all
 pnpm port-direction <path-to-expression.md> [id]

SECURITY.md

@@ -0,0 +1,18 @@
+# Security Policy
+
+Summon's security model depends on a null-origin iframe, restrictive CSP,
+host-owned grants, schema-validated policy dispatch, and explicit capability
+contracts. Reports involving sandbox escape, grant bypass, CSP weakening,
+forged `postMessage` routing, host data exposure, or credential access should
+not be filed as public issues.
+
+Use GitHub private vulnerability reporting for this repository. Include:
+
+- A minimal reproduction.
+- Browser/runtime and operating system.
+- Generated protocol lines or HTML involved, if applicable.
+- The selected `SurfacePlan`, granted intents, and granted capabilities.
+- Whether the issue affects static, declarative, scripted, worker, or component
+  island surfaces.
+
+For non-exploitable bugs, use the public bug report template.

apps/demo/src/batch-main.ts

@@ -1,11 +1,10 @@
+import { PolicyEngine, type CapabilityPack } from '@anarchitecture/summon';
 import { spawnSandbox, type SandboxHandle } from '@anarchitecture/summon/browser';
-import { PolicyEngine } from '@anarchitecture/summon/policy';
 import {
   parseProtocolLine,
   SectionAccumulator,
-  type CapabilityPack,
   type ValidationCapability,
-} from '@anarchitecture/summon';
+} from '@anarchitecture/summon/engine';
 import bootstrapSource from '@anarchitecture/summon/bootstrap.js?raw';
 import defaultTokensSource from '@anarchitecture/summon/tokens.css?raw';
 import { ALL_PROMPTS, sample } from './prompts.js';

apps/demo/src/generate-main.ts

@@ -1,38 +1,40 @@
 import {
-  type ComponentIslandRegistry,
-  type SurfaceStreamContext,
-  type SurfaceStreamResult,
   consumeSurfaceStream,
   createComponentIslandRegistry,
   spawnSandbox,
+  type ComponentIslandRegistry,
   type SandboxHandle,
+  type SurfaceStreamContext,
+  type SurfaceStreamResult,
 } from '@anarchitecture/summon/browser';
 import {
   createSurfaceEnvelope,
   parseSurfaceEnvelope,
   type SurfaceEnvelope,
 } from '@anarchitecture/summon/envelope';
-import { PolicyEngine } from '@anarchitecture/summon/policy';
+import {
+  parseTokenValues,
+  SectionAccumulator,
+  type ProtocolLine,
+  type SummonLayout,
+  type ValidationCapability,
+  type ValidationComponent,
+} from '@anarchitecture/summon/engine';
 import {
   deriveSurfacePlanControls,
   normalizeSurfacePlan,
-  SectionAccumulator,
+  PolicyEngine,
   SURFACE_AUTHORITY_VALUES,
   SURFACE_DATA_VALUES,
   SURFACE_PERSISTENCE_VALUES,
   SURFACE_PURPOSE_VALUES,
   SURFACE_RUNTIME_VALUES,
-  type ProtocolLine,
   type CapabilityPack,
   type ComponentPack,
   type ScriptPolicy,
   type SurfaceCeiling,
   type SurfacePlan,
-  type SummonLayout,
-  type ValidationCapability,
-  type ValidationComponent,
 } from '@anarchitecture/summon';
-import { parseTokenValues } from '@summon-internal/engine';
 import { createEventStore, type DevtoolsEvent } from '@anarchitecture/summon/devtools';
 import bootstrapSource from '@anarchitecture/summon/bootstrap.js?raw';
 import defaultTokensSource from '@anarchitecture/summon/tokens.css?raw';

apps/demo/src/strict-main.ts

@@ -8,13 +8,15 @@
  * in. The architectural property — outer describes, host renders — is the
  * same regardless of the tokenizer.
  */
+import {
+  PolicyEngine,
+} from '@anarchitecture/summon';
 import {
   spawnSandbox,
   createStrictInputRegistry,
   type SandboxHandle,
   type StrictInputController,
 } from '@anarchitecture/summon/browser';
-import { PolicyEngine } from '@anarchitecture/summon/policy';
 import bootstrapSource from '@anarchitecture/summon/bootstrap.js?raw';
 import tokensSource from '@anarchitecture/summon/tokens.css?raw';
 import { STRICT_DEMO_BODY_HTML } from './strict-demo-artifact.js';

apps/server/src/component-pack.ts

@@ -1,9 +1,11 @@
 import type {
-  ComponentExample,
   ComponentPack,
-  ComponentSizing,
   ComponentSurface,
 } from '@anarchitecture/summon';
+import type {
+  ComponentExample,
+  ComponentSizing,
+} from '@anarchitecture/summon/engine';
 
 /**
  * Validate a component pack sent by the client. The server remains renderer

apps/server/src/directions-loader.ts

@@ -5,7 +5,7 @@ import {
   compileDirectionContract,
   coerceOpts,
   type DirectionOpts,
-} from '@summon-internal/engine';
+} from '@anarchitecture/summon/engine';
 
 export const PREFERRED_DEFAULT_DIRECTION_ID = 'ghost';
 

apps/server/src/generate-route.test.ts

@@ -6,7 +6,8 @@ import { createServer, type IncomingMessage } from 'node:http';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import test from 'node:test';
-import type { CapabilityPack, ProtocolLine, SurfaceCeiling, SurfacePlan } from '@anarchitecture/summon';
+import type { CapabilityPack, SurfaceCeiling, SurfacePlan } from '@anarchitecture/summon';
+import type { ProtocolLine } from '@anarchitecture/summon/engine';
 
 const here = dirname(fileURLToPath(import.meta.url));
 const packageRoot = resolve(here, '..');

apps/server/src/ghost-adapter.ts

@@ -8,8 +8,7 @@ import {
   type GhostMemoryStackLayer,
   type PackageMemory,
 } from '@anarchitecture/ghost/scan';
-import type { ProtocolLine } from '@anarchitecture/summon';
-import { compileTokenContract } from '@summon-internal/engine';
+import { compileTokenContract, type ProtocolLine } from '@anarchitecture/summon/engine';
 import { existsSync, readFileSync, statSync } from 'node:fs';
 import { mkdtemp, readFile, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';

apps/server/src/main.ts

@@ -3,13 +3,15 @@ import cors from 'cors';
 import Anthropic from '@anthropic-ai/sdk';
 import {
   type CapabilityPack,
+  type ScriptPolicy,
+} from '@anarchitecture/summon';
+import {
+  parseTokenValues,
   type ContractPromptBlock,
   type ProtocolLine,
-  type ScriptPolicy,
   type SummonLayout,
   type TokenOverride,
-} from '@anarchitecture/summon';
-import { parseTokenValues } from '@summon-internal/engine';
+} from '@anarchitecture/summon/engine';
 import {
   resolveSurfaceGenerationPlan,
   runSurfaceGeneration,